dazziling ece

REMOTE CONTROLLED METAL DETECTING ROBOT

2014-10-23T02:25:00.000-07:00

The aim of this project is to control the operation of movement of a remote controlled robot to detect metals and to view the images surrounding the robot.

The main objectives of this project are to use radio frequency bands.

Ø The movement of robot is controlled by the transmission of signals through air.

Ø The receiver senses these signals from the air..

Ø This mini project makes use of the transmitter and receiver at 433MHz that is available at low cost hence making it very complicated.

Ø The Radio Frequency based control proves to be more advantageous compared to the Infrared Red based control that limits the operating range to only a few meters of distance.

Ø When the robot is moving on a surface, the system produces a beep sound when metal is detected. This beep sound will be transmitted to remote place. Simultaneously the images around the robot will be transmitted to remote place. User can monitor the images and metal detection alarms on Television.

DOWNLOAD FULL PROJECT DETAILS

2014-10-10T06:41:00.000-07:00

yeahhhh........

i will continue this blog again with more great things that will be useful for you

its over an year after the last post ......

expect all you support to continue with great passion

da thadiyaaaaa part 2

2012-11-29T10:31:00.001-08:00

da thadiyaaaaaaaaaaaaa...

da thadiyaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
staring: Ramkumar s pillai

kidilam sanjay

2012-11-29T09:21:00.002-08:00

our own sanju mon.......he rocks

Data Allocation Using Genetic Algorithm for MPSoC Systems with Hybrid Scratch-Pad Memory-paper presentation

2012-11-22T08:49:00.002-08:00

Data Allocation Using Genetic Algorithm for MPSoC Systems with Hybrid Scratch-Pad Memory

Zhi Chen, Meikang Qiu,JianweiNiu2, Zhonghai Lu, Yongxin Zhu

Dept. of Electrical and Computer Engineering, University of Kentucky, Lexington, KY 40506, USA

School of Computer Science and Engineering, Beihang University, Beijing100191, China

Dept. of Electronic Systems, KTH Royal Institute of Technology, Stockholm, Sweden

School of Microelectronics, Shanghai Jiao Tong University, Shanghai 200240, China

Abstract

Hybrid on-chip memory architecture has gathered muchattention recently. However, if not well managed and optimized, the memory access will be a major energy and time consumer for this architecture. This paper presents a novel hybrid Scratch-Pad Memory (SPM) comprising SRAM and Magnetic RAM(MRAM) for MultiProcessor System-on-Chip(MPSoC) architectures. To reduce memory access costs and write activities on MRAMs, we propose a novel adaptive genetic algorithm to efficiently allocate data to each memory unit of the hybrid SPM. Experimental results show that the proposed genetic algorithm can reduce write operations to MRAMs by 28.33% and energy consumption by 15.32% on average.

1 Introduction

The high cost of memory access, involving latency and energy consumption, becomes a major limiting-factor for the advancement of multiprocessor system-on-chip(MP-SoC) architectures [7]. For example, caches consume up to 43% of the overall power in the ARM920T processor [5].

Scratch Pad Memory(SPM), a software-managed on-chip memory, has been widely employed by key manufactur-ers, due to its power efficiency and high predictability. Itis demonstrated that a SPM consumes 34% smaller chip area and 40% lower energy consumption than a cache mem-ory [2]. For advantages in power, area, and predictability, SPM is a promising technique to replace the existing hard-ware cache.

Traditionally, SPM is based on SRAM technology which is competitive in the speed of memory access but con-sumes large amounts of leakage power. Magnetic RAM(MRAM) has attractive properties in density, access speed, and standby leakage [3]. However, MRAM suffers longwrite latency and high write energy consumption, whichhinders the utilization of them as a pure SPM. In this paper, we propose a hybrid SPM architecture integrating both SRAM and MRAM as the on-chip memory to pro-mote memory access performance and alleviate the daunting “memory wall” problem for MPSoC architectures Stacked 3D integration technique can vertically stackand integrate various technologies and functional compo-nents on a die. This technique has facilitated the imple-mentation of the 3D stacked hybridcache architectures in

[9, 11]. Based on the hybrid cache architecture, we pro-pose a hybrid SPM architecture consisting of SRAM and MRAM, which manages data at the software level.

Prior works have investigated the hybrid cache by usingSRAM and MRAM and proven that the hybrid architecturecan save significant volumes of power [9, 11]. In [11], Wuet al. studied inter- and intra- cache level hybrid cache ar-chitectures, including the hardware implementation to sup-port intra cache data movement and reduce energy con-sumption. However, these mechanisms are primarily pro-posed for hardware caches while unsuitable for software-controlled SPMs. In the context of the data allocation in

MPSoC systems with SPM, Avissar et al. [1] proposed a static method to allocate data on SPMs for scalar and ar-ray variables. While Padan et al. [6] explored partitioning strategies for exploiting the potential of on-chip SPMs, theydidn’t account for hybrid SPMs architectures.

Since frequent writes to MRAMs will aggravate the performance, power consumption, and lifetime issues of

MRAMs, it is critical to design appropriate data allocation mechanisms to reduce the undesirable high cost of writes on MRAMs. Targeting the advantages of different mem-ory units of the hybrid SPM architecture, we propose a novel adaptive genetic algorithm,Adaptive Genetic Algo-rithm for Data Allocation(AGADA), to allocate data to dif-ferent memory modules. The objective of the proposed al-gorithm is to minimize the power consumption of memory systems. To achieve this goal, the rationale of this algorithm

is allocating the most frequently written data to SRAM and the most frequently read data to MRAM. In addition, our AGADA algorithm will adaptively perform crossover ge-netic operations to generate fitter offsprings (solutions).

Our work includes three major contributions: (1) propos-ing a novel hybrid SPM architecture consisting of SRAM and MRAM to obtain both benefits of these two kinds of memory; (2) using a genetic algorithm for data allocation,based on the proposed hybrid SPM; (3) adaptively perform crossover operations to satisfy the memory size constraint.

The rest of the paper is organized as follows. Section 2

introduces the proposed models. Section 3 presents our de-tailed algorithms. The experimental results and conclusions are given in Section 4 and Section 5, respectively.

2 System Model

A. Hardware model.Fig.1(a) exhibits a MPSoC architec-ture with hybrid SPMs. Each core is tightly coupled with alocal SPM that consists of a SRAM and a MRAM. Theprocessor cores access the off-chip DRAM main memorythrough a shared bus, and communicate witheach other via

an interconnect bus. Accessing data stored in SPMs of other processors is called remote access. Generally, accessing thelocal SPM is faster and dissipates less energy than fetch-

ing data from remote SPMs. Off-chip main memory access consumes the most energy.

In addition, when a core accesses a memory unit, it may encountercache miss. In this case, we need to obtain datain another memory unit holding this data. Inevitably, thedata transfer between two remote memories will incur muchhigher overhead. According to the mechanism used in [4],we assume energy consumption for memory B getting data from remote memory A is the sum of the cost of the remote

access to B and the local write to A.

B. Chromosome Model.In the data allocation problem,all data items are randomly allocated to memory units of each core and main memory to form a chromosome, with the constraint of the size of each memory unit. Hence, a chromosome represents an allocation scheme. To perform genetic operations more conveniently, we construct all chromosomes in the list structure, as shown in Fig. 1(b). In this figure, we allocate 5 data to a target system with one processor owning a hybrid SPM. Every element of the list is defined as a data item and a memory unit pair: (d,MT) to indicate that data d is assigned to memory unit MT.In each chromosome, 0, 1, and 2 represent SRAM, MRAM, and off-chip DRAM, respectively. For example, the gene

(A, 0) represents data A is allocated to SRAM.

3 Algorithms

This section focuses on the discussion of the proposed genetic algorithm which consists of three major steps: initialization, evaluation, and genetic operations.The objective function of the target problem is described

as: given the number of local reads Nlr, local writes Nlw,remote reads Nrr, remote writes Nrw, the cost of local read Clr, local write Clw, remote read Crr,remote write Crw, and the cost of data transfer between different processors Cmove, we formulate the total cost of memory access Cm for a specific data as Equation (1).

3.1 Initialization

The initialpopulation is built randomly. To accelerate the search procedure for the solution space, the initial population will include the allocation generated by the greedyalgorithm proposed in [10].

3.2 Fitness Function

The main objective of the data allocation problem is to minimize the overall memory access cost and the number of write operations to MRAMs of a schedule. We define the fitness function of a chromosome i as Equation (2).

where M represents the maximal total cost has been ob-served currently.TOTAL_COST (i)is the total memory access cost of chromosome i. It is the sum of the memory access cost of each gene (data) in this chromosome, which is cal-culated by Equation (3).

where𝑁is the number of data and 𝐶𝑀(𝑗)is the memory access cost of data𝑗that is defined as Equation (1).

Generally, genetic operations include selection,crossover, and mutation. We describe each of them as

follows.

A. Selection. In this paper, we will employ the wheel selection. Based on this method, the higher fitness value an individual has, the more area of it will be assigned on the wheel, and thus the more possible it will be selected when the biased roulette wheel is spun.

3.3 GA Operations

B. Crossover. The crossover operations are conducted according to a probability referred to as crossover rate (PC). We randomly select pairs of chromosomes as parents to generate offsprings. We devise a noveladaptive cy-cle crossover strategyto perform crossover operations for the data allocation problem. This method is modified from thecycle crossoverproposed in [8].

In the cycle crossover approach, the child can efficiently inherit the characteristics from both parents. However, for the data allocation problem, this approach may generate in-valid alleles, due to the size constraint of each memory unit.

An example of such scenario is exhibited in Fig. 2(a), where Parent 1 and Parent 2 indicate the parent chromosomes, and Child is generated by these two chromosomes. In this ex-ample, for simplicity, we assume the target system has one processor core with a hybrid SPM, and each on-chip mem-ory can provide space for only 2 data. 0, 1, and 2 represent SRAM, MRAM, and off-chip main memory, respectively.

As shown in the child chromosome, allocating data𝐷to the MRAM will exceed the maximum capacity of it.

We propose anadaptivecycle crossover strategyto over-come the limitation of the cycle crossover method for our data allocation problem and yield valid data allocations.

The key of our approach is to use a variable to indicate the

currently available space for each memory unit. Before al-locating a data to a specific memory, we will first check if there is enough room for the data. If so, the data will be directly allocated to the memory. Otherwise, we will adap-tively examine the memory units of the neighboring proces-sor cores and find a space for it. However, if all on-chip memory units, including SRAMs and MRAMs, are full, the

data will be assigned to the off-chip main memory. An ex-ample of the adaptive cycle crossover operations is exhib-ited in Fig. 2(b). In this figure, the gene (D,0′)indicatesadaptive adjustment result of data allocation to the MRAM

C. Mutation.The mutation operation is archived by ran-domly flipping bits of a chromosome. It is happened in a certain probability calledmutation rate(PM). Since the gene in this paper is defined as a data item and a memory unit pair, the mutation operation can be performed by swap-ping the position of either the data or the memory units of selected genes. Fig. 2(c) shows an example of mutation to exchange the memory positions of two genes.

The whole procedure of our AGADA algorithm works

as follows. First, we randomly generate an initial popula-tion according to the given population size. After initialization

the fitness value of each individual will be evaluated in light of Equation (3). Then, we iteratively apply the above genetic operations to generate a new population and deter-mine the currently best solution. Finally, the fitness of each individual will be evaluated for the new population. Repeat these procedures until coming to the termination conditions.The details of the AGADA algorithm is described in Algo-rithm 3.1.

4 Experiments

We evaluate our algorithm on a set of benchmarks from PARSEC and run them in M5. To verify the effective-ness of the AGADA algorithm, we implemented it and the greedy algorithm as stand-alone programs that use the memory trace as input. The memory access latencies and

energy consumption are obtained from a modified versionof CACTI by using 65nm technology node.

Our target system is a dual-core in-order MPSoC with a 2MB SRAM and an 8MB MRAM as the hybrid SPM. The baseline configuration is a dual-core MPSoC with a 4MB pure SRAM as the SPM. The specifications of the baseline and the hybrid architecture are given in Table 1.

Generally, the density of MRAM is as 4 times as that of SRAM. Therefore, these two configurations occupy the similar chip areas. We then integrate all these parameters into our custom simulator. 10 applications are selected form PARSEC for simulations: black scholes, bodytrack,canneal, dedup, streamcluster, facesim, fluidanimate, x264,

swaptions, and ferret.

Without loss of generality, the following parameter spec-ifications are set for the simulations of our AGADA algorithm: 1) Population size: 500; 2) Crossover type: adaptivecycle crossover; 3) Crossover rate: 0.85; 4) Mutation rate 0.1; 5) Selection method: roulette wheel; 6) Maximum gen-eration: 2000.

We compare our AGADA algorithm to the greedy algo-rithm with respect to the number of writes to MRAMs, dy-namic energy consumption, and memory access latencies based on the set of benchmarks. Fig. 3 shows that com-pared to the greedy algorithm, our AGADA strategy can re-duce the average number of write operations to MRAMs by 28.33% on average. The major reason is that the greedy

algorithm does not distinguish SRAM from MRAM and only selects the frequently accessed data to SPMs. How-ever, the AGADA algorithm is conscious of write activities to MRAMs, which allocates most frequently read data to MRAMs and most frequently written data to SRAMs. By

reducing the number of writes to MRAMs, the AGADA al-gorithm can efficiently extend endurance of MRAMs. Fig. 4 shows that benefitting from the decrease of write oper-ations to MRAMs, the AGADA algorithm will incur much less dynamic energy consumption than that of the greedy al-gorithm. On average, the AGADA algorithm can reduce dy-namic energy consumption by 15.32% in our experiments.

5 Conclusions and Future Work

This work presented a hybrid SPM architecture consist-ing of SRAM and MRAM to solve the memory wall issue for MPSoC architectures. Based on the hybrid SPM archi-tecture, we proposed a novel data allocation strategy using an adaptive genetic algorithm to reduce the number of write

activities on MRAM. Experimental results showed that our genetic algorithm can contribute to a significant reduction in dynamic power consumption of memory systems and the number of writes to MRAMs compared to a greedy algo-rithm. We plan to investigate the effectiveness of the pro-posed hybrid architecture and the accuracy of the genetic algorithm in the future work.

Acknowledgements

This work was supported in part by the University of

Kentucky Start Up Fund and NSFC 61071061; NSFC

61170296, Fund of Aeronautics Science 20091951020,

New Century Excellent Talents in University 291184; Na-tional High Technology R & D Program of China (863) 2009AA012201.

References

[1] O. Avissar, R. Barua, and D. Stewart. An optimal mem-ory allocation scheme for scratch-pad based embedded sys-tems. ACM Transactions on Embedded Computing Systems

(TECS), 1(1):6–26, 2002.

[2] R. Banakar, S. Steinke, B. S. Lee, M. Balakrishnan, and

R. Marwedel. Scratchpad memory: design alternative

for cache on-chip memory in embedded systems. In

CODES+ISSS ’02, pages 73–78, 2002.

[3] X. Guo, E. Ipek, and T. Soyata. Resistive computation:

Avoiding the power wall with low-leakage, STT-MRAM

based computing. InISCA ’10, pages 371–382, 2010.

[4] Y. Guo, Q. Zhuge, J. Hu, M. Qiu, and E. H.-M. Sha. Optimal

data allocation for scratch-pad memory on embedded multi-core systems. InICPP 2011, pages 464–471, 2011.

[5] J. Montanaro, R. T. Witek, K. Anne, A. J. Black, and E. M.

Cooper. A 160-mhz, 32-b, 0.5-w cmos risc microprocessor.

Digital Technical Journal, 9:49–62, 1997.

[6] P. R. Panda, N. D. Dutt, and A. Nicolau. On-chip vs. off-chip memory: the data partitioning problem in embedded

processor-based systems.ACM Transactions on Design Au-tomation of Electronic Systems, 5(3):682–704, 2000.

[7] M. Qiu and E. H.-M. Sha. Cost minimization while satis-fying hard/soft timing constraints for heterogeneous embed-ded systems. ACM Transactions on Design Automation of

Electronic Systems (TODAES), 14(2):1–30, 2009. (Best Pa-per Award).

[8] K. Shahookar and P. Mazumder. A genetic approach to stan-dard cell placement using meta-genetic parameter optimiza-tion.IEEE Trans. Computer-Aided Design of Integrated Cir-cuits and Systems, 9(5):500–511, 1990.

[9] G. Sun, X. Dong, Y. Xie, J. Li, and Y. Chen. A novel archi-tecture of the 3D stacked MRAM L2 cache for CMPs. In

ISCA ’09, pages 239–249, 2009.

[10] S. Udayakumaran and R. Barua. Compiler-decided dy-namic memory allocation for scratch-pad based embedded

systems. InCASES ’03, pages 276–286, 2003.

[11] X. Wu, J. Li, L. Zhang, E. Speight, R. Rajamony, and Y. Xie.

Hybrid cache architecture with disparate memory technolo-gies. InHPCA ’09, pages 239–249.

Computer Network Routing with a Fuzzy Neural Network-paper presentation

2012-11-21T08:49:00.000-08:00

Computer Network Routing with a Fuzzy Neural Network

Behzad Mahjour Shafiei, Mohammad Amin Saeed, Farshid Iranmanesh, Fariborz Iranmanesh

Kerman Branch, Islamic Azad University, Kerman, Iran.

Behzad Mahjour Shafiei, Mohammad Amin Saeed, Farshid Iranmanesh, Fariborz Iranmanesh;
Computer Network Routing with a Fuzzy Neural Network

ABSTRACT

The growing usage of computer networks is requiring improvements in network technologies and
management techniques so users will receive high quality service. As more individuals transmit data through a
computer network, the quality of service received by the users begins to degrade. A major aspect of computer networks that is vital to quality of service is data routing. A more effective method for routing data through a computer network can assist with the new problemsbeing encountered with today’s growing networks.

Effective routing algorithms use various techniques to determine the most appropriate route for transmitting
data. Determining the best route through a wide area network (WAN), requires the routing algorithm to obtain information concerning all of the nodes, links, and devices present on the network. The most relevant routing information involves various measures that are often obtained in an imprecise or inaccurate manner, thus suggesting that fuzzy reasoning is a natural method to employ in an improved routing scheme. The neural
network is deemed as a suitable accompaniment because it maintains the ability to learn in dynamic situations.
Once the neural network is initially designed, any alterations in the computer routing environment can easily be learned by this adaptive artificial intelligence method. The capability to learn and adapt is essential in today’s rapidly growing and changing computer networks. These techniques, fuzzy reasoning and neural networks, when combined together provide a very effective routing algorithm for computer networks.

Computer simulation is employed to prove the new fuzzy routing algorithm outperforms the Shortest Path First (SPF) algorithm in most computer network situations. The benefits increase as the computer network migrates from a stable network to a more variable one. The advantages of applying this fuzzy routing algorithm are apparent when considering the dynamic nature of modern computer networks.

Key words:Network Routing, Fuzzy Reasoning, Neural Networks, Wide Area Networks

Introduction

Computer networks are rapidly becoming a necessity in today’s business organizations, leading
to an increase in the number of computer networks and network users. As networks become more
abundant, it becomes increasingly necessary to focus on the quality of service that is being provided to the
users of the network. The responsibility of this issue lies with the network management.

Network management involves the monitoring, analysis, control, and planning of activities and
resources of a computer network in order to provide the users with a certain quality of service. The idea is
to ensure that the system is operating effectively and efficiently at all times, so there are no short-term or
long-term service problems.

The proliferation of computer networks increases the need for improved network management techniques. As computer networks expand, they become more complex as they attempt to support a more diverse selection of applications and users. The problems associated with supporting more users are exposed when the network seeks to provide each user with an expected quality of service. Problems concerning congestion, unacceptable throughput, bottlenecks, security, equipment failure and poor response times are immediate results of growing networks that can represent an unacceptable quality of service. It has become a necessary and challenging task to provide efficient utilization by ensuring that the network remains accessible and uncrowded.

The International Organization for Standardization (ISO) has defined five areas as the
key areas of network management: fault management, accounting management, configuration
management, security management and performance management. Fault management is the collection of
services that enables the detection, isolation and correction of abnormal operations transpiring in the
managed network. The absence of fault management causes the network to become vulnerable to
additional operational irregularities. A variety of tools is currently available to assist the network
manager in fault management tasks, the majority of which automate the discovering of a fault by
determining communication or lack of communication with the network devices. The remaining tasks of fault management are usually performed by the network manager. Accounting management tracks network resource utilization for each individual and each group in order for the
network manager to provide the appropriate quantity of resources. It is also used to establish metrics,
check quotas, determine costs, and bill users. The information gathered in accounting management can
also help determine if users are abusing their privileges or transmitting data in such a way that
diminishes performance. Security management controls access to information on the network
(Stallings 1990). This provides protection for sensitive information that may exist in the system.
Without this part of network management, there is no systematic manner to distribute, store and authorize
passwords. Having the ability to maintain secure access to restricted information is necessary in most
computer networks. Performance management monitors the network to ensure its accessibility so
that users may utilize it efficiently. Two processes are involved in performance management:
monitoring and controlling. Monitoring traces activities occurring on the network while the
controlling function provides a way to adjust the network in order to improve performance. The
activities that are monitored provide the network manager with measures such as capacity usage,
amount of traffic, throughput levels, and response times.

Configuration management involves obtaining data from the network in order to manage the setup
of the network devices. It includes the processes of network planning, resource planning and service
planning. It also includes traffic management, the process of routing data correctly through a network.
The process of configuration management provides an organized approach to changing and updating
segments and devices on the network. The five network management areas differ in
intricacy, depending on the type of network. A computer network can be categorized into one of
three categories: local area networks, metropolitan area networks, or wide area networks. The overall
concept of each type is virtually the same; the difference lies within the size of the network. Local
area networks (LANs) are networks that connect equipment within a single building or a group of
neighboring buildings. Metropolitan area networks (MANs) are used to connect computer systems
within an area the size of a city. A MAN is commonly developed by combining many LANs
with a public telecommunication provider. A wide area network (WAN) connects many smaller
networks, either metropolitan or local area networks.

There is no specified distance that must lie between the smaller networks. A WAN connects smaller
networks that are in different parts of a city, different cities, or different countries. Such large amounts of
time and money are being invested into computer networks today that it has become both desirable and
cost-effective to automate parts of the network management process. Applying artificial intelligence
to specific areas of network management allows the network engineer to dedicate additional time and
effort to the more specialized and intricate details of the system. Many forms of artificial intelligence have
previously been introduced to network management; however, it appears that one of the more applicable
areas, fuzzy reasoning, has been somewhat overlooked.

Computer network managers are often challenged with decision-making based on vague or
partial information. Similarly, computer networks frequently perform operational adjustments based on
this same vague or partial information. The imprecise nature of this information can lead to difficulties and
inaccuracies when automating network management using currently applied artificial intelligence
techniques. Fuzzy reasoning will allow this type of imprecise information to be dealt with in a precise
and well-defined manner, providing a more flawless method of automating the network management
decision making process.
Statement of the Problem:
The overall goal of network management is to provide network users with an acceptable quality of
service. To reach this goal, network managers are trying to automate as many network operations tasks
as possible. Many currently available network management systems are automated in order to assist
managers in obtaining vital information necessary to achieve the desired quality-of-service. As a result,
network managers are discovering that measurable productivity improvements can be obtained through
automation of the straightforward management tasks [11].

Recent attempts at automation include integrating artificial intelligence into network
management systems using neural networks, expert systems, and genetic algorithms. These methods have
successfully diminished the time and effort required of the network manager by reducing the amount of
interaction that is needed. One important issue that is encountered when attempting to automate segments
of the network management process involves the inaccuracy of the results because of imprecise data.

Many factors involved in network management cannot easily be described in a precise manner
because they are either descriptors concerning the unknown future of the network, or ones that are
quantified into groups having no definite boundaries.For example, when analyzing the performance of a network, we can characterize the network as being either reliable or unreliable. However, it is evident
that there will be no single point that defines the cutoff between reliable and unreliable. Instead, there
will be a fuzzy area between the two that describes a network as being somewhat reliable and somewhat
unreliable. This type of imprecise information is very prominent in network management tasks. If methods
can be developed to take into account this imprecise information, more meaningful results can be reported.

The literature currently indicates the successful application of artificial intelligence techniques to the
five areas of network management. However, there is very little acknowledgment that the information
required for network management is such that it cannot be accurately defined with an exact
descriptor. This has caused many inaccurate assumptions when attempting to automate the
network management system. Applying fuzzy reasoning to these automation processes could
alleviate the problem of inaccuracy and allow for more flawless results and analyses. An issue that is
burdening many computer network managers is increasing traffic. All types of networks are
experiencing this problem to some degree. For example, frame relay usage is experiencing massive growth and corresponding traffic problems. Three of the major frame relay communications corporations,
MCI Communications, Sprint and LDDS WorldCom have all confirmed their traffic levels are growing
monthly by fifteen to twenty percent. The growth seen by these companies is analogous to the growth
being experienced by all types of computer networks around the globe Increasing traffic loads will
naturally lead to network delays, which will lead to other problems as well. These network delays can
easily cause dropped sessions or lost data, not to mention dissatisfied users. It is impossible to stem
this increasing traffic load. However, optimal routing of messages within a network can mitigate some of
the difficulties of heavy traffic. Therefore, a more efficient method of routing needs to be developed to
combat network delays.

Research Methodology:

This research is divided into three phases. The initial phase involves designing the simulation model
to be used for obtaining data. The simulation will mimic a given computer network and its routing
process. Once developed, the fuzzy algorithm will be applied to the given scenario and then simulated in
order to analyze the proposed methods. The second phase consists of developing the specifics of the
routing algorithm. This involves devising the fuzzy logic details as well as the details pertaining to the
neural network. This phase is the focus of the study and therefore requires the most detail and
explanation. Finally, the proposed method will be analyzed and compared to a current method that does
not involve fuzzy reasoning. The comparison will involve the simulation model being applied to an
example network situation. The complete methodology will be described in detail in chapter
four.

Manipulating Fuzzy Sets:

Once the fuzzy sets have been defined, several approaches are available for manipulating those sets. The first and most common is a rule based approach. This approach was employed in the previous attempt
of fuzzy reasoning applied to network routing [2]. The second approach involves using neural networks
to process the information obtained from fuzzy sets. Neural networks are utilized in this study; therefore,
an explanation for processing fuzzy sets with neural networks is provided in the next section. Appendix A
contains a discussion of the rule based approach for the interested reader.

Neural Networks:

A neural network is an artificial intelligence technique originally designed to mimic the functionality of the human brain. It is a non-algorithmic procedure that has a strong capability of learning and adapting to changes in its operating environment. The ability to successfully modify itself indicates neural networks could be a beneficial tool in managing volatile networks. Hence, this study chose this method to process the information obtained by the fuzzy sets.

A neural network is composed of many simple and highly interconnected processors called
neurodes. These are analogous to the biological neurons in the human brain. The artificial neurodes
are connected by links that carry signals between one another, similar to biological neurons. The neurodes
receive input stimuli that are translated into an output stimulus. A neural network consists of many
neurodes connected together as in Figure 3.6. This illustrates a three layer neural network, which is the
type that will be designed for this study. However, it is possible to have more than (or less than) three
layers and more than (or less than) nine neurodes in a neural network. Processing begins when information
(input response) enters the input layer of neurodes. Inputs entering any neurode in the neural network
will follow the same basic process. This is atwo step process that uses two different mathematical
expressions for evaluation. The first step utilizes a summation function to combine all input values to a
neurode into a weighted input value. The second step utilizes a different mathematical expression, known
as a transfer function, that describes the translation of the weighted input pattern to an output response.
This two step process operates identically for all neurodes in the neural network. The summation function controls how the neurode will compute the net weighted input from the single inputs it has
received. Although the summation function operates identically for all layers, summation outcomes for the
input layer will be more direct than at the other layers. This is because each neurode in the input
layer receives a single input value. Since the sum of a single value is equal to that original value, the net
weighted inputs for these neurodes will be the original input values. Neurodes in the other two
layers require some computation to obtain their net weighted inputs. This is accomplished using the
following summation formula.

Conclusions:

Computer networks are becoming more abundant in today’s business environments as they
play a central role in maintaining and transmitting information. Many organizations have realized that
ease of access to information is a critical need that can also build a competitive advantage if it is easily
accessible. Networks play a central role in this concept for many reasons, with the most important
being that they can help geographically dispersed organizations overcome the geographic obstacle. The
growing usage of computer networks is requiring improvements in network technologies and
management techniques so that users will still be provided with high quality service. A major aspect of
computer networks that is vital to quality of service is data routing. As more individuals transmit data
through a computer network, the quality of service received by the users begins to degrade. This
indicates that more effective and adaptive measures must be developed for routing data through computer
networks. The essence of this dissertation was based on developing an improved method for data routing.
The primary tool applied in the routing method of this research was fuzzy reasoning. This was argued
to be an appropriate technique for routing due to the imprecise measures currently used in present routing
algorithms. Many of today’s algorithms use various network measures, known as metrics, to establish the
best path through a computer network. Few people have yet to recognize the nontrivial inaccuracies
present in the measures. Increasing complexities and growth of computer networks is accelerating the
significance of this notion. To combat these inaccurate metrics, fuzzy reasoning was applied as
the basis of the new algorithm presented in this dissertation.

A secondary technique utilized was a neural network. The neural network was deemed suitable
because it has the ability to learn. Once the neural network is designed, any alterations in the computer
routing environment can easily be learned by this adaptive artificial intelligence method. The capability
to learn and adapt is essential in today’s rapidly growing and changing computer networks. These techniques, fuzzy reasoning and neural networks, when combined together provided a more effective
routing algorithm for computer networks.

The principal objective of this dissertation was to demonstrate the advantages of applying fuzzy
reasoning to routing data through a wide area network. Developing the new fuzzy routing
algorithm involved many small processes, which were integrated to facilitate the modeling and testing
required in the study. Simulation methods, neural network procedures, and fuzzy reasoning were all
essential in achieving the research objective. A simulation model was designed following the
development of the new algorithm that applied fuzzy reasoning enhanced by a neural network. The basis
of the simulation was for comparing the new algorithm to a current routing algorithm based on the
shortest route technique. Before the simulations could be employed, an experimental design having
two factors was established. These two factors, congestion level and failure rate, were selected as
primary factors in the experimental design because of their high correlation to routing level achieved. The
level of congestion present in the computer network greatly affects the travel time for all types of data.

Similarly, failure in the computer network can delay or completely stop the transmission of data. Each
factor was divided into two levels, low and high; thus, leading to an experimental design having four
sampling units. Each unit represented a different network situation under which a comparison test was
performed between the two algorithms. The comparisons demonstrated that the new algorithm
outperformed the shortest route algorithm in routing effectiveness under all network situations except an
extremely stable one having low congestion and low failure rate. Nonparametric statistical tests were
applied to establish significance at the _ = 0.10 significance level (Table 5.1). This was the expected
result, and furthermore proves that the new algorithm has large potential benefits associated with it. The
paucity of so-called stable networks being used today emphasizes the usefulness of this new algorithm.
Table 5.1: Significant P-values
Low Congestion High Congestion
Low Failure Not significant P < 0.10
High
Failure
P < 0.10 P < 0.10
74
An additional advantage of the new algorithm that was discussed but not simulated is the neural
network’s ability to learn. The simulation provided data to train a neural network that was trained only
once. If implemented in an actual computer network, the algorithm would likely perform even better due
to its learning capability. This is because the neural network would understand how to manage various
modifications in the network as it grows. This is a notable feature as computer networks are not
designed to be static systems, but instead are dynamic systems that are constantly changing.
The conclusions of this research are obviously limited to some extent in that a specific network
structure and certain metrics were employed.

However, we believe this network exhibits general characteristics that help intuitively conclude that our
results can be generalized over most wide area networks. Utilizing fuzzy sets and a neural network
that are defined relative to the specific computer network assists in generalizing with these results. A
computer network having altered characteristics would employ fuzzy sets with different domain
ranges and a different neural network. Future research involving other network configurations and metrics will also help support these generalizations.

Future Research:

The positive results encountered in this dissertation suggest that additional experiments may
provide further insight into the benefits of fuzzy routing. This dissertation research studied the
benefits of a single network node applying the new fuzzy routing algorithm while all other nodes applied
a standard routing algorithm. Future research could employ the new algorithm at all network nodes and possibly demonstrate additional improvements to the

routing process.

Another modification that could prove beneficial lies with combining the two routing algorithms that
were employed in this study. It was discovered that the new algorithm did not exhibit any advantages
during network situations having low failures and low congestion. This suggests that a hybrid routing
scheme might improve routing efficiency. The hybrid routing algorithm would conditionally utilize the
fuzzy routing scheme during chaotic instances and the shortest path scheme during more stable periods.

References

1. Ani, C.I. and F. Halsall, 1995. “Simulation
Technique for Evaluating Cell-Loss Rate in
ATM Networks,” Simulation, May, 320-329.
2. Arnold, W., H. Hellendoorn, R. Seiseng, C.
Thomas and A. Weitzel, 1997. “Fuzzy Routing,”
Fuzzy Sets and Systems, 85: 131-153.
3. Benes, V.E., 1966. “Programming and Control
Problems Arising from Optimal Routing in
Telephone Networks,” Bell Syst. Tech. J., 45(9):
1373-1438.
4. Brande, J.K., 1996. “Network Performance
Management Using Fuzzy Logic”, Proceedings
of the SE DSI meeting, 321-323.
5. Brande, J.K., 1995. “Fuzzy Adaptive Traffic
Routing in a Packet Switched WAN”,
Proceedings of the SE INFORMS Meeting, 434-436.

6. Buckley, J.J. and Y. Hayashi, 1994. “Fuzzy
Neural Networks,” Fuzzy Sets, Neural Networks
and Soft Computing, ed. R. R. Yager and L. A.
Zadeh, Van Nostrand Reinhold, NY, 233-249.
7. Caudill, M. and C. Butler, 1994. Understanding
Neural Networks: Computer Explorations,
Volume 1: Basic Networks, The MIT Press,
Massachusetts.
8. Cebulka, K.D., M.J. Muller and C.A. Riley,
1989. “Applications of Artificial Intelligence for
Meeting Network Management Challenges in
the 1990’s,” Proceedings of GLOBECOM, 501-506.
9. Ceri, S. and L. Tanca, 1990. “Expert Design of
Local Area Networks,” IEEE Expert Magazine,
October, 23-33.
10. Chan, S.C., L.S.U. Hsu and K.F. Loe, 1993.
“Fuzzy Neural-Logic Networks,” Between Mind
and Computer, Fuzzy Science and Engineering,
ed. P. Z. Wang and K. F. Loe, World Scientific
Pub.Co. Pte.Ltd.
11. Cikoski, T.R., 1995. “Getting Prepared for Rule-based Integrated Network Management,”
Telecommunications (America’s Edition),
March, 46-50. Cisco Systems, Inc., “Routing
Procedures,”
12. http://www.cisco.com/warp/public/732/Tech/rtrp
_pc.html, (1995).

Geographically Distributed Virtual Test Environments for Distributed Embedded Control System using Model-based Design - paper presentation

2012-11-20T08:20:00.003-08:00

Geographically Distributed Virtual Test Environmentsfor Distributed Embedded Control System using Model-based Design

Yukikazu Nakamoto Tadahiro Ito Kenji Yabuuchi

Tatsunori Osaki

Graduate School of Applied Informatics, University of Hyogo, Japan

OCTOPATH Corporation, Japan

Fujitsu Ten Limited, Japan

nakamoto AT ai.u-hyogo.ac.jp

Abstract

Embedded control systems such as automotive andavionics systems form large-scale distributed ones which

consist of numerous CPUs and devices, including plants and various hardware components. The complexity of such systems has increased for sophisticated control using numerous types of sensor data. Meanwhile, market pressures lead to reducing development periods for the large-scale distributed embedded control systems. A model-based design becomes popular to solve the above problems, especially automotive industries. In this paper, we describe a distributed virtual test environment based on the model based design. The key features are communication middle-ware to enable large-scale distributed test with integrating

the programs in geographically distributed sites and control program execution with models of multiple abstractionlevels in the model-based design.

1 Introduction

Embedded control systems such as automotive and avionics systems form large-scale distributed ones that consist of numerous CPUs and devices, including plants and various hardware components that are controlled and accessed by the CPUs. The complexity of such systems has increased for sophisticated, safe, and environment-free control using numerous types of sensor data, which are collected from various vehicle components and sent to computers through vehicle networks. Meanwhile, market pressures lead to reducing development periods for the largescale distributed embedded control systems. A model-based

design to solve the above problems has become popular, especially in automotive industries. In the model-based design, a control system is modeled with state space modeling in the control design methodology and represented as a block diagram. In the block diagram, a block corresponds to a numerical operator in the mathematical model including proportion, integral, derivative actions, which are needed in

the control system, and a solid line between blocks repre-sents a signal. MATLAB/Simulink supports the design ofthe control system with a wide variety of blocks that areuseful.

Another solution for the problems is the usage of var-ious simulators that have been used to test functional be-havior of the embedded control systems. In the test phase,any bugs that occurred in the design phase are detected, and fixing these bugs is expensive. To avoid this situation and to reduce the test time, it is very effective to test the func-tional behavior of the system design and software design

at a higher level when using the plant simulators. Sim-ulators for automotive system development include ECU (CPU) simulators as well as plant simulators that are con-trolled by the ECUs, such as those for engines and brakes. To test ECU software in the absence of actual vehicle com-ponents, a software-in-the-loop simulation (SILS) is used.The SILS consists of an ECU simulator and a plant simula-tor. A hardware-in-the-loop simulation (HILS), where ECU software is executed in an actual ECU while a plant is sim-ulated, is also used [3].

To develop large-scale distributed embedded control sys-tems with high dependability and productivity, we have de-veloped a virtual execution environment platform. We call our platform the functional integration simulation environ-ment (FISE). The purpose of the virtual execution environ-ment platform is to test functional behavior of the large-scale distributed embedded control system software. We described the requirements for the platform and the initial system designs of the platform [6]. We recently presented

the development status of a hybrid software execution en-vironment in the FISE, which integrates virtual and real software execution environments for large-scale distributed embedded control systems to test functional behavior of dis-tributed embedded control software in a more realistic envi-ronment [7, 8].

In this paper, we describe a distributed virtual test envi-ronment using the model-based design, extending our pre-vious work. The key features are communication middle-ware to enable large-scale distributed testing with integrat-ing the programs in geographically distributed sites and

control program execution with models of multiple abstrac-tion levels in the model-based design.

Our contributions in this paper provide the followingbenefits to developers:

*From the control program viewpoint, a developer can test a control program without actual plants such as

controlled hardware and their environments.

*From the control design viewpoint, a control designer can test a control algorithm that is implemented in an

ECU program.

We introduce control system design briefly in Sec. 2.

Section 3 describes the geographically distributed virtual

test environment. Section 4 concludes the paper.

2 Control System Design

We describe the steps required to develop the control sys-tem in embedded control systems and briefly how to design

control systems using automotive systems as an example.

.1. Requirement Specification:

Requirements for an embedded control system in-cluding functional features and non-functional features

such as control performance are specified.

2. Architecture Design:

In this step, we design the architecture of an embedded control system. In terms of control design, we model

control functionalities of the system based on mathe-matical methods or the system identification method.

Next, we design the control system based on the block diagram model to specify continuous time behavior.

A control system, which consists of plants and con-trollers, is modeled with a state space modeling in the control design methodology and represented as a block diagram, where one block corresponds to a numerical operator in the mathematical model including propor-tion, integral, derivative actions which need in con-trol and a solid line between blocks represents a sig-nal. In this step, MATLAB/Simulink is used to model the control design. MATLAB/Simulink supports the design of the control system with a wide variety of blocks that are useful in designing control systems. The MATLAB/Simulink controller model is simulated

with a sampling cycle from the viewpoint of control performance, controllability, observability, and stabil-ity. Figure 1 shows a MATLAB/Simulink model of an anti-lock brake system [4].

3. ECU/Hardware/Software Design:

An embedded control system design is divided into ECU, hardware, and software components, and each

component is designed separately. The plants are an engine and brakes in an automotive system. Controllers are ECUs which obtain the inputs and statuses of plants through sensors and then output

commands to the plants through actuators. The con-troller part is implemented primarily with ECU soft-ware. Recently, it has become more common to design the software using a modeling language such as UML. The model is designed in the described time behav-ior while the control system is designed in continuous time.

4. Implementation:

The divided ECU, hardware, and software parts are im-plemented.

3 Functionalities of geographically dis-tributed virtual test environment

To integrate and test control programs in geographically distributed sites and control program execution with mod-els of multiple abstraction levels in the model-based design,

various simulators such as CPU simulators and plant sim-ulators should be integrated into the network and provide network-wide simulation functionalities in the large-scale distributed embedded control systems. The architecture for the distributed virtual test environment is shown in Fig. 2.

Communication middleware:

Communication middle-ware requires an open standardized interface. Various simu-lators such as CPU simulators and plant simulators are con-nected to the communication middleware. For this connec-tion to be established easily, the interface of the middleware should be open and standardized. We utilized open source

CORBA implementation, MICO, in the early stage of the development. CPU and plant simulators are executed as CORBA objects, and they communicate using the CORBA communication mechanism[7].

However, communication middleware in the distributed test environment should be established through the Inter-net. The background of this requirement is numerous ECU and plant developers exist, especially in the automotive in-dustry, and control software that they develop needs to be integrated. However, the control software, especially in the developing phase, is often prohibited to deliver control programs in a source code form from outside their sites,so the integration requires using the Internet. Thus, weadopted the windows communication foundation (WCF) inthe current implementation[1]. The WCF was introduced

as a communication subsystem in the .NET framework forservice-oriented applications. A service on top of the WCF (WCF service) provides operations. Invoking an operation in a service is implemented by SOAP over TCP or SOAP over HTTP. SOAP over HTTP in the WCF is necessary be-cause of testing in the geographically distributed sites. The merit is that application software on top of the WCF is in-dependent the lower layer network protocol, whether in the LAN or through the Internet. The drawback was that

the WCF is only used in Windows; however, the WCF will be available on Linux developed by the mono project[5].Control program execution including CPU simulators andmplant simulators are implemented as WCF services, whichmare collectively called simulation services in this paper. Am simulation service provides operations, which are invoked by other simulation services. We have evaluated the WCF

in the LAN setting by transmitting small-sized data. The result shows that these speeds are comparable to method in-vocation in MICO.

Multiple types of control software execution:

We pro-vide three types of control software execution with models of multiple abstraction levels at present. The first is a con-troller model in the block diagram. The second is nativeprogram execution, and the last is CPU simulation.

In native program execution, a user can test a newly de-veloped control program that does not require the other tar-get machine dependent functionalities. This is suitable formtesting a newly developed control algorithm. Whether themcontrol behavior in the algorithm is equivalent to the con-troller design with MATLAB/Simulink is checked. Testing source programs means testing ones in the platform inde-pendent model in the model-driven architecture[2].

A CPU simulator is necessary for testing not only newly developed software in an execution environment close to a real setting but also for existing software. The CPU sim-ulator is also helpful because performing tests without the source code is very helpful for software developers because only binary codes are delivered and all the source codes are not delivered in the industry.

Simulation speed is an important issue in a CPU sim-ulator. Interpretive simulators, which are widely used for debugging software, and cycle-accurate simulators, which are used in hardware-software co-design, are slow to de-bug and test software in a CPU. To solve the problem, we developed a translation-based CPU simulator using QEMU [7, 8]. QEMU is a virtual execution environment generator.

The CPU simulator, which is generated by QEMU, trans-lates the target machine code into host machine code and ex-ecutes it. We developed the V850 QEMU utilizing QEMU 0.13.0. A Dhrystone MIPS of V850 QEMU has been cal-culated as approximately 110.5 MIPS with the current PC with a standard clock speed. This simulation speed is suffi-cient for developing control software in the mid-range ECU in a few years.

Service adaption layer:

We prepared the service adap-tion layer on the top of WCF to control simulators as WCF services. The following functions are in the application pro-gramming interface (API) of the layer.

ReadDatareads 32-bit data from a port in a simula-tion service.

WriteDatawrites 32-bit data to a port in a simula-tion service.

callFuncinvokes a function invokes in a simulation service.

We assumed that the specified function could be exe-cuted independently of the other program execution.

SuspendSimsuspends the specified simulation ser-vice.

ResumeSimresumes the specified simulation service.

We can use these APIs as follows.

WriteDataemulates data arrival from plant services

andcallFuncemulates calling an interrupt handler

from the data arrival, respectively. The plant service

obtains data or a command from the controller with

ReadData.

WriteDataemulates data arrival from plant services

andcallFuncemulates calling a control algorithm.

The plant service obtains data or a command from the

control algorithm withReadData.

The last two APIs control program execution engines,

CPU simulators, and plant simulators.

Execution controller:

A simulation controller controls the simulation by executing the simulators cyclically. The

simulators perform the execution and are suspended af-ter that in simulation cycles in virtual time. An execu-tion controller resumes the simulators periodically and syn-chronously for some specific duration.

4 Conclusion

We described a distributed virtual test environment using the model-based design. The key feature is communication middleware to enable large-scale distributed testing with in-tegrating the programs in geographically distributed sites.

The testing environment provides different types of control software execution with models of multiple abstraction lev-els for testing from a source form as a platform independent model to binary form control programs.

Currently, we have developed a platform of the virtual test environment. In the next step, we are going to build ac-tual simulator services for the environments and test actual control programs using the simulator services to examine the effectiveness of the virtual test environment.

Acknowledgments

This work has been supported in part by a Scientific Re-search Grant-in-Aid from the Japan Society for the Promo-tion of Science ((C)21500040) and Fujitsu Ten Limited.

References

[1] David Chappell. Introducing Windows CommunicationFoun-dation, 2010.

[2] D. S. Frankel. Model Driven Architecture: Applying MDA to

Enterprise Computing. Wiley, 2003.

[3] R. Isermann, J. Schaffnita, and S. Sinsel. Hardware-in-the-loop simulation for the design and testing of engine control

systems. Control Engineering Practice, 7(5):643–653, May

1999.

[4] Mathworks. Modeling an Anti-Lock Braking System, 2010.

http://www.mathworks.com/products/simulink/demos.html

?file=/products/demos/shipping/simulink/sldemoabsbrake.html.

[5] mono project. Wcf development, 2010. http://www.mono-project.com/WCFDevelopment.

[6] Y. Nakamoto, I. Abe, T. Osaki, H. Terada, and Y. Moriyama.

Toward Integrated Virtual Execution Platform for Large-scale

Distributed Embedded Systems. InProc. 6th IFIP WG 10.2

International Workshop, Software Technologies for Embed-ded and Ubiquitous Systems, pages 317–322, Oct. 2008.

[7] Y. Nakamoto, K. Yabuuchi, T. Osaki, T. Kishida, T. Hara,

I. Abe, and A. Kitamura. Proposing a hybrid soft-ware execution environment for distributed embedded sys-tems. In Proc. 13th IEEE International Symposium on

Object/Component/Service-Oriented Real-Time Distributed

Computing Workshops, pages 176–183, 2010.

[8] Y. Nakamoto, K. Yabuuchi, and T. Osaki. Virtual soft-ware execution environments for distributed embedded con-trol systems. In Proc. 14th IEEE International Sympo-sium on Object/Component/Service-Oriented Real-Time Dis-tributed Computing Workshops, pages 288–296, 2011.

Neural Network Trainer through Computer Networks -paper presentation

2012-11-10T03:51:00.000-08:00

2010 24th IEEE International Conference on Advanced Information Networking and Applications

Neural Network Trainer through Computer Networks

Nam Pham†, Hao Yu†, Bogdan M. Wilamowski†, Fellow, IEEE

†Electrical and Computer Engineering, Auburn University, Alabama, US

nguyehu@auburn.edu hzy0004@auburn.edu wilam@ieee.org

Abstract -

This paper introduces a neural network training tool through computer networks. The following algorithms,

such as neuron by neuron (NBN) [1][2], error back propagation (EBP), Levenberg Marquardt (LM) and its

improved versions are implemented in two different computing methods, traditional forward-backward

computation and newly developed forward-only computation. The training tool can handle not only conventional multilayer perceptron (MLP) networks, but also arbitrarily connected neuron (ACN) networks. There are several benefits that make this network training tool desirable. Network training process

can be used remotely through any network connection or any operating system can be used to access the network training tool, making the application operating system independent. Also much less installation time and configuration time is required because the training tool locates on one central machine. Many users can access at the same time. Users can train and see the training results directly through networks.

And the most important thing is the software producers can protect their intellectual property when network browsers are used as user interface
.

Keywords— neural networks, training tool

I. INTRODUCTION

Communication through computer networks has become a popular and efficient means of computing and simulation. Most companies and research institutions use networks to some extent on a regular basis [3][4]. Computer networks provide the ability to access all kinds of information which are available from all around the world, and intranet networks provide connectivity for a smaller, more isolated domain like a company or a school. Several tools of computer network programming are available today

including Java, CGI (Common Gateway Interface)...CGI scripts utilize PERL, PHP, or other scripting languages.

Several neural network trainer tools are available on the market. One of the freeware available tools is “Stuttgart Neural Network Simulator” is based on widely C platform and is distributed in both executable and source code version [5]. However the installation of this tool requires certain knowledge of compiling and setting up the application. Also, it is based on XGUI that is not freeware and still single type architecture- Unix architecture [6].

The commercial neural network software called “Neurodesigner” is a product of CyberSoft [7]. Even

though aiming to attract users by Java based windows interface, but this tool lacks some fundamental algorithms, like Levenberg Marquardt algorithm. MATLAB Neural Network Tool box contains basic training algorithms, such as EBP algorithm and LM algorithm, but they are limited for traditional multilayer perceptron networks, which are inefficient [8]. The commercial price also places a hurdle

on educational use of such a tool.

This paper will describe the power of network programming technology used to develop the neural

network training tool which can be trained remotely through any computer network. Several network

programming tools which are available today, include in Java, CGI, JavaScript, ActiveX, HTML, PERL, PHP [9] while HTML, JavaScript, PHP are used to develop in this particular application. The trainer has a user-friendly GUI (Graphical User Interface) and features include password protection and user accounts, local or remote files for training, training result hyperlinks and Error curve in the

form of image.

The PHP network programming language supports for dynamic web-pages. Its communication with web browser is accomplished through network connection. PHP has capability to process, extract data and receive request to execute the external execution files in the background. When the execution files finish, it will send the results back to the requesting clients. Moreover, HTML and JavaScript can be incorporated into PHP scripts very efficiently. This feature makes PHP more powerful for the web programming. HTML and JavaScript provide the front-end graphical user interface that allows users to input data, upload data files or click a button to start training.

The training process can be described as Fig. 1: when clients upload all the input files and send a request to the server, the request will be processed and executed by PHP scripts on the server. After training, the server will send the results back to the local machine that made the request.

II. OVERVIEW OF NEURAL NETWORK

Artificial neural networks (ANN) are used in many industrial applications, such as nonlinear control [10][11],

system analysis and diagnosis [12][13], VLSI design [14][15] and data classification [16][17]. It is easy to

demonstrate that they can surplus human capabilities to recognize the complex patterns [18][19].

Error back propagation (EBP) algorithm [20][21] is the most popular training method, however, it is not an efficient one because of its slow convergence and its low training stability. Based on EBP algorithm, lots of improvements are developed for better training [22][23], and some of them, such momentum [24], Quick-prop and Resilient EBP [25], work well.

Although complex computation for Jacobian/Hessian matrix is necessary during training process, Levenberg

Marquardt (LM) algorithm [26] is considered as one of the most efficient algorithms for small and median sized training patterns. Also there are many good improved algorithms [27] based on LM algorithm for better training.

Most of neural network training software which uses LM algorithm (e.g. MATLAB Neural Network Toolbox) is not able to train neural networks with arbitrary connections between neurons. This deficiency was overcome by the NBN algorithm [1].

Like EBP algorithm, multilayer perceptron (MLP) networks are broadly accepted in practical applications

because they could be realized easily by programming. However, MLP networks perform much less efficient

training than other structures, such as MLP with full connections among layers (Bridged MLP) and fully

connected cascade (FCC) networks, to deal with the same problems. For example, for parity-7 problem, it needs at least 8 neurons for the standard MLP network to get a solution (Fig. 2(a)), while, for BMLP and FCC networks, only 4 and 3 neurons are required respectively (Fig. 2(b) and (c)). For efficient training, BMLP and FCC networks are better choices, but they also require more challenging computation [8].

In this paper, the neural network trainer NBN 2.0 is introduced as a powerful training tool. It contains EBP

algorithm, LM algorithm, neuron by neuron (NBN) algorithm [1][2] and a improved NBN algorithm. Besides the conventional forward-backward computation, a newly developed forward-only (without error back propagation process) computation is also implemented in the software. Based on the neuron by neuron computing scheme, this tool can handle arbitrarily connected cascade (FCC) networks.

In the section IV of this paper, the detailed information of NBN is described, and the section V presents a practical example how to use the NBN 2.0.

III. OVERVIEW OF NETWORK PROGRAMMING

Several network programming tools are available such as Java, CGI, ActiveX, Java-script, VBScript, HTML, and PERL. During software development, it is important to justify which part of the software should run on the client machine and which part should run on the server. CGI is quite different from writing Java applets. Applets are transferred though a network when requested and execution is performed entirely on the client machine that made request. In CGI much less information has to be passed to the server and the server executes instructions based on the given information and sends the results back to the local machine that make the request. In case of neural network trainer it only makes sense to use CGI for training process

because it is impossible to send the trainer through the computer network every time it was requested, and this would be extremely slow. Therefore, it is important to develop methods which take advantage for networks. This would require solving several issues, such as:

• Minimization of the amount of data which must be sent by network

• Selection of programming tools used for various tasks

• Development of user-friendly interface

• Security, privacy

• Portability of software used on servers and clients

• Task partitioning between the server and client

This training tool currently incorporates CGI, PHP, HTML and Java-Script. CGI programming allows dynamic web-page generation in a web browser. Communication between the CGI program and the web browser is accomplished through a network connection between the web browser and a computer running an HTTP server. A CGI program is executed on a server when it receives arequest to process information from a web browser. The server then decides if the request should be granted. If the authorization is secured, the server executes the CGI program and returns the results to the web browser that requested.

PHP is a scripting language like PERL. In fact, its syntax resembles PERL. The main difference lays in the set of standard built-in libraries that support generation of HTML code, processing data from and to the web server, and handling cookies. The same functionality can be accessed in PERL by inclusion of one or more libraries. PHP can be used either as a classical CGI scripting language or as an implementation of ASP technology [28]. Since certain frequently used functionality is built in directly into the language, it is more efficient to use. In general, any specialized tool will be somewhat more efficient for one particular task it was designed for, instead of other powerful but general purpose tools.

IV. NEURAL NETWORK TRAINER

The NBN 2.0 [29][30] is developed based on Visual Studio 6.0 using C++ language hosting on server and

communicating with clients through PHP scripts. Its main interface is shown in Fig. 3. In the following part of this section, a detailed instruction of the training tool is presented.

A. Training Algorithms

Up to now, the training tool is developed with six different types of training algorithms.
• Error Back Propagation (EBP) This is an improved EBP algorithm [31], with momentum and multiple learning constants. The momentum is introduced to adjust weight vector using the information from the previous iteration. Therefore, the update rule of the improved EBP algorithm can be
described as

where: kis the index of iterations; gis the gradient vector; ∆wis the weight change; ηis the momentum; {α1, α2… α3}are multiple learning constants. For every iteration, the most optimal learning constant will be picked out by comparison of training errors.

• Levenberg Marquardt (LM) Original LM algorithm with update rule [32]:

where: His the Hessian matrix; Iis the identity matrix and μis the combination coefficient. The original LM algorithm is only used for MLP networks.

• Neuron By Neuron (NBN)

This is the improved LM algorithm, with advantages: (1) ability of training arbitrarily connected neural networks [1][2]; (2) without Jacobian matrix computation and

storage [33].

• Error Back Propagation, forward-only (EBP, forward only)

This is the EBP algorithm with different computation routings from traditional backpropagation computation.

• Neuron By Neuron, forward-only (NBN, forward only)

This is the NBN algorithm with forward-only computation process.

• Neuron By Neuron, improved (NBN-improved)

This is a newly developing algorithm derived from EBP algorithm and Newton algorithm. It’s designed to do only one matrix inversion for each iteration during training. With this property, it’s supposed to compute faster than LM algorithm. At the same time, by inheriting gradient searching ability from EBP algorithm, the proposed algorithm also can perform stable training. The drop-down box is used to select training algorithms as Fig.4.

B. File Instruction

The neural network interface will receive the request from users with uploading files and input parameters to

generate the data files and then send the command to the training software locating on server. There are two files required for training process: topology file and training data file and the users have to use “Browse” buttons as in Fig.5 to upload two these files. These two files have to follow certain syntax so that the training tool can make sense in the correct way.

• Topology file

The topology files are named “*.in”, and they are mainly used to construct neural network topologies for training. The topology files consist of four parts: topology design, weight initialization (optional), neuron type instruction and training data specification.

The topology design is aimed to create the neural structures. The general command is “n [b] [type] [a1a2…an]”, which means inputs neurons indexed with a1,a2…,an are connected to neuron bwith a specified neural type (bipolar, unipolar or linear). Fig. 6 presents the topology file for the neural networks shown in Fig. 2.

The weight initialization part is used to specify the initial weights for training and this part is optional. If there is no weight initialization in the topology file, the trainer will generate the initial weights randomly (from -1 to 1) before training. The general command is “w [wbias] [w1w2… wn]” corresponding to the topology design. Fig. 7 shows the example of weight initialization for the parity-3 problem with 2 neurons in FCN network. “//” sign in the topology file is understood as the comment by the trainer

In the neuron type instruction part, three different types of neurons are defined. They are bipolar (“mbip”), unipolar (mu) and linear (“mlin”). Bipolar neurons have positive or negative outputs, while unipolar neurons only have positive outputs. The outputs of both bipolar and unipolar neurons are no more than 1. If the desired outputs are larger than 1, the linear neurons are considered to be the output neurons.

The general command is “.model [mbip/mu/mlin] fun=[bip/uni/lin], gain=[value]”. “gain” is the parameter of

related activation functions (Fig. 8).

different “gain” values; for bipolar and linear

neurons, “gain” plays the same roles as in unipolar

neurons

The training data specification part is used to set the name of training pattern file, in order to get correct training data. The general command is “datafile=[file name]”.

• Training pattern file

The training pattern files include input patterns and related desired outputs. In a training pattern file, the number of rows is equal to the number of patterns, while the number of columns is equal to the sum of the number of inputs and the number of outputs. However, only with the data in the training pattern file, one can’t tell the number of inputs and the number of outputs, so the neural topology should be considered together in order to decide those two parameters (Fig. 9). The training pattern files are specified in the topology files as mentioned above, and it should have the same route as the related topology files.

C. Parameter Settings

All parameters can be edited in the user interface Fig. 10 with the blanks written in HTML form and Java-Script. There are three main parameters: training times, max-error, max-iteration have to be filled in. These values must be the number. If users do not put these parameters in the proper forms, the warning message will pop up. If these parameters are left with the blanks, the trainer will automatically assign their values by zeros. Besides these parameters, there are other parameters with default values which will dynamically pop up for inputting data of “combination coefficient”, “scale constant”, “momentum constant”, “learning constant”, “alpha constant”, “beta constant”, “gamma constant” which depends on the selected algorithm when users click the “Set parameters” button.

D. Training Information

Instantaneous training data are presented in this area, including SSE and cost iterations for current training,

average iteration and time spent in solving the same problems, and the success rate for multiple times training.

These parameters have default values “0s”, are disabled and only updated after each training process.

E. Plot Area

This area is used to depict the sum squared error (SSE) during training. The log scaled vertical axis presents SSE values from 0.0001 to 10000, while the horizontal axis, which is linearly scaled automatically with the coefficient at the bottom of plotting area (“×[value]” in Fig. 3), shows the number of iterations cost for training. The plot is provided in bmp format, widely recognized by most of popular web browsers. All plots are dynamically generated.

The “Submit data” button allows the training tool to check all inputs. This is very necessary because the network trainer can’t handle all types of formats of files and input parameters which can affect the training success. All submitted data is saved into the database and the trainer will automatically retrieve these data from the database and initialize them as the next data set.

When all the requirements are fulfilled and set up properly the button “Start training” will appear. Otherwise,

it will not and the training tool will send the error warnings back to the clients. The training process can be long or short depending on the convergence of the selected algorithm, the complication of network structure, the input parameters and the speed of network. If the training process is successful the training result will be generated. The training result file is used to store training information and the results such as training algorithm, training pattern file, topology, parameters, initial weights, result weights and training results will be saved after the training process finishes. The name of the training result file is generated automatically according to the name of the training file and hyperlinked right above the Graphical Users Interface. If the training process gets errors the “Error” hyperlink will appear instead of the “Training Result” hyperlink.

V. EXAMPLE

This example will present all steps of training process with parity-4 problem. Two input files include parity4.in, parity4.dat, selected algorithm is NBN with parameter training times= 500, max-error= 0.001, max-iteration= 500, combination coefficient= 0.01, scale constant=10.

output plot

VI. CONCLUSION

In this paper, the training tool NBN 2.0 through computer networks is introduced for neural network

training. This trainer contains both first order and second order training algorithms, which are implemented by

traditional forward-backward computation and a newly developed forward-only computation respectively. It can handle not only MLP networks, but also ACN networks well. With the detailed instructions and example presented in the paper, one can get familiar with this useful tool for neural network training. The NBN 2.0 is available at http://131.204.128.91/NNTrainer/index.php,and it will be updated from time to time.

REFERENCES

[1] B. M. Wilamowski, N. Cotton, J. Hewlett, O. Kaynak, “Neural

network trainer with second order learning algorithms”. Proc.

International Conference on Intelligent Engineering Systems, June

29 2007-July 1 2007, pp. 127-132.

[2] Wilamowski, B.M. Cotton, N.J. Kaynak, O. Dundar, G.,

“Computing Gradient Vector and Jacobian Matrix in Arbitrarily

Connected Neural Networks”, IEEE Trans. on Industrial

Electronics, vol. 55, no. 10, pp. 3784-3790, Oct. 2008.

[3] B. M. Wilamowski, John Regnier, Aleksander Malimowski, “SIP-

Spice Intranet Package”, IEEE International Conference on

Industrial Electronics, pp.192-195, June 7-10 1998.

[4] B. M. Wilamowski, A. Malinowski, and J. Regnier, “SPICE based

Circuit Analysis using Web Pages”, ASEE 2000 Annual Conference,

St. Louis, MO, CD-ROM session 2520, June 18 to Aug 2, 2000.

[5] Stuttgart Neural Network Simulator, URL from May 2002:

http://www-ra.informatik.uni-tuebingen.de/SNNS/.

[6] M. Manic, B. M. Wilamowski, and A. Malinowski, “Internet based

Neural Network Online Simulation Tool”, Proc. of the 28th Annual

Conference of the IEEE Industrial Electronics Society, pp.

2870-2874, Sevilla, Spain, Nov 5-8, 2002.

[7] Neurodesigner- comprehensive neural network software, URL from

May 2002: http://www.neurodesigner.com/

[8] B. M. Wilamowski, Neural Network Architectures and Learning

Algorithms, IEEE Industrial Electronics Magazine, vol. 3, no 4,

pp. 56-63, 2009.

[9] A. Malinowski, B. M. Wilamowski, "Internet Technology as a Tool

for Solving Engineering Problems ", The 27th Annual Conference of

the IEEE Industrial Electronics Society(tutorial) pp. 1622-1630,

Denver CO, Nov 29-Dec 2, 2001.

[10] J. A. Farrell, M. M. Polycarpou, "Adaptive Approximation Based

Control: Unifying Neural, Fuzzy and Traditional Adaptive

Approximation Approaches, "IEEE Trans. on Neural Networks,vol.

19, no. 4, pp. 731-732, April 2008.

[11] G. Colin, Y. Chamaillard, G. Bloch, G. Corde, "Neural Control of

Fast Nonlinear Systems—Application to a Turbocharged SI Engine

With VCT,"IEEE Trans. on Neural Networks,vol. 18, no. 4, pp.

1101-1114, April 2007.

[12] S. Khomfoi, L. M. Tolbert, “Fault diagnostic system for a multilevel

inverter using a neural network”. IEEE Trans. Power Electron., vol.

22, no. 3, pp. 1062-1069, May 2007.

[13] J. F. Martins, V. Ferno Pires,A. J. Pires, “Unsupervised

neural-network-based algorithm for an on-line diagnosis of

three-phase induction motor stator fault”.IEEE Trans. Ind.

Electron., vol. 54, no. 1, pp. 259-264, Feb. 2007.

[14] K. Cameron, A. Murray, "Minimizing the Effect of Process

Mismatch in a Neuromorphic System Using

Spike-Timing-Dependent Adaptation,"IEEE Trans. on Neural

Networks,vol. 19, no. 5, pp. 899-913, May 2008.

[15] G. Indiveri, E. Chicca, R. Douglas, "A VLSI array of low-power

spiking neurons and bistable synapses with spike-timing dependent

plasticity,"IEEE Trans. on Neural Networks,vol. 17, no. 1, pp.

211-221, Jan 2006.

[16] B. Vigdor, B. Lerner, "Accurate and Fast Off and Online Fuzzy

ARTMAP-Based Image Classification With Application to Genetic

Abnormality Diagnosis,"IEEE Trans. on Neural Networks,vol. 17,

no. 5, pp. 1288-1300, May 2006.

[17] M. Kyperountas, A. Tefas, I. Pitas, "Weighted Piecewise LDA for

Solving the Small Sample Size Problem in Face Verification,"IEEE

Trans. on Neural Networks,vol. 18, no. 2, pp. 506-519, Feb 2007.

[18] Jafarzadegan, M. , Mirzaei, H. , “A new ensemble based classifier

using feature transformation for hand recoognition”, Human System

Interactions, 2008 Conference on, pp. 749-754, May, 2008.

[19] Mroczek, T. , Paja, W. , Piatek, L. , Wrzesie, M. ,”Classification and

synthesis of medical images in the domain of melanocytic skin

lesions”, Human System Interactions, 2008 Conference on, pp.

705-709, May, 2008.

[20] Rumelhart D. E., G. E. Hinton, R. J. Williams, “Learning

representations by back-propagating errors”. Nature, vol. 323, pp.

533-536, 198

in the paper, one can get familiar with this useful tool for

neural network training. The NBN 2.0 is available at

http://131.204.128.91/NNTrainer/index.php,and it will be

updated from time to time.

REFERENCES

[1] B. M. Wilamowski, N. Cotton, J. Hewlett, O. Kaynak, “Neural

network trainer with second order learning algorithms”. Proc.

International Conference on Intelligent Engineering Systems, June

29 2007-July 1 2007, pp. 127-132.

[2] Wilamowski, B.M. Cotton, N.J. Kaynak, O. Dundar, G.,

“Computing Gradient Vector and Jacobian Matrix in Arbitrarily

Connected Neural Networks”, IEEE Trans. on Industrial

Electronics, vol. 55, no. 10, pp. 3784-3790, Oct. 2008.

[3] B. M. Wilamowski, John Regnier, Aleksander Malimowski, “SIP-

Spice Intranet Package”, IEEE International Conference on

Industrial Electronics, pp.192-195, June 7-10 1998.

[4] B. M. Wilamowski, A. Malinowski, and J. Regnier, “SPICE based

Circuit Analysis using Web Pages”, ASEE 2000 Annual Conference,

St. Louis, MO, CD-ROM session 2520, June 18 to Aug 2, 2000.

[5] Stuttgart Neural Network Simulator, URL from May 2002:

http://www-ra.informatik.uni-tuebingen.de/SNNS/.

[6] M. Manic, B. M. Wilamowski, and A. Malinowski, “Internet based

Neural Network Online Simulation Tool”, Proc. of the 28th Annual

Conference of the IEEE Industrial Electronics Society, pp.

2870-2874, Sevilla, Spain, Nov 5-8, 2002.

[7] Neurodesigner- comprehensive neural network software, URL from

May 2002: http://www.neurodesigner.com/

[8] B. M. Wilamowski, Neural Network Architectures and Learning

Algorithms, IEEE Industrial Electronics Magazine, vol. 3, no 4,

pp. 56-63, 2009.

[9] A. Malinowski, B. M. Wilamowski, "Internet Technology as a Tool

for Solving Engineering Problems ", The 27th Annual Conference of

the IEEE Industrial Electronics Society(tutorial) pp. 1622-1630,

Denver CO, Nov 29-Dec 2, 2001.

[10] J. A. Farrell, M. M. Polycarpou, "Adaptive Approximation Based

Control: Unifying Neural, Fuzzy and Traditional Adaptive

Approximation Approaches, "IEEE Trans. on Neural Networks,vol.

19, no. 4, pp. 731-732, April 2008.

[11] G. Colin, Y. Chamaillard, G. Bloch, G. Corde, "Neural Control of

Fast Nonlinear Systems—Application to a Turbocharged SI Engine

With VCT,"IEEE Trans. on Neural Networks,vol. 18, no. 4, pp.

1101-1114, April 2007.

[12] S. Khomfoi, L. M. Tolbert, “Fault diagnostic system for a multilevel

inverter using a neural network”. IEEE Trans. Power Electron., vol.

22, no. 3, pp. 1062-1069, May 2007.

[13] J. F. Martins, V. Ferno Pires,A. J. Pires, “Unsupervised

neural-network-based algorithm for an on-line diagnosis of

three-phase induction motor stator fault”.IEEE Trans. Ind.

Electron., vol. 54, no. 1, pp. 259-264, Feb. 2007.

[14] K. Cameron, A. Murray, "Minimizing the Effect of Process

Mismatch in a Neuromorphic System Using

Spike-Timing-Dependent Adaptation,"IEEE Trans. on Neural

Networks,vol. 19, no. 5, pp. 899-913, May 2008.

[15] G. Indiveri, E. Chicca, R. Douglas, "A VLSI array of low-power

spiking neurons and bistable synapses with spike-timing dependent

plasticity,"IEEE Trans. on Neural Networks,vol. 17, no. 1, pp.

211-221, Jan 2006.

[16] B. Vigdor, B. Lerner, "Accurate and Fast Off and Online Fuzzy

ARTMAP-Based Image Classification With Application to Genetic

Abnormality Diagnosis,"IEEE Trans. on Neural Networks,vol. 17,

no. 5, pp. 1288-1300, May 2006.

[17] M. Kyperountas, A. Tefas, I. Pitas, "Weighted Piecewise LDA for

Solving the Small Sample Size Problem in Face Verification,"IEEE

Trans. on Neural Networks,vol. 18, no. 2, pp. 506-519, Feb 2007.

[18] Jafarzadegan, M. , Mirzaei, H. , “A new ensemble based classifier

using feature transformation for hand recoognition”, Human System

Interactions, 2008 Conference on, pp. 749-754, May, 2008.

[19] Mroczek, T. , Paja, W. , Piatek, L. , Wrzesie, M. ,”Classification and

synthesis of medical images in the domain of melanocytic skin

lesions”, Human System Interactions, 2008 Conference on, pp.

705-709, May, 2008.

[20] Rumelhart D. E., G. E. Hinton, R. J. Williams, “Learning

representations by back-propagating errors”. Nature, vol. 323, pp.

533-536, 198

Performance Evaluation of TOFU System Area Network Design for High-Performance Computer Systems -paper presentation

2012-11-09T20:29:00.004-08:00

Performance Evaluation of TOFU System Area Network Design for High-Performance Computer Systems

P. BOROVSKA, O. NAKOV, S. MARKOV, D. IVANOVA, F. FILIPOV

Computer System Department

Technical University of Sofia

8 Kliment Ohridski Boul., 1756 Sofia

BULGARIA

pborovska@tu-sofia.bg, nakov@tu-sofia.bg, markov@acad.bg, d_ivanova@tu-sofia.bg,

pilif.pilif@googlemail.com, http://cs-tusofia.eu

Abstract

Switch and system area network architectural designs are significantly influenced by next generation high-performance computer systems and supercomputer technology. As technology evolves, this impact on interconnection network needs to be considered and reevaluated. In this paper we evaluate a communication performance of a high-speed switch and TOFU system area network design by means of network simulations using OMNET++ simulator. The models under investigation have been verified on the basis of parallel program implementations (C++, MPI) on IBM Blade Center.

Key-Words: - Switch Architectural Design; TOFU System Area Networks; Simulation Model; OMNET++, Communication Performance

1 Introduction

The scientific and technological challenges in modern world demand powerful computational resources like a
large numbers of processing cores that are highly interconnected via a high-speed system area network
(SAN). SAN offers an attractive solution to the communication crisis and are becoming pervasive in
high-performance computer systems (HPCS). A well-designed SAN makes efficient use of scarce
communication resources — providing high throughput, low-latency communication between clients with a minimum of cost and energy, [1, 2, 5].

In this paper, we propose a high-speed switch design and perform evaluation of system area networks (SAN) via simulations using the discrete event simulator OMNeT++, [4].
Simulation experiments are intended to model a high-speed switch and SAN design for high-performance
computer systems, which connect nodes in TOFU topology and evaluate the communication efficiency
impact on different traffic patterns.

The communication performance parameters are estimated on the basis of parallel simulation models in OMNeT++ network simulator environment which have been run on IBM Blade Center.

2 Switch design

We suggest a switch architecture that has a highly regular structure. The switch architecture for the case
of four input and output ports is shown in Fig. 1.

The proposed switch design comprises identical modules for each communication transfer. It has an
input multiplexer, which selects either direction from neighbor switch or from the attached host (a packet of
lower priority). The input registers store one flit and extract its routing information, [1].

Next element is DMUX_Host, which forwards the flit to the host if routing function signals that destination
node is already reached. Else, if the above condition is not met, the flit is delivered to the relevant output port
(though the next demultiplexer), depending again on the routing decision.

The outputs of buffers are connected to the output ports through a four non-blocking crossbars. The output
ports are the common resource, which arbitration logic has to consider, when evacuating a flit from the buffers. They should be marked as occupied as soon the header flit enters and freed when the corresponding tail flit exists.

The composition of header, payload and tail flits (forming one packet) makes a virtual path across the
ports and the buffers, which could not be cut by other such virtual paths and the becomes blocked, till common resources are freed.

Suggested switch design uses low latency wormhole routing. This mechanism outperforms store and
forward in terms of latency characteristics and at the same time requires smaller buffers because allocated
buffer resources are at smaller units – flits.

The simulation model of proposed switch design is built using OMNET++. OMNeT++ is an extensible,
modular, component-based C++ simulation library and framework, with an Eclipse based-IDE and a graphical runtime environment.

Switch’s model is subdivided into three stages: input registers, FIFO buffers and non-blocking crossbar,
implemented as fully connected multiplexers and demultiplexers. They are represented as simple module,
making the whole switch a compound module in OMNeT++’s model contexts. As it could be seen in Fig. 2, these simple modules have number of instances, corresponding to the number of ports, which is a
configurable parameter in our model, allowing constructing of different topologies with any base and
radix. All simple modules, building the switch are interconnected by channels as well as the links between
switches themselves. Channels consist of data path and control links, which the editor (NED Editor) shows as just one line.

The compound module: the switch has a global clock, which is called directly (without using massage
mechanism) via Module::Clock () virtual function, which each module has. This allows easily defining the
sequence of three stages pipelined clock for: input registers, buffers and output ports. The next step is to
write modules behavior in C++. Each module defines its own functionality, but common strategy is: module
keeps its input data/control state, when it receives a message and forwards it to the next module on the
system clock (when its Clock() method has been invoked).

Host, which is a separate simple module, is the traffic generator and also traffic sink in our simulation model.
It maintains its own clock, which is configured in each simulation experiment, giving us different values of the
offered traffic rates.

3 TOFU System Area Network Design

TOFU – “torus fusion” is a six-dimensional mesh/torus topology which achieves highly scalabl
and fault-tolerant interconnection networks for large scale high-performance computer systems that ca
exceed 10 Petaflops [3]. It is developed by the Fujits engineers. Each network node consists of six links fo
xyz3D Torus and four fixed sized links for abc3D mesh/torus, thus forming a 6D mesh/torus from th
Cartesian product of xyz and abc, Fig. 3.

From another perspective, a node is an overlaid xyztorus that theoretically helps us to achieve twelve

times higher scalability than the 3D torus network, Fig. 4.

Each pair of adjacent abcmesh/torus is interconnected via twelve links, Fig. 5.

The routing algorithm implemented in TOFU network is path traversal first in the abc mesh/torus followed

by xyz torus and then again in the abcmesh/torus (abc=>xyz=>abc), Fig. 6

In case of faulty nodes, the multipath routing allows to detour faulty nodes in TOFU network, Fig. 7.

4 Experimental Framework

4.1 Platform

The developed parallel simulation models are tested and evaluated on IBM Blade Center with the hardware

platform, based on three Blade servers, HS21, Xeon Quad Core E5405 80w 2.00GHz/ 1333MHz/12MB L2, 2x1GB Chk, two Blade servers, HS22, 2xXeon Quad Core E5504 80w 2.00GHz/ 800MHz/4MB L2, 3x2GB Chk, O / Bay SAS to disk subsystem IBM System Storage DS3400 Single Controller and hard disk drive subsystem for IBM 750GB Dual Port HS SATA HDD chassis specialist for Blade Center, IBM eServer BladeCenter (tm) H Chassis and recorder 2x2900W PSU UltraSlim, network switch Blade Center Chassis , BNT Layer 2 / 3 Copper Gb Ethernet Switch Module, Optical Switch chassis specialist for Blade Center, Brocade (R) 10-port 4 Gb SAN Switch Module with Optical Switch Module for IBM Short Wave SFP Module, together with the necessary wiring, special cabinet Blade Center, NetBAY S2 42U Standard Rack Cabinet and specialist-arrester Power Ultra Density Enterprise C19/C13 PDU Module (WW), located at the High-Performance and GRID Computer Lab, Computer Systems Department, Technical University of Sofia.

4.2 Simulation Tool

OMNeT++ is an extensible, modular, component-based C++ simulation library and framework, with an Eclipse based-IDE and a graphical runtime environment, [4]. The simulator provides efficient tools for users to describe the structure of the actual system. Some of the main features are: hierarchically nested modules;

modules are instances of module types; modules communicate with messages through channels; flexible

module parameters; topology description language.

The active modules are termed simple modules. They are written in C++ using the simulation class library. There are also extensions for real-time simulation, network emulation, alternative programming languages (Java, C#), database integration, System C integration. OMNeT++ supports parallel simulation. The simulator is developed in a way that it encapsulates the simulation model with associated MPI code for parallel execution. The idea is, the developer to focus on

creating the model and to simulate it in a parallel
environment only with a few settings and adjustments.

4.3 Simulation Experiments and Result

Analysis The basic communication metrics include network latency and throughput. The network latency is defined as the average time for the massage transfer from the source node to the destination node. The network throughput is defined as the average number of packets, delivered for one machine cycle, or as the
information in bits, transferred per unit of time.

The simulation experiments are targeted to evaluate the communication performance of the SAN architectural design of TOFU topology. The experiments imply different packet traffic - uniform and gossiping and variable of packet size – 32 and 64 flits. According to these input parameters the simulation experiments are conducted.

The TOFU system area network is tested for two traffic patterns – Uniform and Gossiping distribution in
network. Uniform Traffic: Each node sends messages to other nodes with an equal probability (i.e., destination nodes are chosen randomly using a uniform probability distribution function).

Gossiping Traffic: It is inspired by the form of gossip in social networks. Another name for gossiping is the
so called “epidemic protocol”. The gossip traffic pattern spreads the information in a manner similar to
the spread of a virus in a biological community – a host sends a message to a recipient. When the message
is received, the recipient becomes a sender and sends messages to its neighbors and in such a way the
problem grows recursively and the network load gets higher. The packet count in all experiments is 100000.
For both traffic patterns the tests are evaluated for package sizes of 32 flits and 64 flits.

For the simulation purpose, we choose a high-speed switch architecture detailed in second paper session, [1]. Though we changed the routing algorithm logic since we have a different topology. First of all we simplified the node representation from 6D to 2D.

Secondly, we created three nodes with the design rules of Tofu. In our simulation each node knows its x and y coodinates. Therefore we easily know that numbers between 0 and 11 for 1 node, numbers between 12 and 23 another and so on. The routing algorithm reads the desired address from the flit head and first of all compares it according to the x coordinate if the x value of the desired address is the same with that of the

switch the flit head starts moving to reach its y coordinate.

Network latency of 100 000 package count for uniform and gossip traffic patterns with package size

32 flits are shown in Fig. 8.

Network latency of 100 000 package count for uniform and gossip traffic patterns with package size

64 flits are shown in Fig. 9.

The simulation results present better latency value of gossiping traffic distribution than the achieved results

of uniform traffic distribution in network. The reason for those results is: in uniform traffic distribution the

destination is with various distances, in many cases uniform destination can be close to the maximum

distance that is possible in network. On the other site, in gossiping traffic distribution many of the nodes send

messages to neighbor nodes. In this case the gossip route is closer to minimum distance nodes in network,

respectively the time to reach the destination is less and the latency results are better.

ACKNOWLEDGEMENTS

The results reported in this paper are part of a research project ДЦВП02/1, supported by the National Science Fund, Bulgarian Ministry of Education and Science. References:

[1] Borovska, P. (2009), Computer systems. Sofia; Bulgaria: Ciela, ISBN 954-649-633-2 (in

Bulgarian)

[2] Duato, J., Yalamanchili, S., Lionel M., (2002) Interconnection networks: an engineering

approach. Morgan Kaufmann Publishers, ISBN 1-55860-852-4

[3] Ajima, Y., Sumimoto, S., & Shimizu, (2009). Tofu: A 6D Mesh/Torus Interconnect for

Exascale Computers, Computer, Vol. 42 (11), pp. 36-40

[4] Varga, A., OMNeT++ version 4.0 User Manual, http://omnetpp.org

[5] Pl. Borovska, O. Nakov , D. Ivanova, K. Ivanov, G. Georgiev, Communication Performance

Evaluation and Analysis of a Mesh System Area Network for High Performance Computers, 12-th

WSEAS International Conference on Mathematical Methods, Computational Techniques and Intelligence Systems (MAMECTIS - 2010), Kantaoui, Sousse, Tunisia, May 3-6, 2010, ISBN: 978-960-474-188-5, pp. 217-222

Allianz Cornhill Information Services Pvt Ltd customer service job

2012-11-09T06:25:00.001-08:00

Allianz Cornhill Information Services Pvt Ltd

CUSTOMER SERVICE / CUSTOMER SUPPORT / CUSTOMER CARE / CLIENT SERVICE /
CLIENT SUPPORT (VOICE)

Job Summary

Company Name
Allianz Cornhill Information Services Pvt Ltd

Locations
Cochin / Kochi / Ernakulam, Thiruvananthapuram / Trivandrum

Experience
0 - 5 years

Key Skills

"Customer Service", "Customer Support", "Customer care", "Client Service", "Client Support", Voice, "Call Center", BPO, Inbound

Function
Customer Service/ Call Centre/ BPO

Role
Customer Service Executive (Voice)

Industry
ITES/ BPO/ KPO

Posted On
26th Oct 2012

Job Ref code

About Company

Allianz Cornhill Information Services Pvt Ltd

Job Description

Allianz BP Walkin on 2nd & 3rd Nov-2012 (Kochi & Trivandrum)

Customer Service Associate / Senior Customer Service Associate (Voice)

Join Allianz, a Fortune 100 company, CMMI Level 5 certified

Allianz Trivandrum provides Business Process Services including Sales, Service, Claims Processing, Management Information, Testing and Back-Office administration to Allianz globally.

Skills required:

0-5 years experience
Fluency in English
Flexible to work in shifts
Candidates who are Graduates or pursuing Graduation can apply

Walk in for an interview between 1000 to 1700 hours on 2nd and 3rd Nov-2012

Kochi:

Beaumonde The Fern, Vivekananda Lane, Near South Railway Station, Kochi , Tel: 484 3000500

www.beaumondefernhotel.com

Trivandrum:

Allianz, 2nd Floor, Bhavani, Technopark, Trivandrum

ELECTRONICS & COMMUNICATION ENGINEER Fresher / Experience Walk In Interview

2012-11-09T06:16:00.000-08:00

Tactearnhome.com

ELECTRONICS & COMMUNICATION ENGINEER Fresher /
Experience Walk In Interview

Job Summary

Company Name
Tactearnhome.com

Locations
Chandigarh, Cochin / Kochi / Ernakulam

Experience
0 - 10 years

Key Skills

ELECTRONICS & COMMUNICATION Production, Maintenance, R&D Quality Control, Vendor Development, Design, Customer Support, Sales Marketing.

Education
Any graduate

Function
• Customer Service/ Call Centre/ BPO
• IT

Role
• Fresher
• Trainee
• H/W Installation/ Maintenance Engg
• Computer Operator/ Data Entry

Industry
Consultancy

Posted On
20th Oct 2012

Job Ref code
ELECTRONICS & COMMUNICATION ENGINEER

Management,Prepare User manual

Documentation in MS-word, Should good in MS office and internet.

Job Description ::

(1) Design Drafting, Modelling, tooling, new product development, model testing ,2D, 3 D Knowledge, interact with production department, Concept generation in Photo Shop, Detail Designing in CAD & Design Reviews.

(2) 3-D Modeling, Assembly & Drafting in Ideas12NX and NX5.

(3) Design calculations, Design freeze and review.

(4) Design Conflict resolution with various Organizational aggregates.

(5) Design release for Pilot lot build, ECA implementation and Product regularization.

(6) Managing overall operations related with component Design and its complete lay outing according to component assembly.

(7) To do from the initial design of the component and it's drawing up to the fitment in the assembly.product development or design development.

(8) Good communications with Vendors & Customer.

FPGA: An Efficient And Promising Platform For Real-Time Image Processing Applications -paper presentation

2012-11-06T10:10:00.000-08:00

Proceedings of the National Conference on

Research and Development in Hardware & Systems

(CSI-RDHS 2008)

June 20-21, 2008, Kolkata, India

FPGA: An Efficient And Promising Platform For Real-Time Image Processing Applications

Sparsh Mittal, Saket Gupta and S. Dasgupta

E&C Department, Indian Institute of Technology Roorkee, sparsuch@iitr.ernet.in

E&C Department, Indian Institute of Technology Roorkee, freshuce@iitr.ernet.in

E&C Department, Indian Institute of Technology Roorkee, sudebfec@iitr.ernet.in

Abstract

Digital image processing (DIP) is an ever growing area with a variety of applications including medicine, video surveillance, and many more.. To implement the upcoming sophisticated DIP

algorithms and to process the large amount of data captured from sources such as satellites or medical instruments, intelligent high speed real-time systems have become imperative. Image processing algorithms implemented in hardware (instead of software) have recently emerged as the most viable solution for improving the performance of image processing systems. This paper reviews the relative merit of FPGA over softwares and DSPs as a platform for implementation of DIP applications. Our goal is to familiarize applications programmers with the state of the art in compiling high-level programs to FPGAs, and to survey the relevant research work on FPGAs. The outstanding features which FPGAs offer such as optimization, high computational density, low cost etc, make them an increasingly preferred choice of experts in image processing field today.

Keywords: Digital Image Processing (DIP), FPGA, Hardware Descriptive Language, PC

1. Introduction

Digital image processing [1] is an ever growing area with variety of applications in different fields. As image sizes and bit depths grow larger, software has become less useful in the video-processing realm. Generally even specialized image processing programs running on PCs cannot adequately process large amounts of high-resolutions treaming data, since PC processors are made to be for general use and hence are unable to efficiently implement many current sophisticated DIP algorithms. Also, to process the large amount of data captured from satellites and ground-based detection systems or 3D data from medical instruments, intelligent high speed real-time systems have become imperative, which may process data before passing it to the human analyst. The requirements demand a system ideally having characteristics viz. high performance, flexibility, easy up gradability, low development cost, and a migration path to lower cost as the application matures and volume increases.

Recently, image processing algorithms implemented in hardware have emerged as the most viable solution for improving the performance of image processing systems.

The introduction of reconfigurable devices and system level hardware programming languages has further accelerated the design of DIP in hardware. FPGAs are often used as implementation platforms for real-time image processing applications. A Field Programmable Gate Array (FPGA) is a programmable (or reconfigurable) device [2] in which the final logic structure can be directly configured by the end user. An FPGA consists of an array of uncommitted elements that can be programmed or interconnected (or configured) according to a user’s specification in a virtually

limitless number of ways. Being reprogrammable and easily upgradable, an FPGA offers a compromise between theflexibility of general-purpose processors and the hardware-based speed of ASICs.

In this paper we survey implementation of image processing applications on FPGAs with an emphasis on the salient features of FPGAs. The rest of the paper is organized as follows. Section 2 highlights limitations of other implementation alternatives and serves to set the stage for explaining the advantage of FPGAs. In section 3 weevaluate FPGAs on several relevant parameters. Section 4

summarizes prior research in the FPGA implementation of image processing algorithms. Finally, section 5 concludes the work and gives directions for future work.

2. Setting the stage: Limitations of other platforms

2.1 Drawbacks of DSPs and ASICs

System architecture choices for hardware implementation include standard cell ASICs, ASSPs, and programmable solutions such as digital signal processor (DSP) or media processors and FPGAs. Each of these has advantages and disadvantages. ASSPs are inflexible, expensive, and time-consuming to develop. Full custom ASIC design offers highest performance, but they cannot be changed. Hence any error in the hardware design existing after fabrication wastes the entire product. DSPs are specialized microprocessors, typically programmed in C, or with assembly code for improved performance. It is well suited to extremely complex math intensive tasks such as image processing. Knowledge of hardware design is still required, but its advantage is that the learning curve is much lower than other design choices. However, powerful DSPs are costly and their corresponding software applications may not match the performance of hardware.

The reconfigurable computing technology in FPGAs [3], along with many other features of FPGAs make them ideally suited for real-time video processing. Hardware design techniques such as parallelism and pipelining techniques can be developed on an FPGA [4], which is not possible in dedicated DSP designs. The primary reason most engineers choose an FPGA over a DSP is driven by the MIPS

requirements of an application [5]. The need for high performance rules out processor-only architectures. A state-of-the-art DSP running at 1 GHz cannot perform H.264 HD decoding or H.264 HD encoding. FPGAs are the only programmable solutions able to tackle this problem.

2.2 Drawbacks of PCs

Software implementation of most image processing algorithms has several limitations and hence it is quite difficult to achieve. Complex operations have to be realized by a large sequence of simple operations, which can only be implemented serially. The range of available operations is limited to common basic operations. The constraint of real-time processing introduces a number of additional complications. These include such issues as limited memory bandwidth, resource conflicts, and the need for pipe lining.

The CPU is burdened with additional tasks, such as OS requests, user interaction, etc., which is a major drawback in the context of real-time processing. At real-time video rates of 25 frames per second a single operation performed on every pixel of a 768 by 576 color image (PAL frame)equates to 33 million operations per second. (excluding the overhead of storing and retrieving pixel values.) Many

image-processing applications require that several operations be performed on each pixel in the image resulting in an even large number of operations per second. As a result it is difficult to meet hard real time requirements with softwares [3].

2.3 The advantages of FPGAs

The salient features of FPGAs that make them superior in speed, over conventional general-purpose hardware like Pentiums is their greater I/O bandwidth to local memory, pipe lining, parallelism and availability of optimizing compiler. Complex tasks, which involve, multiple image operators, run much faster on FPGAs than on Pentiums, in fact, ref [6] report 800 time speed up by FPGA using SA-C. There are several reasons for such large speed up which FPGAs have over PCs (see section 3). In comparison to an FPGA, hardware such as Pentium runs at memory speed, not at cache speed. So, even running at much higher clock frequency and having the facility of cache memory, it responds much slower than a comparable FPGA. Frequency of operation in hardware such as Pentium can be increased up to a certain extent to increase the performance or the required data rate to process the image data, but increasing the frequency above certain limits causes system level and board level issues that become a bottle neck in the design. However, the difference in speeds also depends on the

particular application involved [6]. In particular, complex image processing applications do enough processing per pixel to be computation bounded, rather than I/O bounded. Here, FPGAs dramatically outperform Pentiums by factors of up to 800. Simpler image processing operators tend to be

I/O bounded. In these cases, FPGAs still outperform Pentiums because of their greater I/O capabilities, but by smaller margins (factors of 10 or less).

3. Evaluation of FPGAs as Platform for Developing DIP Applications

3.1 Advantages of FPGAs

Many advantages of FPGAs make them a preferred choice of implementation in DIP realm. Based on our survey, we find many significant features which are as follows:-

1. A characteristic of many image-processing methods is the multiple iterative processing of data sets

such as four stages of canny edge detector, which require performing multiple passes over the image. These steps, which have to be performed sequentially on a general-purpose computer, can be fused in one pass in FPGA, as their structure is able to exploit spatial and temporal parallelism. FPGA can perform multiple image windows in parallel and multiple operations within one window also in parallel.

2. By employing several optimizations techniques such as Loop Fusion, Loop Unrolling etc efficient

usage of FPGA resources and speed-up in implementations is possible by avoiding many redundant operations.

3. FPGAs are capable of parallel I/O, which allows them to perform read (from memory), process and write (to memory) simultaneously. Many operations such as convolutions, finding square root etc can be executed much faster by using pipe lining and parallelism.

4. All of the logic in an FPGA can be rewired, or reconfigured, with a different design as often as the designer likes. This type of architecture allows a large variety of logic designs dependent on the processor’s resources), which can be interchanged for a new design as soon as the device can be reprogrammed.

5. FPGAs provide the flexibility to reprogram and upgrade to new standards [7]. Easy Upgradeability ensures that FPGAs solutions evolve quickly with no risk of obsolescence.

6. The reusability and efficiency of hardware implemented on FPGA, is especially useful in

developing Image Processing IP (intellectual property) as it allows an efficient system in terms of cost and performance. Possibility of quick integration of the IP blocks without a need of modification or repetition of verification cycle [7] simplifies debugging and thus greatly reduces the time-to-market.

7. Because of its LUT based architecture, some convolution masks (such as constant coefficient

multiplier or KCMs) can be implemented very efficiently [8].

8. High computational density in FPGA together with a low development costs allows even the lowest volume consumer market to bear the development costs of FPGAs. In fact, compared to ASICs, FPGAs are especially useful in a lower volume type of application. As authors in [9] report with low cost FPGAs high-definition solutions can now be implemented for less than US$1.00 per 1,000 logic elements (LEs)

9. The wide range of FPGAs made available from various companies like Xilinx, Altera, etc fulfill the performance requirement of many of the applications, such as display products [10].

3.2 Limitations of FPGAs

On the other hand, these are the limitations of FPGAs for image processing applications.

1. Currently there are many overheads in FPGA design. This include data transfer times which is the time required to upload (or download) the data, from (or to) reconfigurable processor to (or from) host; time for reconfiguration 2. FPGAs are excellent choice only for those algorithms which don’t use floating -point mathematics or complex mathematics. Division, direct multiplication etc are very complex and

expensive on FPGA. Hence, the designers have to reformulate their algorithms and avoid complex

mathematics (e.g. implementing a divide by 8 using the bit shifting method of division instead of a divide by9).

3. Current FPGAs cannot be reconfigured quickly as the process of modifying or combining FPGA circuits is also laborious.

4. The size of memory that can be implemented using standard logic cells on an FPGA is limited, as

implementing memory is an inefficient use of FPGA resources.

5. Routines where complex tasks cannot be broken down into simpler tasks must perform a more serial method of processing, which is not entirely efficient with FPGAs.

6. Hardware offers much greater speed than a software implementation, but it comes with a price of increased development time inherent in creating a hardware design. Most software designers are familiar with C, but in order to develop a hardware system, one must either learn a hardware design language such as VHDL or Verilog, or use a software-to-hardware conversion scheme, such as Streams-C [11], which converts C code to VHDL, or MATCH [12], which converts MATLAB code to VHDL

4. Implementation of DIP applications on FPGAs

A lot of research has been recently done on utilizing FPGAs as development platform for DIP algorithms. Here we present the related work in the area. The authors in [6] have developed a high level language (called SA-C) for expressing DIP algorithms, and an optimizing compiler that compiles the high-level program written on SA-C and runs them on FPGAs. SA-C is a single-assignment dialect of the C programming language designed to exploit many features of FPGAs [13, 14]. To compare the performance of FPGAs and the Pentium processors, they have implemented SA-C programs compiled to a Xilinx FPGA to equivalent programs running on an 800 MHz Pentium III. For 8 common DIP routines implemented on both these platforms, FPGAs offer 8 to 800 times speed-ups over the Pentium. Experiment results and analysis of various issues such as pipe lining, parallelism, optimizations, memory, I/O etc, brings out many prominent features of the FPGAs, relevant to image processing realm. In [15] they present performance numbers for several image-processing routines such as Gaussian, max and Laplace filter etc, written in SA-C.

The authors in [16] present a pipe lined architecture of image processing algorithms like median filter, basic morphological operators, convolution and edge detection implemented on FPGA. The hardware modeling is done with the Handel-C language. Moreover, in their work [17], the performance and efficiency of Handel-C language on image processing algorithms is compared at simulation level with another C-based system level language called SystemC and at synthesis level with the industry standard Hardware Descriptive language (HDL), Verilog. Comparison parameters at simulation level include, man-hours for implementation, compile time and lines of code. Comparison parameters at synthesis level include logic resources required, maximum frequency of operation and execution time.

The author in [18] implemented the Rank Order Filter, Erosion, Dilation, Opening, Closing and Convolution algorithms using VHDL and MATLAB on two FPGA platforms. He also integrates the FPGA algorithms into the modeling environment called ACS.

The authors in [19] address the issue of mapping algorithms to hardware. They present some general techniques such as look up tables, raster based methods etc for dealing with expressions that inefficiently map to hardware. They discuss the effects of and means to deal with the timing, bandwidth,

and resource constraints under different processing modes of the system. The efficient mapping of three different types of general operations viz. point, window and global operations is discussed in relation to the hardware constraints.

The authors in [3] report the speed ups that FPGAs offer on image processing methods (such as image denoising and restoration, segmentation, morphological shape recovery

etc.) on 2D and 3D images In computer vision and image processing, FPGAs havealready been used to accelerate real-time point tracking [20], stereo [21], color-based object detection [22], and

video and image compression [23] (see also [17]). Crookes presented a hardware FPGA implementation of image filtering to increase the speed [24, 25]. The authors in [26] applied three 2-input bubble sorting algorithm to obtain a triple input sorter and implemented it in FPGA. This algorithm can be utilized to obtain the maximum, middle, and minimum values and hence can be used to realize the 2-D sorting.

5. Conclusion and Future work

With a multi billion-dollar market per year, increases in FPGA speeds and capacities have followed or exceeded Moore’s law for the last several years. This survey clearly

demonstrates the outstanding features of FPGAs which make them seem very promising choice for the researchers in the field. FPGAs are great fits for video and image

processing applications, such as broadcast infrastructure, medical imaging, HD videoconferencing, video surveillance, and military imaging.

The greater future potential lies in including FPGAs on-chip with the main processor, giving the benefit of general-purpose acceleration without the communication bottleneck created by placing the FPGA in a co-processor. At the moment, applications written directly in VHDL are more efficient (albeit more difficult to develop), but we expect future improvements to the compiler to narrow this gap.

Also the disadvantages of FPGAs need to be addressed to make them more efficient and useful.

6. Reference

[1] Castleman, K. R. Digital Image Processing, Upper Saddle River, New Jersey: Prentice-Hall, 1996.

[2] Stephen D.Brown, R.J. Francis, J.Rose Z.G.Vranesic. Filed

Programmable Gate Arrays, 1992.

[3] S. Klupsch, et al. “Real Time Image Processing based on

Reconfigurable Hardware Acceleration” Available www.mpi-inf.mpg.de/~strzodka/papers/public/KlErHu_02fpga.pdf

[4] Digital Video & Image processing Xilinx solutions for

Broadcast Chain. Xilinx Ltd 2002.

[5] Telikepalli, A. Fiset, E. “Platform FPGA design for high-performance DSP”. Available http://www.lyrtech.com/DSP-development/technical_lib/form1_wp.php

[6] Bruce A. et al. “Accelerated Image Processing on FPGAs”,

IEEE Transactions on Image Processing, Dec. 2003

Volume 12, Issue12, pp 1543- 1551

[7] “Image Processing Applications on New Generation FPGAs”

by Rahul V. Shah, eInfochips Ltd.,March 7, 2006

[8] Chi-Jeng Chang, Pei-Yung Hsiao, Zen-Yi Huang. “Integrated

Operation of Image Capturing and Processing in FPGA”,

International Journal of Computer Science and Network Security,

Vol. 6 No. 1 pp. 173-180

[9] “Video and Image Processing Design Using FPGAs” Altera

white paper Available www.altera.com/literature/wp/wp-ideo0306.pdf

[10] High-Performance Image Processing on FPGAs By Michael

Tusch Available

www.xilinx.com/publications/xcellonline/xcell_57/xc_pdf/p042-044_57-apical.pdf

[11] M. Gokhale, “Stream oriented FPGA computing in streams-C,” in Proc. IEEE Symp. Field-Programmable Custom Computing

Machines, Napa, CA, 2000.

[12] P. Banerjee, “A MATLAB compiler for distributed,

hetergeneous, reconfigurable computing systems,” in IEEE Symp.

Field-Programmable Custom Computing Machines, Napa, CA,

2000.

[13] A. P. W. Böhm, et al, “Mapping a single assignment

programming language to reconfigurable systems,”

Supercomputing, vol. 21, pp. 117–130, 2002.

[14] http://www.cs.colostate.edu/~cameron/

[15] Compiling and Optimizing Image Processing Algorithms for

FPGA’s Bruce Draper, Walid Najjar, Wim Böhm, Jeff Hammes,

Bob Rinker, Charlie Ross, Monica Chawathe, José Bins

[16] Daggu V. R.and Venkatesan M. “Design and Implementation

of an Efficient Reconfigurable Architecture for Image Processing

Algorithms using Handel-C”

www.uweb.ucsb.edu/~shahnam/CannyAlgorithmImplementation.p

[17] Daggu Venkateshwar Rao, et al “Implementation and

Evaluation of Image Processing Algorithms on Reconfigurable

Architecture using C-based Hardware Descriptive Languages”

Available www.gbspublisher.com/ijtacs/1002.pdf

[18] Nelson, A.. Implementation of Image Processing Algorithms

on FPGA Hardware. Masters Thesis, Graduate School of

Vanderbilt University, 2000.

[19] Johnston, C. T., Gribbon, K. T., and Bailey, D. G.,

“Implementing Image Processing Algorithms on FPGAs,”

Proceedings of the Eleventh Electronics New Zealand Conference,

Palmerston North, New Zealand, pp. 118-123, Nov 2004.

[20] A. Benedetti and P. Perona, “Real-time 2-D feature detection

on a reconfigurable computer,” in Proc. IEEE Conf. Computer

Vision and Pattern Recognition, Santa Barbara, CA, 1998.

[21] J. Woodfill and B. v. Herzen, “Real-Time stereo vision on the

PARTS reconfigurable computer,” in Proc. IEEE Symp. Field-Programmable Custom Computing Machines, Napa, CA, 1997.

[22] D. Benitez and J. Cabrera, “Reactive computer vision system

with reconfigurable architecture,” in Proc. Int. Conf. Vision

Systems, Las Palmas de Gran Canaria, 1999.

[23] R.W. Hartenstein, J. Becker, R. Kress, H. Reinig, and K.

Schmidt, “A reconfigurable machine for applications in image and

video compression,” in Proc. Conf. Compression Technologies

and Standards for Image and Video Compression, Amsterdam,

The Netherlands, 1995.

[24] Crookes D. et al., “Design and implementation of a high level

programming environment for FPGA-based image processing,”

Vision, Image and Signal Processing, IEE Proceedings, vol. 147,

Issue: 4 , Aug, 2000, pp. 377 -384.

[25] Bouridane A., Crookes D., Donachy P., Alotaibi K., and

Benkrid K., “A high level FPGA-based abstract machine for image

processing,” Journal of Systems Architecture vol. 45, Issue: 10,

April, 1999, pp. 809-824.

[26] Maheshwari R., Rao S.S.S.P., and Poonacha P.G., “FPGA

implementation of median filter,” Tenth International Conference

on VLSI Design, June, 1997, pp. 523 -524.

Power Reduction in VLSI chips by Optimizing Switching Activity at Test Process, Architecture & Gate Level-paper presentation

2012-11-06T01:41:00.002-08:00

Power Reduction in VLSI chips by Optimizing Switching Activity at Test Process, Architecture & Gate Level

Chetan Sharma

(M.Tech-VLSI Design, JSS Academy of Technical Education, Noida, India)

Abstract:

Due to increasing the demand of low power VLSI test process, it is necessary to consider all

small factors which affect on total power dissipation. This paper gives the reduction of power by

advancement in test pattern generation methods and gives the complete flow of data using switching

suppression blocks at architecture and gate level.

Keywords: Don’t care bit feeling, ATPG method, Signal gating flow, Bus invert coding flow.

Introduction:

The power dissipation of any circuit depends upon switching activity as shown in following equation:

There are various techniques for reducing this switching activity at different levels of VLSI design at different

level of design like

(1) For Architecture level: We use guarded evaluation at architecture level.In this case a latch circuit is used which checked the condition of input after that it decide that these input should be feed to original circuit or not. Thus switching activities are reduced at this level.

(2) For Gate level:

(a) Gate level signal gating technique is used for switching activity reduction. In this technique an extra

hardware such as controller circuit is required. The main drawback at this level switching power reduction is

that if controller need more power to operate their functionality then it becomes ineffective. So prior to use this technique power consumption by controller circuit is calculated and use as shown in following fig (b)

(b) Bus inverter encoding: The key idea behind this technique is to compare the bit streams of previous transmitted data & present data then we’ll decide that whether we have to send original data or invert foam of it, depending on minimum switching activity present either in original information or in invert foam.

(3) Switching activity reduction in testing techniques:

There are various steps of frontend VLSI for making a goodquality product. Firstly RTL is design by keeping into account the testing aspects for minimizing technical effort in test vector generation and producing low cost testing. It has few disadvantages like as increasing complexity of designing, increasing area and number of input pads. RTL is designed by taking intoconsideration the specification preapered by architecture team according to customer requirement. After it Test bench is designed by the same design engineer. At the last frontend step, Test case is written which will initiate all test bench modules and provide test vectors for testing the RTL.

For the test vector anyone can use manual method of test pattern generation in which CAD tool can be used.

According to functionality of gate, test vectors are generated in the manual method.

Except it another technique of test pattern generation isATPG (Automatic Test Pattern Generation). A specified method is used for self generation of test vectors for testing the CUT (circuit under test).There are various method like as D Roth’s algorithm technique, Boolean difference method.

In the D Routh’s technique there are following three steps: (a) Fault activation: if stuck at 0 fault then set that

particular node to 1 and vise-versa. (b): Path sensitization: propagation is done onfaulty node to accessable

output node. (c) Line justification: In this step back trace is done fro accessable output to accessable input

nodes. By doing these three steps Test vectors are generated at all input nodes. In this method don’t care ‘x’ may come at the test vector.

Second ATPG method is by Boolean method. In this technique boolean relation between test vectors. It does’nt need to path sensitization like D routh’s method. For calculate test vector for the stuck at 0 fault at any node N (suppose). Then df/dN is calculated by Exclusive OR between output function f1 and output function f2. Output

function f1is calculated by placing N=0 in original output f and Output function f2 is calculated by placing N=1 in original output f. Now nor stuck at 0 fault N is multiplied in df/dN. Now value of primary inputs are calculated by comparing this function to logic value1.This technique may also have don’t care bit “x” at the test vector.

This don’t care should replaced by particular defined bit. We can choose either 0 or 1.Normally it is seen that design engineer choose randomly this don’t care bit.But it should choose such that there will be minimum

switching activity in the test vector because on reducing switching activity, desirable power reduction will

produce.

For example test vector generated by automatic test pattern generation technique shown in fig(d). It has two X bits i.e. second bit and fifth bit.

Now on the place of X state, defined bit 0 or 1 is used according to previous and next bit of this don’t care bit. As shown in example second don’t care is replaced by bit 1 because there isno switching among first three bits of test vector. If we replace it by 0 then it’ll increase 2 switchingactivities. Finally affect the power. So by this method second bit is replaces as defined bit 1.

In the case of fifth bit generated by ATPG method. We’ll check only fourth bit because bit vector length is 5.As fourth bit is 0 so this don’t care should replaced by 0 for no switching activity involved in fourth and fifth bit position.

Conclusion:

In this paper power dissipation of testing process is decreased by minimizing switching activities of test vector. This test vector is generated by Automatic test pattern generation method. There is the requirement of define path for external circuit which is used to switching activity optimization as described in this paper.

References:

[1] P.Girard Survey of Low –Power Testing of VLSI Circuits: proceeding IEEE Design & Test -2002 pp.82-92

[2] N.Nicola and B.M.Al-Hashimi Power –Costrained Testing of VLSI Circuits: proceeding in Kluwer Academic Publishers-2003

[3] P.Girard, C. Landrault, S. Pravossoudovitch and D.Severac Reducing Power Consumption During Test Application by Test Vector

Ordering: proceeding in ISCAS-1998 pp.296-299

[4] R.Sankaralingam, R. Oruganti and N. Touba Static Compaction Techniques to Control Scan vector Power Dissipation Proceeding in

IEEEVLSITestSymposium-2000

[5] K.A.Bhavsar Mehta, Analysis of Test Data Compression Techniques Emphazing Statistical Coding Schemes: proceeding in ACM

Digital Library USA,2011

[6] Giacomotto C. and Oklobdzija V.G., "LogicStyle Comparison for Ultra Low PowerApplications,"Techcon (SemiconductorResearch

Corp.), Oct. 2005.

[7] "Predictive Technology Model”, Websitecurrentlyavailable online at www.eas.asu.edu/~ptm.

JPEG steganography: a performance evaluation of quantization tables

2012-11-06T01:07:00.002-08:00

2009 International Conference on Advanced Information Networking and Applications

JPEG steganography: a performance evaluation of quantization tables

Adel Almohammad
Brunel University
adel.almohammad@brunel.ac.uk

Gheorghita Ghinea
Brunel University
george.ghinea@brunel.ac.uk

Robert M. Hierons
Brunel University
rob.hierons@brunel.ac.uk

Abstract

The two most important aspects of any image-based steganography system are the imperceptibility

and the capacity of the stego image. This paper evaluates the performance and efficiency of using

optimized quantization tables instead of default JPEG tables within JPEG steganography. We found

that using optimized tables significantly improves the quality of stego-images. Moreover, we used this

optimization strategy to generate a 16x16 quantization table to be used instead of that

suggested in [1]. The quality of stego-images was greatly improved when these optimized tables were

used. This led us to suggest a new hybrid steganographic method in order to increase the embedding capacity. This new method is based on both [1] and Jpeg-Jsteg methods. In this method, for

each 16x16 quantized DCT block, the least two-significant bits (2-LSBs) of each middle frequency

coefficient are modified to embed two secret bits. Additionally, the Jpeg-Jsteg embedding technique is

used for the low frequency DCT coefficients without modifying the DC coefficient. Our experimental

results show that the proposed approach can provide a higher information-hiding capacity than the other methods tested. Furthermore, the quality of the produced stego-images is better than that of other methods which use the default tables

1. Introduction

Message transmissions over the Internet still have data security problems. Therefore, secure and secret
communication methods are needed. Cryptography scrambles the message so that it cannot be understood. However, it makes the message suspicious enough to attract eavesdropper’s attention.Steganography hides the secret message within other innocuous-looking cover files (i.e.images, music and video files) so that it cannot be observed.

There are two kinds of image steganographic techniques: spatial domain and frequency domain based methods. The schemes of the first kind directly embed the secret data within the pixels of the cover
image such as Least Significant Bit (LSB) insertion. The schemes of the second kind embed the secret
data within the cover image that has been transformed such as DCT (discrete cosine transformation). The DCT coefficients of the transformed cover image are quantized, and then modified according to the secret data [10].

Capacity and stego-image quality (imperceptibility) are the two most important requirements of any steganographic system. Capacity is the amount of data embedded within a given image while the imperceptibility means that the hidden message cannot be perceived by the human visual system or other statistical means. Furthermore, increasing the capacity while maintaining the imperceptibility is still a challenge. However, many novel embedding techniques have been suggested in order to enhance the security and increase the capacity of steganographic methods [4, 10, 11, 18, 21].

One of the most popular image formats widely used on the Internet and World Wide Web (WWW)
is JPEG. JPEG compression provides a large compression ratio and maintains high image quality.
Moreover, JPEG has been widely used within the steganographic community as a cover image [15, 16,
18, 19].
In JPEG compression, the image is divided into disjoint blocks of 8x8 pixels, a 2-dimensional DCT
is applied to each block, and then the DCT coefficients of these blocks are quantized and coded
[8]. Most of the steganographic techniques used for JPEG images adopt the standard JPEG compression.
The cover image is divided into non-overlapping blocks of 8x8 pixels in order to perform DCT and
provide compressed images [2, 11, 12, 15, 16, 18, 19].
Although the JPEG standard uses 8x8 quantization tables, it does not specify default or standard values for quantization tables. Specifying the quantization values is left up to the application. However, the JPEG standard provides a pair of quantization tables (luminance and chrominance) as examples tested empirically and found to generate good results (Table1 for luminance). Since this quantization table is widely used, it will be called the JPEG default quantization table. However, there are no samples for larger quantization tables in the JPEG standard.

In order to balance between image quality and compressed image size, a "Quality Scaling Factor"
can be applied to the quantization table (equation (1)) [18]. Table 2 represents the default table (Table 1) but with quality factor Qf = 2
Qx,y' = round[ Qx,y / Qf ] -------------(1)

The human visual system (HVS) is more sensitive to lower frequency noise since the energy of natural

images is concentrated on the lower frequency components [2]. In image compression with a JPEG

baseline system, the quantization step maintains the DCT coefficients needed to achieve the desired

image quality whilst it zeroes out most of high frequency DCT coefficients and discards information

that is visually irrelevant [20]. Therefore, quantization table influences image quality.

Since the quantization table is not part of the

JPEG standard, users are allowed to design or redefine the quantization table to control the quality

of the reconstructed image and the compression ratio [3]. Miano states that “If you are implementing a

JPEG encoder you can come up with your own scaling or use any other method you want for generatingquantization values”. Therefore, a quantization table can be arbitrarily generated [13].

Many different methods have been proposed to find the optimum quantization table for JPEG

compression because the loss of fidelity in JPEG coding occurs entirely in the quantization step [20].

In this paper, we evaluate the impact of using optimized quantization tables (OQT) instead of the

default quantization tables (DQT) on the performance of JPEG steganography. Moreover, we

propose a new steganographic method with higher embedding capacity and better stego-image quality

compared with the other methods tested in this paper.

The rest of this paper is organized as follows. Section 2 will review the related work on methods of .JPEG steganographic and quantization tables’ optimization. Section 3 will propose our data hiding scheme based upon JPEG. Section 4 will show our experimental results and will discuss the attributes of our proposed method. Finally, the conclusion will be presented in Section 5

2. Related work

The method proposed in this paper optimizes the steganographic method of [1] in terms of capacity
and stego-image quality. Moreover, it optimizes Jpeg-Jsteg and Chang et al. methods. Therefore, these methods are discussed in this section. Furthermore, the optimization methods of JPEG quantization table are described here as well.

2.1 Steganographic methods

The widely known JPEG-based steganographic tool Jpeg-Jsteg divides the cover image into non-overlapping blocks of 8x8 pixels. It embeds the secret data in the LSB of the quantized DCT coefficients of each block. Since it embeds only one bit in each quantized coefficient whose value is not 1, 0, or -1, the capacity of this method is very limited [21].

Since the energy of images is concentrated in the lower frequency coefficients, modifying such coefficients may cause a quality degradation of output image. However, high frequency coefficients will be discarded due to the quantization process. Accordingly, Chang et al. [2] developed a steganographic method based upon JPEG and modified 8x8 quantization table (Table 3) in order to improve the hiding capacity of Jpeg-Jsteg method. They utilized the middle frequency for embedding in order to achieve better hiding capacity and
acceptable stego-image quality. For each quantized DCT block, the least two-significant bits (2-LSBs) of
each middle frequency coefficient were modified to embed two secret bits.In previous work [1], we proposed a steganographic method based upon JPEG compression and DCT transformation. We divided
the cover image into disjoint blocks of 16x16 pixels instead of blocks of 8x8 pixels. Furthermore, we
suggested a 16x16 quantization table (Table 4) and used the middle frequency coefficients for data
embedding. For each quantized DCT block, the least two-significant bits (2-LSBs) of each middle
frequency coefficient were modified to embed two secret bits. We got better results in terms of capacity and imperceptibility than the previous two methods discussed.

2.2 Optimizing JPEG quantization tables

In image compression with a JPEG baseline system, it is possible to control the image quality and
compression ratio by controlling values in quantization table [7]. Therefore, it is useful to find a quantization table with better image quality than obtained by the JPEG default tables [5]. We now describe some methods for optimizing the JPEG quantization table

The relationship between quantization tables and reconstructed JPEG images’ quality was investigated
in [17]. The quantization table was partitioned into four bands by frequency. Subsequently, each value in
each band was changed and then the quality of image was examined. As a result, it was found that the DC
coefficient has an important effect on the image quality while the higher frequency coefficients have
only a secondary importance. In another piece of work, a statistical method was used in [7] to propose
a better quantization table than the default tables of JPEG compression (medical ultrasonic echo images)
in order to improve the compression ratio.
In related work, Chang et al. proposed a novel

approach for designing an image independent JPEG quantization table. They derived a perceptual

quantization table by incorporating the human visual system (HVS) with the uniform quantizer. This

HVS-based quantization table was superior to JPEG default quantization table in terms of the perceptual

quality of the reconstructed image as well as the Peak Signal-to-Noise Ratio (PSNR) [3].

Additionally, a model for generating a JPEG quantization table was proposed in [5] to improve the

PSNR of the final image. The quality of the reconstructed image using this quantization table was

better than the quality of image using the default JPEG quantization table.

Finally, a general strategy for modeling optimal quantization tables was presented in [14]. This

method was designed for adaptive DCT image coding. Moreover, it can be used both for the JPEG

image compression standard and for an extension of the JPEG approach to image block sizes other than

8x8 pixels. These optimized tables produced considerably improved compression performance

compared to the default JPEG quantization table.

In conclusion, using an optimized quantization table for JPEG compression provides a reconstructed

image with better quality than using the default JPEG table. Therefore, by using such optimized

quantization tables, we can either get stego-images with better quality or hide more data while

maintaining the stego-image quality.

3. The proposed method

The majority of research in the JPEG steganography area uses the default JPEG quantization table or a modified version of this table [2, 15, 18, 19]. However, an arbitrary and modified 16x16 quantization table was proposed in [1]

In this paper we propose a hybrid steganographic method based on both [1] and Jpeg-Jsteg. Moreover,

an optimized quantization table is used instead of that arbitrary generated one. Furthermore, the impact of using such optimized quantization tables with the other stego methods is examined against the image

quality and capacity.

3.1. Optimized quantization tables

Having shown the importance of the quantization table in the JPEG compression system, we are going

to investigate and evaluate the effects of using optimized quantization tables on JPEG

steganography.

Since we are going to optimize the steganographic method proposed in [1], we need an optimized 16x16

quantization table. The optimization strategy proposed in [14] is an appropriate method to be used

because it can produce quantization tables with various dimensions rather than just 8x8 tables.

The optimized tables of Monro and Sherlock are represented by a three parameter model as following [14]:

3.2. The embedding and extracting procedures

The procedure of embedding a secret message in a cover image for our proposed steganographic method can be described as follows:

1. The message (M) to be embedded in the cover image is randomly generated.

2. The cover image is divided into non-overlapping blocks of 16x16 pixels and then the DCT is used to

transform each block into DCT coefficients.

3. The DCT coefficients are scaled by the optimized and modified 16x16 quantization table (Table 6.B).

In this quantization table, the values of (1) represent the middle frequencies to be used for embedding

(242 bits). The quantized DCT coefficients of each block are rounded to the nearest integers and then set

in zigzag scan order.

4. Jpeg-Jsteg embedding is applied to the low frequency coefficients (top left part, 14 coefficients,

of each block) without using the DC coefficient for embedding.

5. The least two-significant bits of each middle frequency coefficient in the quantized DCT blocks are modified to embed two secret bits.

6. The JPEG entropy coding (DPCM, Run-Length coding, and Huffman coding) is applied to compress

these resultant blocks, and then the JPEG file is obtained.

In our method, the procedure of extracting the embedded message from the JPEG can be described

as follows:

- The JPEG file (stego-image) is entropy decoded using the coding tables (Huffman tables) located in the image header. As a result we get the blocks of quantized DCT coefficients modified according to the secret message.

- From each pre-defined middle frequency coefficient of each block we retrieve the least two-significant bits (secret bits).

- From each low frequency coefficient of each block (where its value does not equal to 0, 1, or -1), we

retrieve the LSB.

- We put these retrieved bits in the same order of embedding to get the secret message (M).

4. Evaluation and discussion

Experiments were conducted in order to evaluate the efficiency of our method. Five gray-level images:

Lena, Tiffany, Couple, Peppers, and Baboon (Fig 1, Fig 2, Fig 3, Fig 4, and Fig 5 respectively), each of

512x512 pixels were used as cover images.

The four methods ([1, 2], Jpeg-Jsteg, and our proposed method) were coded in Matlab R2007a (V

7.4.0) and run on a PC Pentium 4 with 1GB of RAM under the Windows XP operation system.

One of the methods used to evaluate the quality of images is the human evaluation techniques. In these

techniques, humans are asked to observe some images and then to evaluate or assess the visual quality of these images. However, the visual sensitivity varies from person to another and it changes over time in anyone. Therefore, different viewers will behave differently [6]. Consequently, most researchers use Peak Signal to Noise Ratio (PSNR) and Mean Square Error (MSE) criteria to measure the quality of image coding and compression [9]. The PSNR and MSE for an NxN gray-level image are defined as [2]:

4.1 Performance evaluation

In order to evaluate the performance and efficiency of the optimized quantization tables, we used them with Jpeg-Jsteg, [2], and [1] methods. Table 7 shows the capacity (bits) of the cover images using these three methods once with the default tables (Table 2, Table 3, and Table 4 respectively) and once with the optimized tables (Table 5.A, Table 5.B, and Table 6.B respectively). The Jpeg-Jsteg method does not embed a fixed number of secret bits within a given cover image. However, the capacity varies from one block to another, so this method includes code to count the number of secret bits embedded within each cover image. The method in [2] uses the 2-LSB of each predefined middle frequency coefficient (set to be 1 in Table 3 & Table 5.B) for embedding. Each block of 8x8 pixels can embed 2x26 secret bits. Therefore, a cover image of 512x512 pixels can hold 52x (512x512)/ (8x8) =212992 secret bits. However, the method in [1] can embed 242 secret bits in each block of 16x16 pixels using the same technique (Table 4 & Table 6.B). Therefore, the capacity of a cover image of 512x512 pixels is 242x (512x512)/ (16x16) = 247808secret bits.

Table 8 shows the quality of stego-images for these three methods. It is obvious that the quality of all stego-images produced were considerably improved when the optimized quantization tables were used instead of the default ones.

4.2 The novel method suggested

The improvement in the stego-image quality of method [1] was exploited to increase the capacity of

embedding. Therefore, we suggested the hybrid stego method which involves the technique in [1]

(for the middle frequencies) along with the Jpeg-Jsteg technique (for the low frequencies without the

DC coefficient). Table 7 and Table 8 respectively show the capacity and stego-image quality of this novel stego method. Our suggested method along with the optimized quantization table (Table 6.B) can embed

much more information in the cover images than other methods tested. Using our method, the quality

of the produced stego-images was better than that of other methods (which use the default tables). Since

the capacity and imperceptibility represent the two main requirements of any steganographic technique

[22], our steganographic method provides larger embedding capacity and better stego-images’ quality.

5. Conclusion and future work

In this paper, we proposed a new steganographic method to improve the imperceptibility and increase

the capacity of our method previously proposed in [1]. The suggested method was based on both [1] and

Jpeg-Jsteg methods. It was shown that our new method can embed considerably more secret

information than other stego methods tested. Furthermore, the quality of our method’s stego-images was better than that of other methods which use the default quantization tables. However, determining the optimal quantization table for steganography still represents a challenge and requires further investigation.

Almost always the color space YCbCr is used to store JPEG images. The component Y (luminance)

represents the intensity of the image. However, the components Cb and Cr (chrominance) specify the blueness and redness of the image respectively. Using only the Y component in such color model

(YCbCR) produces a gray-level representation of the color image [13]. Therefore, gray-level images

represent special cases of color images. As a result, color images can be used as cover images but we

have to take all of these components (Y, Cb, and Cr) into consideration. In this case, each of the

chrominance components (Cb and Cr) should have the same coding procedures that Y component has.

In our future work we will consider color images and investigate the feasibility of using the chrominance

components for data hiding. Moreover, we will investigate the impact of using optimized quantization tables on the size of JPEG stego-images.

6. References

[1] A. Almohammad, R. M. Hierons and G. Ghinea, “High Capacity Steganographic Method Based Upon JPEG”, The Third International Conference on Availability, Reliability and Security. ARES08, Barcelona, Spain, 4-7 March, 2008, pp. 544-549.

[2] C.-C. Chang, T.-S. Chen and L.-Z. Chung, “A steganographic method based upon JPEG and quantization table modification”,Information Sciences,vol.141, 2002, pp. 123-138.

[3] L.-W. Chang, C.-Y. Wang and S.-M. Lee, “Designing JPEG quantization tables based on human visual system”, In Proceedings of The International Conference on Image Processing. ICIP 99, Kobe, 24-28 October, vol.2, 1999, pp. 376-380.

[4] R. Chu, X. You, X. Kong and X. Ba, “A DCT-based image steganographic method resisting statistical attacks”, In Proceedings of IEEE International Conference on Acoustics, Speech, and Signal Processing. ICASSP '04, 17-21 May. vol. 5, 2004, pp V-953-6.

[5] L. F. Costa and A. C. P. Veiga, “Identification of the best quantization table using genetic algorithms”, IEEE Pacific Rim Conference on Communications, Computers and Signal Processing. PACRIM 2005, 24-26 August, 2005, pp. 570-573.

[6] I. Cox, M. Miller, J. Bloom, J. Fridrich and T. Kalker, “Digital Watermarking and Steganography-Second Edition”, Burlington, MA, USA, Elsevier Inc, 2008.

[7] K. Hamamoto, “Standardization of JPEG quantization table for medical ultrasonic echo images”, In

Proceedings of The 6th IEEE International Conference on Electronics, Circuits and Systems. ICECS '99.Pavos, 5-8 September, vol.2, 1999, pp. 683-686.

[8] ISO DIS 10918-1 “Digital Compression and Coding of Continuous-Tone Still Images (JPEG)”, CCITT

Recommendation T.81.

[9] X. Kong, R. Chu, X. Ba, T. Zhang and D. Yang, “A Perception Evaluation Scheme for Steganography”,in Intelligent Data Engineering and Automated Learning, vol.2690: Springer Berlin / Heidelberg, LNCS, 2003, pp. 426-430.

[10] Y. K. Lee and L.-H. Chen, “High capacity image steganographic model”, In IEE Proceedings on Vision, Image and Signal Processing, June, 147(3), 2000, pp. 288-294. [11] Y.-K. Lee and L.-H. Chen, “Secure Error-Free Steganography for JPEG Images”, International Journal of Pattern Recognition and Artificial Intelligence, vol.17, 2003, pp. 967-981.

[12] Q. Li, C. Yu and D. Chu, “A Robust Image Hiding Method Based on Sign Embedding and Fuzzy Classification”, The Sixth World Congress on Intelligent Control and Automation, 2006. WCICA 2006, June 21-23. 2006, pp.10050-10053.

[13] J. Miano, “Compressed Image File Formats: JPEG, PNG, GIF, XBM, BMP”, Addison-Wesley, 1999.

[14] D. M. Monro and B. G. Sherlock, “Optimal Quantisation Strategy for DCT Image Compression”, In

IEE Proceedings of Vision Image and Signal Processing, 143(1), 1996, pp. 10-14.

[15] V. K. Munirajan, E. Cole and S. Ring, “Transform domain steganography detection using fuzzy inference systems”, In Proceedings of the IEEE Sixth International Symposium on Multimedia Software Engineering, 13-15 December, 2004, pp. 286-291.

[16] J. Rongrong, Y. Hongxun, L. Shaohui, W. Liang and S. Jianchao, “A New Steganalysis Method for Adaptive Spread Spectrum Steganography”, In Proceedings of the International Conference on Intelligent Information Hiding and Multimedia Signal Processing. IIH-MSP '06, Dec, 2006, pp. 365-368.

[17] T. Shohdohji, Y. Hoshino and N. Kutsuwada,“Optimization of quantization table based on visual

characteristics in DCT image coding”, Computers & Mathematics with Applications, 37(11-12), 1999, pp. 225-232.

[18] H.-W. Tseng and C.-C. Chang, “Steganography using JPEG-compressed images”, The Fourth International Conference on Computer and Information Technology. CIT '04, 14-16 September, 2004, pp. 12-17.

[19] P. H. W. Wong and J. W. C. Wong, “A Data Hiding Technique in JPEG Compressed Domain”, In Proceedings of SPIE Conference on Security and Watermarking ofMultimedia Contents III, San Joes, CA, USA, January, vol.4314, 2001, pp. 309-340.

[20] Y. O. Yildiz, K. Panetta and S. Agaian, “New Quantization Matrices for JPEG Steganography”, In

Proceedings of SPIE, Mobile Multimedia/Image Processing for Military and Security Applications,

Orlando, FL, USA, 11 April, vol. 6579, 65790D, 2007, pp. 1-11. [21] Y.-H. Yu, C.-C. Chang and Y.-C. Hu, “Hiding secret data in images via predictive coding”, Pattern Recognition, vol.38, 2005, pp. 691-705.

[22] X. Zhang and S. Wang, “Steganography using multiple-base notational system and human vision

sensitivity”, Signal Processing Letters, IEEE, vol.12, 2005, pp. 67-70

COMBINATION OF JPEG ALGORITHM AND WATERMARKING FOR INCREASING THE QUALITY AND COMPRESSION RATIO - paper presenation

2012-11-03T04:35:00.003-07:00

COMBINATION OF JPEG ALGORITHM AND WATERMARKING FOR INCREASING THE QUALITY AND COMPRESSION RATIO

1Muhammad Subali
2 Sarifuddin Madenda

1 Gunadarma University(subali@staff.gunadarma.ac.id)

2 Departement d’informatique et d’igenierie,UQO,Quebec(m.sarifuddin@uqo.ca)

Abstract

Jpeg formation is compression model of color image which is establish as an ISO and usually public

used. Jpeg compression technique started by RGB to YCbCr colour transformation process. And each color component Y, Cb, and Cr compressed by Discrete Cosine Transform (DCT) process,. Quantizing and Coding step by step. Bits of result coding from each component of Y, Cb and Cr combined one group in series.This paper explained compression technique can be optimized JPEG result compression by bit insertion of coding result from one color component to matrix quantization from another color component. The experiment shows that the same compression quality compression technique which develop in this paper have ratio of compression about 10.99% until 154% better then JPEG codec, and for the same compression ratio this technique give better quality compression. Keywords:Image Compression, JPEG,Watermarkning,MIG

1 Introduction

Technology develop of image acquatition more sophisticated, like digital camera, scanner, has produce color image until 8 Mpixel. The higher pixel will increase need of memory and time image transmission. Algorithm develop and optimize image compression technique is prominent solution for increasing transmission efﬁciency and data memory without decrease of image quality. Compression algorithms developed for loss less and lossy compression.

JPEG 2000 which use in DWT (Digital Wavelet Transform is better product compression ratio then quality of JPEG. But its not used in the public. In another hand, JPEG used by DCT is loss less compression usually used by public and used by all the device of image acquisition. JPEG format acknowledge as ISO (International Standard Organization) for digital color image compression in 1992 (ISO/IEC JTC1 Dan CCITT Rec 81)[4].Base on digital image needs and copyright protection has develop watermarking introduce by G.C Langelar in 1996[16]. This method is insert the information in to picture by LSB of pixel.

This paper explain about combination of JPEG compression technique and watermarking to optimize compression ratio.

2 JPEG

It has been known, digital color image is pixel

collection where each pixel is color vector element three dimension (3-D) there are RGB, YCbCr

etc[32]. Image with color representation YCbCr or

YUV is used in JPEG compression. Figure 1 shows

JPEG compression process, and ﬁgure 2 show general ﬁgure of bit collection of coding result in three

color component there are Y, Cb and Cr.

For each color component , JPEG divide image in to blocks 8 x 8 pixels. Then each pixel block will causes successively DCT process, Quantization, and Coding for color component Y, Cb and Cr. Bits collection of coding result from three color component is compressed image data. And bit header collection,tables and compressed image data formed JPEG bit stream.

To the JPEG image compression, conducted return process wich start by bits divide in each color

component and continue successfully by decoding process, de-quantization and DCT invers.This process shows in ﬁgure 3. In compression process and decompression process,quatization table and coding (entropy,Huffman coding) was a same.There for this table must participated to JPEG image

compressed[35].

3 Digital Watermarking

Digital watermarking is information insert process to audio signal, image or digital video. Information

insert has visible and invisible characteristic. In watermarking visible,information can be seen visual.

Specially for information like text or owner identi-ﬁcation logo from image or video. In watermarking invisible,information inserted to audio ,imageor video but cannot be seen by visual.Important application from this type is to copyright protection system. Steganography is one of part of invisible digital watermarking, where two person can communicated secreat by information insertion into audio, image and video.

One of simple methode invisible digital watermarking is bit insertion in to pixel by Least Signiﬁcant Bit (LSB).To hide the information in to image LSB pixel, can be save 3 bits in each pixel.Manipulation of LSB pixel is quick and easy manner to hide the information. Invisible methode of digital watermarking from LSB use from modiﬁ- cation technique of JPEG compression.

4 Develop Method

To increase compression ratio,in this part we suggested technique modiﬁcation of JPEG compression

by collection between JPEG compression technique and watermarking. Two collection show in ﬁgure

4. Its different with JPEG compression technique in ﬁgure 2. This technique, bit insertion of coding

result color Cb component into quantized matrix of color Cr component. Then quantizing, inserting

and decoding in matrix Cr. Result bits of coding component Cr inserted again into quantized matrix

component Y. Finally, quantized and inserted matrix return coding and producing data bits of image

compression image. Data bits collected by header bit and quantizing and coding tables become bitstream which saved in ﬁle with extensi MIG/.MIG (Multimedia Informamation and data compression

Group).

Bit insertion conducted by using watermarking method like explained by G.C Langelar[16], is insertion of LSB in each matrix component.

5 Result Analysis

To proved performance this methode which developing in this paper,we do experiments with use comparing software are Adobe Photoshop CS2 versi 9.0.1, Morgan JPEG toolbox V2, Morgan JPEG 2000 Toolbox, ACD See 9 toward three standars images in bmp format (Babbon.bmp, Lenna.bmp, danpeppes.bmp) by resolution 512x512 pixel ( ﬁle size from each image is 769 kb).

In analyse experiment result conducted in two perspective. First, equal value ratio compression are grouped. So, PSNR value are analyzed which represented as comparation curves between compression ratio ( X axis ) and PSNR (Y Axis). The results are represented in the following ﬁgure 5 , 6 and 7. Second, equal PSNR values are grouped and then compression ratio analyzed, represented , as a comparison curves between PNSR ( X axis ) and comparison ratio ( Y axis). The results are represented in the following ﬁgure 8 , 9 and 10

Based on the three ﬁgure 5,6 and 7 shows that from equal compression ratio, MIG compression program has a high PSNR value toward adobe,Morgan, and ACD see as comparing software.

For peppers.bmp image with compression ratio about 2.7 until 16.7, MIG have PSNR value better then ACD See (smallest value). And for peppers.bmp image with compression ratio about 16 until 32, MIG have PSNR value 85.415% better then Morgan V2 (higher value). For baboon.bmp image with compression ratio 10.3 until 16, MIG have PSNR the worst value about 2 % from ACD

See. For Lena.bmp image with compression ratio about 22 until 35, MIG have PSNR the worst value

about 8.23% from ACD See.

Figure 8,9 and 10 show analysis that from equal PSNR value, All MIG compression ratio be better then comparing software. For papers image in PNSR value in above 41 dB. MIG have compression ratio about 10.99 % higher than ACD see (smaller increase in compression ratio). The higher compression ratio about 154% in MIG versus Morgan V2, And for baboon image about 36.2 dB of PSNR value. And for papers image of PNSR value in under 40 dB. MIG compression ratio about 3.8 % is smaller then ACD see.

6 Conclusion

MIG compression methode by collection of JPEG compression technique and Watermarking developed in this paper gives better result then general software, there are Adobe Photoshop CS2 versi 9.0.1, Morgan JPEG toolbox V2, Morgan JPEG 2000 Toolbox, ACD See 9. Generally MIG compression technique optimize the ratio and the JPEG compression quality in software. But MIG is longer

in time excecution process because of increasing insertion bits The future research is applicating develop method in for video compression.

References

[1] Image compression - from dct to wavelets : A review.

[2] The latest png speciﬁcation.w3c tech reports.W3C Tech Reports. Oct. 1, 1996 is the recommended v 1.0 spec.

[3] Itu-t recommendation t.81: Information technology digital compression and coding of continuous-tone still images - requirements and guidelines, 1992.

[4] Iso/iec fcd 15444-1: Information technology :Jpeg2000 image coding system, part 1: Core coding system, 2004.

[5] C. Christopoulos A. Skodras and T. Ebrahimi.

The jpeg 2000 still image compression standard. In IEEE Signal Processing Magazine,

number 18, Sept 2001.

[6] E. Atsumi and N. Farvardin. \lossy/lossless region-of-interest image coding based on set partitioning in hierarchical trees. In IEEE InternationalConference on Image Processing, Oct. 1998.

[7] R.M. van Schyndel N.R.A. Mee C.F. A.Z.Tirkel,G.A.Rankin. Osborne. electronic water mark.In DICTA, 1993.

[8] Guy E. Blelloch. Computer science department,carnegie mellon university. Introduction to Data Compression, October 2001.

[9] A. P. Bradley and F. W. M. Stentiford. Jpeg2000 and region of interest coding. In Proc. Digital Image Computing Techniques and Applications, 2002.

[10] J. Askelof C. A. Christopoulos and M. Larsson. Efﬁcient region of interest encoding techniques in the upcoming jpeg2000 still image coding standard,. In Proc. IEEE International Conference on Image Processing, Sept 2000.

[11] E. Ordentlich D. Taubman and I. Ueno. Embedded block coding. In Proc. IEEE International Conference on Image Processing, 2000.

[12] Alexey Moskvin Dmitriy Vatolin. JPEG 2000

Image Codecs Comparison, CS MSU Graphics&Media Lab Video Group. September 2005.

[13] P.E Douglas A. Kerr. JPEG Compression of Still

Images. August 16 2003.

[14] J. Zhao E. Koch. Towards robust and hidden imagecopyright labeling. In IEEE Workshop on

Non Linier Signal and Image Processing, June 1995.

[15] Adrian Ford and Alan Roberts. Colour space conversions, August 1998.

[16] et al G.C. Langelaar. Copy Protection for Multimedia Data based on Labeling Techniques.

1996.

[17] Bernd Girod. Ee368: Digital image processing, spring 2005-2006.

[18] Gernot Hoffmann. Jpeg compression,September 18 2003.

[19] http://www.acdsee.com/.

[20] http://www.morgan multimedia.com/.

[21] http://www.stanford.edu/ esetton/experiments2.htm.

[22] Ziv. J. and A. Lempel. A universal algorithm for sequential data compression. In IEEE Transactions on Information Theory, volume 23, pages 337–343, 1977.

[23] Ziv. J. and A. Lempel. Compression of individual sequences via variable-rate coding. In

IEEE Transactions on Information Theory, volume 24, September 1978.

[24] F.T. Leighton T. Shamoon J. Cox, J. Kilian. Secure spread spectrum watermarking for multimedia. In IEEE Transaction on Image Processing, December 1997.

[25] Sarifuddin Madenda. Multimedia data compression : today and future. Multimedia Information Research Group, 2006. Canada.

[26] R. Polika. The engineer’s ultimate guide to wavelet analysis: The wavelet tutoria.

[27] Zhigang Fan Sanjeeb Dash Ramesh Neelamani_, Ricardo de Queiroz and Richard G.

Baraniuk. Jpeg compression history estimation for color images. In IEEE Transactions on

Image Processing.

[28] R.E. Woods R.C. Gonzales. Digital Image Processing, Second Edition. Pearson Prentice Hall,

2005.

[29] B. Schneiner. Applied Cryptography: Protocols,Algorithm, and Source Code in C. Wiley,

New York, 1994.

[30] J. M. Shapiro. Embedded image coding using zerotrees of wavelet coeﬁcients. In IEEE Transactions on Signal Processing, volume 41, Desc 1993.

[31] Arno Swart. An introduction to JPEG compression using MATLAB. October 2003.

[32] D. Taubman and M. W. Marcelin. Jpeg2000: Standard for interactive imaging. In Proceedings of the IEEE, volume 17.

[33] D. S. Taubman and M. W. Marcelin. JPEG 2000: Image Compression Fundamentals, Standards and Practice. Kluwer Academic Publishers, Dordrecht, 2002.

[34] N. Morimoto W. Bender, D. Gruhl. A. lu, techniquesfor data hiding. In IBM System Journal,

volume 35, 1996.

[35] G. K. Wallace. The JPEG still picture compression standard, volume 34. April, April 1991.

[36] Panrong Xiao. Image compression by wavelet transform, August 2001.

fajar uno

Tips for preparing a research presentation

2012-10-28T06:53:00.001-07:00

First, organize your talk:

Identify the important ideas
Your work (or the work you are presenting) likely has many details, but only one or two main ideas; structure your talk around these main ideas.
Create a talk outline
Your talk should be organized in a top-down manner. You should have the following main sections in your talk:
- Introduction, the big picture: what, why and why we should care, and how. Be sure to include:
  - a statement of the problem being solved (what)
  - motivation and putting the work in context (why and why should we care)
  - a high-level view of the solution (how)
- Details of solution
- Results demonstrating your solution
- Critiques of the work (possibly compare to related work)
- Conclusions and future directions for this work
The talk should be organized so that the important ideas are presented first, the details second, and the conclusions last. Each section of your talk should be organized in a similar manner: big ideas, details, then summarize.

Next, design your slides:

Slide organization
Your slides should be organized like an outline--a few main points, with sub-points under each one. Your slides are a guide for your talk not a word-for-word copy of your talk. List specific points that you want to talk about as sub-topics of each main topic. If there are particular details that you want to discuss, outline them on the slide and keep written notes for you to refer to in your talk rather than writing all the details on the slide.
Summarize main points
You should have a summary slide of the main ideas at the end. If applicable, Include a list of open questions and/or future directions of your work.
It is okay to waste space
Add just enough prose prose to present the main points and highlight the main parts of each point. Use phrases rather than complete sentences and use large fonts. You can use acronyms and abbreviations sparingly, however you should say the complete name when you talk about about them. For example, if you abbreviate processes to procs on a slide, say "processes" when you talk about the point not "procs". Similarly, if your create an acronym for your super fast multi-cast implementation, SFMC, and refer to the old slow multi-cast implementation as OSMC, then say "our super fast multi-cast" and "the old slow multi-cast" rather than "SFMC" and "OSMC". The exception is for well-known acronyms such as PVM, MPI, API, JVM, etc.
A picture is worth a thousand words
Use figures and graphs to explain implementation and results. It is very hard to describe a system implementation without having a picture of the components of the system.
Number of slides
As a general rule, it should take 2-3 minutes to talk through the material on one slide, so for a 30 minute talk you should have about 13 slides.If there are too many ideas in your work to present completely in 30 minutes, then pick one or two (the most interesting/important parts) that you will discuss in detail, and present the other parts at a higher level. Also, you can create back-up slides for specific details that you don't plan to talk about, but may get questions about.

Then, prepare your presentation:

Provide a talk road-map
Tell the audience where you are going with your talk.
- Give audience a road-map of your talk at the beginning by using outline slides. Immediately after the title slide, put up an outline slide and tell the audience the main organization of your talk. Another alternative is to first have a few slides motivating the general topic, and then put up an outline slide giving the audience a road-map of your talk.
- It should be clear when you start a new high-level part of your talk. Use good transitions from one slide to the next, and from one main topic to the next..."We just talked about the implementation. Now we will look at how well the system performs."
- You may want to use the outline slide at other points in your talk to provide a visual transition between parts of your talk.
Repeat your point
There is a rule that says you have to tell your audience something three times before they really hear it:
1. Tell them what you are going to say.
2. Say it.
3. Summarize what you said.
This is particularly important for figures and graphs. For example:
1. This graph show how algorithm A performs better than algorithms B and C as the number of nodes increase.
2. The X axis is the number of nodes, the Y axis is the execution time in seconds. The red curve shows the execution time of A as the number of nodes increases.
3. Thus you can see that as the number of nodes increases above N, algorithm A performs better. This is because...
Talk to the audience
Don't read your slide off the computer, nor directly off the screen. It is okay to stop for a second and refer to your notes if you need to.
Practice
Give a practice run-through of your talk in front of an audience of at least one other student. Stand in a room for 30 minutes (or the duration of your talk) and talk through all your slides (out loud). This should be a timed dress rehearsal. Don't stop and fix slides as you go and don't let your audience ask questions or suggest fixes until your practice talk is over; you want to force yourself to talk through your entire talk.You should assume that there will be about 5-10 minutes worth of questions during or after your talk. If your talk is too long, you should cut out some material to get it to fit into the time slot (your audience will not mind if your talk ends 5 minutes early, but they will mind if it goes 5 minutes over).
As a practice talk audience member, you should jot down notes of places in the talk where you have suggestions for improvements, or where something seems unclear. After the presenter is done with his/her practice talk, you should talk through the things you wrote down. It is also good to give the presenter some practice answering audience questions.
Nervousness: How to fight back
- A well organized, practiced talk will almost always go well. If you draw a blank, then looking at your slides will help you get back on track.
- Taking a deep breath will clam you down. One trick is to try to remember to take a deep breath between each slide.
- Slow down. Take a few seconds to think about a question that is being asked before you answer it. It is okay to pause for a few seconds between points and between slides; a second or two of silence between points is noticeable only to you, but if you are talking a mile a minute everyone will notice.
- Bring notes. if you are afraid that you will forget a point or will forget your elegant transition between slides 11 and 12, write these down on a piece of paper and bring it with you. However, you don't want to have a verbatim copy of your talk, instead write down key phrases that you want to remember to say.
- Be prepared to answer questions. You don't have to know the answer to every question, however you should be prepared to answer questions about your work. Before you give the talk, think about what questions you are likely to get, and how you would answer them. You may want to have back-up slides ready for answering certain questions.
- It is okay to say "I don't know" or better yet "gee, I hadn't thought about that, but one possible approach would be to..."

10 Things You Should Do To Prepare For a Job Interview

2012-10-28T06:20:00.005-07:00

10 Things You Should Do To Prepare For a Job Interview

1. Create a Resume
When you present a resume to an employer, you’re giving them a snapshot of who you are, your skills, and your capabilities. It tells the employer where you’ve been and gives them a picture of where you’re headed. Having a well-developed resume is one of the most important steps in landing the job that you want. If you’ve never written one before, there are plenty of resources available that are free. Check online sources–there are several resume websites that can start you off in the right direction. You can also check with your college or career center on campus,

2. Dot your “ I’s” and cross your “ T’s”, Fine Tune Your Resume
Once you’ve created your resume, it’s now time to fine tune it. Double, Triple, Quadruple check your resume. Is spelling correct? Is there any formatting issues? Does your resume flow nicely? Is your resume tailored specifically to the company that you’re applying for? Make sure all these things are addressed before you turn in that paper, because once you hand it in you can’t get it back to fix it. Remember, dot your “I’s” and cross your “T’s”! It’s always a good idea to have someone else read your resume at least once before you submit it. Try asking a parent, friend, teacher, or coach!

3. Do Your Homework, Know Where You Are Applying Taking the initiative to know the company/employer will help set yourself apart from the crowd. Try researching the history of the company, how they came to be, what projects they are currently working on, or just familiarize yourself with some of the products and services they offer. Understanding what the company/employer has to offer, their vision and values, can greatly impact your chances of getting hired. Doing your homework will not only show your enthusiasm and desire to work for the company, but it will also prepare you for the interview portion of the hiring process. Make sure you have specific questions to ask in the interview if you can’t find the information you need. If you have a disability, research the company policies, availability of training programs within the company, or supported employment options that may be available. There are quite a few companies that employ and work with people with a variety of strengths and struggles- do your research and find out what would be a good fit for you!

4. Prepare a Cover Letter
A cover letter is your introduction to the employer expressing your desire to apply for a certain position. You should take this opportunity to share a little of your personality and highlight some of the skills you possess that would make you a great candidate for the position that you are applying for. Most of the time employers look at the cover letter before reviewing your resume so share your qualities; they want to know more about you. If you need help, sample cover letters are available in Microsoft Word as templates, or you can ask the career center on campus, a college counselor at high school, or your teacher or parent!

5. Do Practice Interviews
The interview portion of the hiring process can be overwhelming for most people. But the scary interview can be… NOT so scary. So what’s the big secret to acing the interview? PRACTICE! Role playing with a friend or family member will not only calm your nerves, but it also won’t leave you looking stumped when it comes to the big day! Many typical interview questions are available online and having a prepared answer for some questions is a good strategy to feel less nervous in the interview. Remember appropriate interview social skills, as well: good eye-contact, hand-shaking, and turn-taking in conversations are important skills in the interview! Your parent, friend or coach should give you feedback on these important social skills during your role playing activities.

6. Look Professional
Now that you’ve prepped your resume, did your homework, and practiced interview questions; it’s time to look the look. Remember the employer only has limited of time to spend with you before deciding whether or not to hire you. Prepare an outfit that’s appropriate for your interview. You want to look professional and appropriate– which means no cut up shirts and no sandals! You want to give off the best first impression as possible. What to wear may differ depending on where you are applying for a job. It’s probably not necessary to wear a full suit to an interview at a grocery store, for example, but make sure that all of your clothing is clean, not wrinkled, and looks respectful!

7. Be Early!
Who wants to be late to an interview, especially when it’s your dream job? Using tools such as Map Quest or Google Maps and knowing how to get to your interview site will help you manage your time efficiently. You’ll be able to find alternative routes in case of traffic issues or the unforeseen, like closed lanes and road blocks. If you’re taking public transportation, look up route schedules and leave enough time in case the bus or train gets delayed. You don’t want get lost, so know where you’re going. If you have a phone that can access maps online, map out the address beforehand and consult your phone en route. Getting to an interview a few minutes early (10-15) is best! That way your potential future employer will know that you are responsible and trustworthy.

8. Get Enough ZZzzZz’s…
You want to make sure that you’re well rested before the day of your interview. It might be a hectic day, so you’ll need all the energy you can get. Catch up on those Z’s, the more the better. Try to get to bed a little bit earlier than normal, in case you have trouble falling asleep.

9. Eat a Good Breakfast
Rest along with having a good breakfast are ingredients to starting off the day right. Having food in your stomach will give you the fuel your body needs to run efficiently throughout the day. If you take medication, make sure that you take it with enough time for it to become fully active before your interview. You want to be clear-headed and focused!

10. Clear Your Schedule
If you know you’re having an interview, try and schedule your activities around it. You never know how long an interview is going to last. It can be anywhere from 5 minutes to 1 hour. Clear some time so you have a good window of opportunity to get through the interview without having to worry about being late to something else. If you are having someone pick you up or drop you off, make sure they know when the interview starts and that you have their phone number, so that you can let them know when the interview is over. Always remember that it’s a good idea to turn off your phone DURING the interview!

Tips to Help Make Your Job Interview Successful

2012-10-28T06:18:00.001-07:00

How to make your interview successfull.........

1. Research.
Find out a little bit about the company you want to work for. Visit the location in person if it is a store or building open to the general public. Visit the company’s Website and talk to anyone you might know who works there. What kinds of products or services does the company make or sell? What types of people work there? What are the typical hours this position requires? What are some of the day-to-day tasks that the job involves?

Make notes of things you want more information about and ask the employer about them at the end of your interview (it’s always a good idea to have a few questions to ask the employer, anyway!). Researching a company and the position make you stand out in an interview. It shows that you are really interested in working there. For more information on how and why to research a company before you interview,

2. Practice
It sounds funny – and it looks even funnier – but practicing out loud for your interview will help you sound more polished and concise and less nervous in the actual interview. List a few key things you want the employer to know about you, and review common interview questions. Formulate answers to those questions and answer them out loud while looking at yourself in the mirror. This exercise prevents you from rambling in the interview and sounding unpolished and unsure. It also helps you discover what really does make you the best candidate for the job!

3.Dress to Make a Good First Impression.
In an interview, first impressions do matter. The best way to ensure a good first impression is to dress smart. If you are interviewing for a job in an office, it is usually best to wear a dark-colored, conservative suit (for both men and women). If you are interviewing for a job where the dress code is more casual (at a factory or a construction site, for example), nice slacks and a collared button-down shirt with a tie for men and a nice dress or blouse and slacks or skirt for women are usually appropriate. You should avoid wearing excessive jewelry, perfume, and flamboyant clothes. Good personal hygiene is also important.

If you are unsure what to wear, you should always go with the most conservative, professional option. Most experts agree it is better to be overdressed than dressed too casually. What you are wearing tells employers a lot about how serious you are about getting the job. Find out more about how to dress for an interview

4. Be Conscious of Good Interview Etiquette.
This list could go on forever – there is literally an endless array of “dos” and “don’ts” for an interview – and not everyone agrees on every aspect of that list. There are, however, some basic “interview etiquette” tips that are important to remember. (For a more comprehensive list,

Be on time for your interview. This is, perhaps, the most important. Employers expect employees to arrive on time to work. They may see a person who is late to an interview, when he or she is supposed to be showing his or her best side, as someone who will have difficulty arriving on time to work or meeting deadlines if hired.

Be aware of your body language. When shaking hands, make sure your grip is firm and confident. Have good posture, but avoid appearing like you’re as stiff as a cardboard cutout. Even the most experienced professionals get nervous in an interview – it’s normal. However, if you appear too nervous, the interviewer might draw the wrong conclusions about your ability to do the job – especially if it involves interacting with people! Conversely, make sure you don’t slouch – this could give the impression that you are lazy or uninterested in the position. Maintain eye contact with your interviewer to convey confidence. When speaking, be polite and professional and avoid using slang and profanities. The more confident and polished you appear the more likely you are to leave the interviewer with a positive impression of you.

Keep the interview positive. Avoid making negative remarks about any previous jobs or employers. Also, refrain from complaining about any job-related tasks or responsibilities you were given in a previous position. Employers want to hire someone who is positive, enthusiastic, and able to meet and deal with challenges.

5. Be Prepared to Ask the Interviewer Questions.
This is where your research comes in. Employers want to know if you’re truly interested in the position. They also want to know that you have all the information you need to make a decision, if offered the job. It isn’t a good idea to turn the tables and “interview” the interviewer, but it is a good idea to go into the interview with a few questions in mind. This is your chance to ask additional questions about the business, the position, the requirements, and the expectations of the person who will fill the position.

Click on Sample Questions to Ask an Interviewer or Questions to Ask in an Interview for list of sample questions to ask in your interview. Remember to ask questions that are relevant to the company and position for which you are interviewing.

6. Follow up with a Thank-You Note.
Make sure you let the interviewer know how pleased you were to have the chance to interview with him or her. Immediately after the interview, send the interviewer a thank-you note, thanking him or her for taking time to interview you. This is not only proper etiquette and a common display of appreciation, but it also allows you to reaffirm one or two key points of the interview. It also lets the interviewer know how interested you are in working for the company. Being polite and professional always makes a good impression.

All of this advice comes down to three important things to remember when you're interviewing: being prepared, professional, and polite is the best way to make the right impression!

Things To Remember Before An Interview

2012-10-27T10:14:00.003-07:00

Six Things To Remember Before An Interview

The economy is in a rough place right now, despite what the media says about no longer being in a recession. None of us can afford to bomb an interview, so I thought I would share some tips and things to think about when going for a big interview.

1. Be confident, not cocky.

Your attitude can make a big difference when going for an interview. In this case, you will want to ride the fence a little. You do not want to be overconfident or act as though the position is beneath you or that you are settling for the job. At the same time, you don’t want to act like the job is a tremendous step up for you, or give the impression that you aren’t completely qualified for the job. Have your game face on, and look sharp
.

2. Be prepared!

When you go into an interview, you already know that you are going to be bombarded with questions. It is hard enough to get through this portion and hope that you’re making the right impression. It is a good idea to know what you are going to say before you say it. Review common interview questions a day or two before your interview to get an idea of what you will say regarding each question. Also, be ready for tough questions regarding your past experiences, such as when you were angry, when you had to handle a tough situation, etc. Most employers want to sneak a peak at the way you have handled things in the past. Caution: This is not the time to tell them a crazy story of revenge on another coworker, or a prank you pulled, or how little your boss did. It doesn’t matter how comfortable you are during the interview, they are always, and I mean always testing you.

Another crucial part comes when the interviewer asks you if you have any questions. This is never a time to say “Nope” or to appear to be stumped. You need to be engaged and ask engaging questions. Never walk into an interview without knowing things about the company, so that you can ask intelligent questions. Interviewers want to know that you have a brain to form your own concepts and ideas, especially if you’re a graphic designer, photographer, creative director, web designer, animator, illustrator, marketing coordinator, etc. You should be asking questions that do not have yes or no answers. This second portion of the interview should be more like a conversation than a yes/no session. Research the company, know what they are about, and don’t ask questions that can be found on their web site. They will know that you haven’t done your homework, and interviewers (like most people) will be irritated after answering the same questions 75-100 times. Don’t ask about salary or benefits unless they happen to bring it up. If you are invited back for a second interview, this is usually when they open up to those type of questions.

3. Stay relevant to the position

When an interviewer asks you questions regarding your skills, your personality, your strengths, weaknesses, etc., stay relevant to the position that you are applying for. Being too general shows that you haven’t thought much about the position and you are just looking for a job. Use examples of your past experience and abilities that would make you a great candidate for the position you are applying for. Don’t be too obvious, but helping to make yourself fit their mold for a model employee will really go along way.

4. Body language

it is important to take note of your appearance as well. Dress well- suit and tie, jacket and skirt, pant suit, etc. Stand up straight and smile. Shake hands firmly and address everyone in the room. These are pretty straight forward, and I am sure that you have heard them time and time again. The next couple of things you may not have heard. Sitting with your arms folded give the message that you have something to hide, or that you are unsure or uncomfortable with yourself. Sit with your hands in your lap with an open posture. Do not rest your head on your hands or lean on anything, as this can be seen as informal or too casual. Crossing a leg is fine ( I have back problems, and during long interviews this can relieve a lot of pressure and pain), Leaning forward or slouching in your seat is also seen as informal, and can also be seen as not taking the interview seriously. Also, don’t fidget or fiddle with anything. Do not twiddle your thumbs. It is important to appear focussed, and the interviewer should feel like they have your undivided attention.

5. Send a thank you letter after the interview is over, thanking them for their time, and showing them your appreciation. This is crucial, as I know many employers that have gone with another candidate due to this issue. It is seen as inconsiderate and unprofessional.

6. Follow up a few days later with a phone call regarding the position. If they are still debating on which employee to choose, this is a gesture that shows your interest in the position and shows your determination.

Performance-aware Security of UnicastCommunication in Hybrid Satellite Networks-paper presentation

2012-10-23T12:52:00.002-07:00

Performance-aware Security of Unicast Communication in Hybrid Satellite Networks

Ayan Roy-Chowdhury Electrical and Computer Engineering Institute for Systems Research University of Maryland College Park, MD 20742 Email: ayan@umd.edu

John S. Baras Electrical and Computer Engineering Institute for Systems Research University of Maryland College Park, MD 20742 Email: baras@isr.umd.edu

Abstract—In this work, we address the performance problems that arise when unicast security protocols IPSEC andSSL are applied for securing the end-to-end communication inhybrid satellite networks. Satellite networks use TCP and HTTPperformance-enhancing proxy servers to overcome the adverse effect of the large delay-bandwidth product of the satellite channel. However, the proxy servers cannot function when IPSECand SSL are used for secure unicast communication in hybridsatellite networks. We therefore propose the use of the LayeredIPSEC (LES) protocol as an alternative to IPSEC for networklayer security. We describe a modiﬁcation to the Internet Key Exchange protocol if dynamic key establishment is needed for Layered IPSEC. For application-level security of web browsing with acceptable end-to-end delay, we propose the Dual-modeSSL protocol (DSSL) to be used instead of SSL. We describe

how LES and DSSL protocols achieve the desired end-to-end communication security while allowing the TCP and HTTP proxy servers to function correctly. Through simulation studies, we

quantify the improvement in performance that is achieved using our proposed protocols, compared to traditional IPSEC and SSL.

I. INTRODUCTION

Satellite links suffer from longer propagation delays compared to terrestrial links. The delay can be as high as 500ms round-trip for a geostationary satellite link. Most Internet trafﬁc uses the Transmission Control Protocol (TCP), which is highly susceptible to the delay-bandwidth product and exhibits very poor performance in satellite channels.To mitigate the negative effects of the satellite propagation delay on Internet trafﬁc, commercial satellite networks usually implement a split-connection TCP Performance Enhancing Proxy (PEP) [1]. A PEP agent is installed at the satellite gateway between the satellite network and the Internet. The PEP agent inspects every TCP packet that ﬂows through the network and sends back premature acknowledgments to the TCP senders. Studies have shown that this technique leads to

signiﬁcant performance improvement in satellite networks [2]. Commercial satellite networks also employ HTTP proxy servers, at the central hub and each client location, to improve the speed of response to web browsing requests for Internet trafﬁc. When the remote client makes a request for a webpage, the web server responds with the requested base HTML page.The hub HTTP proxy server intercepts and reads the web page and sends multiple GET requests to the destination web server to retrieve all the embedded objects in the base page.This exchange occurs over a high-speed terrestrial connection

between the hub and the Internet, thereby saving the time each request would have needed for a round trip over the satellite link. As the objects are retrieved by the hub, they are immediately forwarded to the client proxy. The client browser GET requests are terminated at the local proxy server, which forwards the pre-fetched documents to the client browser immediately. The net result is that only a single GET request

from the user browser traverses the satellite link, while a set of rapid responses quickly deliver the requested webpage and associated elements to the browser.

A. Proxy Performance Problem with Unicast CommunicationSecurity

Two protocols that are widely used for secure unicast communication are the Internet Security Protocol (IPSEC) [3]and the Secure Socket Layer (SSL) protocol [4]. IPSEC creates an end-to-end secure channel at the network layer for the secure transfer of trafﬁc between two end users.The problem with using IPSEC in satellite networks is that it disables the functionality of the PEPs. The IP packet payload,which includes the TCP header, is encrypted with keys known only to the end points. Therefore a TCP PEP, which is an

intermediate node in the communication path, cannot read or modify the TCP header, since the PEP does not know the keys. Consequently the PEP cannot function, leading to a degradation in the performance of the TCP protocol. The Secure Socket Layer (SSL), on the other hand, operates above the transport layer in the protocol stack and establishes a secure HTTP (HTTPS) session on a need basis. SSL encrypts

the TCP payload (the application layer HTTP data) betweenthe client and the server, but the TCP header is transmitted in the clear. Therefore the TCP PEPs can function correctly with SSL. Howwever, the HTML webpage encrypted into SSL records are readable only by the client and the server who have

the decryption keys. The keys are not available to the HTTP proxy, and therefore the HTTP proxy cannot read the HTML webpage. Consequently, HTML object pre-fetching by the hub proxy server cannot take place. The net result is that a web

Fig. 1. Packet format for IPSEC and Layered IPSEC. Key K1 is shared between end-points only. Key K2 is shared between end-points and TCP PEPs.

page with n−1 embedded objects takes n∗RT T to get loaded,an increase in delay by a factor of n.Our objective is to propose solutions that allow IPSEC and SSL to work in conjunction with TCP and HTTP proxy servers in hybrid satellite networks, so that the unicast communication is secured without sacriﬁcing the performance optimization algorithms. For this, we look at prospective candidate protocols and evaluate their performance through simulations.The rest of this paper is organized as follows. In section II, we describe the Layered IPSEC protocol that we propose to use as an alternative to IPSEC. We also propose modiﬁcations
to the Internet Key Exchange protocol that is used by IPSEC for dynamic session establishment. Section III describes the Dual-Mode SSL protocol, which we propose as an alternative to SSL. Performance analysis of the proposed protocols are given in sections IV and V. Section V also describes optimized versions of the Dual-mode SSL. We brieﬂy review related work in section VI and conclude this paper in section VII.

II. LAYERED IPSEC FOR CO-EXISTENCE WITH TCP PEPS
For network layer encryption and integrity protection, we consider the Layered IPSEC Security protocol (LES), which is based on the concept of breaking the IPSEC encryption in multiple encryption regions or zones on a single packet basis. The method has been proposed independently in [5], [6]. Although the ﬁner details in the two approaches are different, the basic idea is the same. Known as multilayer IPSEC or
ML-IPSEC [5], and Layered IPSEC (LES) [6], the idea is to encrypt different regions of the IP packet using different keys (ﬁg. 1b). The TCP payload is encrypted with key K1 which is shared only between the endpoints. The original IP header and the TCP header are encrypted with key K2 which is shared by the endpoints with intermediate authorized nodes like the TCP PEP. Therefore a TCP PEP can decrypt the header portion of the ESP packet with K2 and read the TCP header to do its performance optimizations. But the PEP cannot read the TCP payload and therefore cannot access the actual data since it
does not posses the key K1. In [6], the authors have demonstrated the correctness of operation of LES and have shown that its performance is comparable to IPSEC for the speciﬁc cryptographic algorithms
used. [5] shows that the throughput overhead of ML-IPSEC in a simple test-bed is 2%-7% compared to IPSEC.We believe that the LES approach would be an effective security solution in hybrid satellite networks that would allow TCP PEPs to function effectively. However, LES introduces
higher complexity and higher communication overhead compared to IPSEC in the establishment of the secure channel thatnow requires co-ordination not only between the end points,but also with the proxy servers. We therefore investigate the performance of end-to-end trafﬁc when LES is implemented in conjunction with TCP PEP optimizations in a hybrid satellite network, and compare to the case where IPSEC is implemented (and therefore the TCP PEPs cannot function).
A. Modiﬁcation to Internet Key Exchange Protocol (IKE) for Layered IPSec
Both [5] and [6] assume pre-shared keys between the end points and the TCP PEP to establish the secure channel. However, in situations when the IPSEC encryption keys are dynamically determined at the time of establishing the secure channel, the Internet Key Exchange (IKE) [7] is used to generate the keys. IKE performs a series of handshakes between the end points to establish the two keys used by IPSEC for
encryption/decryption and two keys for authentication (the usage of the keys in IPSEC is uni-directional).
IKE operates in two phases - phase 1 and phase 2. The phase 1 exchange happens once and it creates a security association that allows multiple phase 2 connections to be set up between the client and the server. The phase 1 exchange can happen in either the main mode, in which there are 3 pairs of message exchanges between the end points, or in the aggressive mode, in which all the exchanges are condensed
into a total of 3 messages. In IKE phase 2 quick mode, there is a total of 3 exchanges between the initiator and the responder peers, during which the two parties verify the keying material that each will
use for the session. The phase 2 exchange uses the session keys established in phase 1 to do mutual authentication and establish a phase 2 session key. Based on the phase 2 session key, the two end points agree on a set of four keys used by IPSEC.

We propose to modify the IKE protocol to incorporate the generation of additional keys needed for LES. In the modiﬁed protocol, in IKE phase 1 the initiator entity (which would be the remote client node in our scenario) includes the certiﬁcates of the remote and hub proxy nodes in the protection mechanism negotiation stage with the responder entity (the server node in our scenario). The keying data that is exchanged between the end points in the modiﬁed IKE phase 1 is subsequently used in IKE phase 2, so that the client and
the server agree on a set of six keys - the four keys for forward and reverse encryption and authentication between the client and server, and two additional keys to be used by the sender to perform layered encryption on the IP header and also layered authentication. We add a fourth message dissemination to IKE
phase 2, in which the client distributes the two additional keys to the local and remote proxy servers. The client encrypts the IP header encryption keys using the public keys of the proxy servers (we assume that the public keys and certiﬁcates of the proxy servers are available to the client), authenticates the message using a digital signature, and sends the authenticated message to the proxy servers. Figure 2 illustrates the step that we add to IKE phase 2 for key management for LES. Additionally, we propose to use only the aggressive mode of IKE phase 1 exchange, and the quick mode of IKE phase 2 exchange. This is to contain the negative effect of the long round-trip delay on the overall performance - we have to ensure that the delay incurred due to the IKE message exchanges do not neutralize the advantages that might be gained due to the use of LES. The IKE phase 1 aggressive mode will reduce the delay by 50%, compared to the IKE
phase 1 main mode. Whether that is sufﬁcient savings, we evaluate through simulations in section IV.
III. DUAL-MODE SSL: HTTP PROXY-FRIENDLY SECURE WEB BROWSING
When the HTTP trafﬁc is secured using SSL and the security policy does not allow for trusted third parties, we propose the use of a modiﬁed SSL protocol, the Dual-Mode SSL (DSSL) protocol. As shown in ﬁg. 3, the secure connection in DSSL has two modes - an end-to-end main mode connection between the client and the web server, and a secondary mode connection that has the hub HTTP proxy as an intermediate
node. The security parameters for both modes are negotiated between the client and the server. Since DSSL extends the SSL protocol to include support for HTTP proxy servers, the message structures and many of the protocol steps are similar. DSSL introduces a series of additional message exchanges
between the client and the HTTP proxy server, and between the proxy server and the web server. The various stages of the DSSL protocol are described below.
Stage 1: Client-proxy handshake phase 1. When a remote client wants to establish a secure session for the very ﬁrst time, it might not be aware of the security parameters of the HTTP proxy. It therefore establishes a connection to the HTTP proxy and initiates the ﬁrst stage of the DSSL protocol, the client-proxy handshake phase 1. In this phase the client sends its security certiﬁcate to the HTTP proxy, which in turn responds with its own security certiﬁcate. The client thus obtains the public key of the HTTP proxy server from the proxy’s certiﬁcate. The start and end of the communication in each phase is marked by a “Hello” and a “Done” message
respectively, for each of the participating entities. This is in accordance with the original SSL protocol.
Stage 2: Client-server handshake. Once the client has obtained the security certiﬁcate of the HTTP proxy, it contacts the web server to exchange security credentials and to establish the session keys for the secure web session. This stage is similar to the SSL protocol, with two exceptions - (i) the client sends both its own certiﬁcate and the HTTP proxy certiﬁcate to the web server, and (ii) in the key exchange step, the client
generates both primary and secondary keys and sends them to the web server.
Stage 3: Client-proxy handshake phase 2. After the client and the web server have established the session keys in the second stage, the client again contacts the HTTP proxy and instructs it to obtain the session keys from the web server.
Stage 4: Proxy-web server handshake. The HTTP proxycontacts the web server and sends its certiﬁcate to authenticate itself. Upon correct authentication, the web server sends the secondary session key to the HTTP proxy.
Stage 5: Client-proxy handshake phase 3. This ﬁnal stage of the key establishment protocol is essentially a continuation of the client-proxy handshake phase 2. After the proxy obtains the secondary key from the web server, it contacts the client to conﬁrm that it has received the key. The establishment of the primary and secondary keys between the client, the web server and the proxy is now complete. All the messag exchanges in DSSL are authenticated using digital certiﬁcates.Let K1 be the encryption key for the main mode, and
K2 be the encryption key for the secondary mode. When the client makes an HTTPS request, the client proxy sends local replies to the client browser. The web server, on receiving the request, parses the requested HTML page to obtain the embedded object links, which are collated into a new HTML page. The object links HTML page is then encrypted by DSSL using K2 to create the proxy SSL record. DSSL encrypts

the base HTML page using K1 to create the primary SSLrecord. The two records are appended together and sent to the client in an IP packet (ﬁg. 3). The hub proxy intercepts the IP packet, extracts the object links from the proxy SSL record using K2, and pre-fetches the embedded objects. The web server always encrypts the actual objects using K1, so that the hub proxy cannot read the base HTML page data. The hub proxy transfers the embedded objects to the client together at one time. Thus the HTTP proxy functionality is preserved in DSSL while maintaining end-to-end security of the HTML page contents.

IV. PERFORMANCE EVALUATION OF LAYERED IPSEC WITH IKE MODIFICATIONS FOR HYBRID SATELLITE NETWORKS
We have analyzed the performance of Layered IPSec with IKE modiﬁcations through simulations in Opnet Modeler [8]. The simulation setup consists of a remote client connected to a server via a satellite link. All communication between the client and the server pass through the remote and satellite hub TCP PEPs. The satellite link delay is 130 milli-seconds, uplink bandwidth is 256 kbps and the downlink bandwidth is 70 Mbps. Figure 4 shows that the application response time for LES is signiﬁcantly better than that of IPSEC, both when IKE and
pre-shared keys are used
This is because when IPSEC is
used, the TCP optimizations are not working and therefore TCP considers the channel error to be signs of congestion and thus goes into recovery mode quicker. The graphs also indicate that using IKE adds signiﬁcantly higher delay compared to using pre-shared keys. This is due to the multiple message In all the graphs, X-axis is the simulation time in minutes; Y-axis is the application response time in seconds.exchanges between the client, the server and the PEPs that areneeded by IKE to establish the secure channel. Each messageexchange goes over the satellite links and adds to the overalldelay. In fact, the delay for LES with pre-shared keys is nearlyas low as that of unsecured data transmission with fullTCP
optimization, which has the lowest delay. The slightly higher delay for the former is primarily due to the IPSEC processing overhead at the nodes, and the slight transmission overhead due to the larger packet sizes due to LES headers and trailers. The effect of TCP optimizations is so pronounced that the lack of optimizations can have a greater effect on the overall delay than the IKE overhead. This is illustrated by the delay graph of IPSEC with pre-shared keys, which starts out much lower compared to LES with IKE (as can be expected), but it climbs higher when the un-optimized TCP in the former case runs into channel errors.
Figure 5 shows that the average TCP load due to LES with IKE is much higher than the other cases. At simulation time 1 hour 40 minutes, the LES TCP load is 89.938562bps, which is 42% higher than the TCP load for unsecured transmission (63.333333bps), and 37.7% higher that IPSEC with IKE
(65.318627bps). However, this high overhead is mostly due to IKE. In the case of LES with pre-shared keys, the TCP load is 66.686275bps at simulation time 1 hour 40 minutes. This is only 1.1% higher than IPSEC with pre-shared keys (65.941176bps), and 5.3% higher than unsecured transmission.
The results indicate that Layered IPSEC can be a viable alternative to IPSEC for satellite networks, with comparable byte overhead while providing signiﬁcant improvement in application performance. However, this holds true only if the secure channel is established apriori. While using IKE will still result in improved application response times for high channel error conditions, it might introduce unacceptably high
overhead even with the proposed modiﬁcations.

V. PERFORMANCE EVALUATION OF DUAL-MODE SS We have analyzed the performance of the DSSL protocoland associated web browsing by Opnet simulations. The setupis similar to that described in section IV, with the difference being that HTTP proxy servers are used in place of the TCP PEP servers. We conducted simulations for different scenarios - (i) unsecured web browsing with functional HTTP proxy, (ii) SSL security and hence non-operational HTTP proxy and (iii) DSSL security with HTTP proxy functional.Figure 6 compares the response times for completing the DSSL handshake against the SSL handshake. The graph highlights the delay overhead of DSSL due to the additional steps of the client communicating with the proxy server in DSSL stages 1, 3 and 5, and the proxy server contacting the web server in stage 4. The DSSL overhead ranges between 20.3% and 20.74% over the SSL handshake delay. To reduce the high delay involved in DSSL handshake, we propose a condensed version of DSSL, in which the handshake

consists of only the ﬁrst two stages. In the ﬁrst stage, the client contacts the HTTP proxy and exchanges each other’s digital certiﬁcate. Subsequently, the client contacts the web server. Once the client and the web server have established the security parameters in stage 2 of DSSL, the client makes the ﬁrst HTTP “Get” request. This request goes through the HTTP proxy and triggers the proxy to send its certiﬁcate to the web

server, and a request for the DSSL session secondary keys. The HTTP proxy request is piggy-backed on the client HTTP “Get” request. The server responds to the client request with the base webpage in a HTTP “Post” response. In addition,the server responds to the proxy key request with its own certiﬁcate and the DSSL secondary session keys, encrypted with the proxy’s public key. This response to the proxy is

piggy-backed on the HTTP response to the client. The proxy receives the combined response from the web server and is thus able to retrieve the secondary session keys from the encrypted message, using its private key. Consequently, it is able to decrypt the relevant portions of the HTTP “Post” response and therefore can perform the HTTP acceleration. We refer to this variant of DSSL as DSSL two-phase. The ﬁrst stage in DSSL two-phase is necessary in the situation that the client and the HTTP proxy server do not

share any security association beforehand. However, if the two entities are apriori aware of each other’s security information (via their digital certiﬁcates), then this phase is not needed. Every time the client contacts a web server to initiate a secure web session, it passes to the web server a locally cached copy of the HTTP proxy’s certiﬁcate. The DSSL protocol can thus be further reduced to just one stage, that of stage 2. The DSSL secondary session key is transmitted to the HTTP proxy piggybacked on the ﬁrst response from the server, as described in the DSSL two-phase. We refer to this optimization of the DSSLprotocol as DSSL quick mode.

Figure 7 compares the response times of DSSL handshake

for its various versions. At simulation time 1hour and 20 minutes, DSSL quick mode handshake time is 33% less thanDSSL two-phase (11.5 seconds and 17.2 seconds, respectively). The quick mode time is nearly half (48.8% less) than the handshake time for full version of DSSL (22.465 seconds),

and is 38.8% less than that of SSL (18.61 seconds). The optimizations in DSSL two-phase or DSSL quick

mode are proposed to overcome the detrimental effect of the long propagation delay of the satellite channel on the DSSL handshake protocol. This optimization however requires further changes to the HTTP protocol, to allow piggy-backing the DSSL secondary keys on the initial HTTP exchanges between the client, the web server and the proxy server. Figure 8 compares the application response times for multiple secure browsing sessions with multiple servers. The times for all cases of DSSL are much lower than that for SSL, and

are comparable to unsecured web browsing. The additional delay is primarily due to the security overhead at the different nodes to maintain the secure session and to encrypt/decrypt the trafﬁc.

VI. RELATED WORK

Olechna et al [9] have suggested two solutions to the IPSEC problem. The ﬁrst approach is to move the TCP PEP gateways to the endpoints. The TCP optimizations are done on the trafﬁc in the clear, and then the trafﬁc is encrypted using IPSEC. This approach improves the performance, but when a packet is lost or received in error, TCP goes into congestion avoidance phase and the transmission is reduced

in half. The second approach is to split the secure connection into two at the satellite gateway. This allows the gateway to decrypt the IPSEC packet and read the headers and thereby do performance optimizations. However, this requires trust in the satellite gateway and might be unacceptable to users who require strong end-to-end security. Several modiﬁed TCP protocols have been proposed that perform better compared to the original speciﬁcation in the event of channel errors or delay, or when IPSEC is used. A discussion of these TCP enhancements can be found in [10].The problem of HTTP proxy performance with SSL has been addressed by the industry by breaking up the end-to-end single SSL connection between client and server into multiple SSL connections [11]. In this solution, the client browser creates a secure HTTP connection with the Remote Page Accelerator (RPA) at the client satellite terminal, a second connection is created between the RPA and the Hub Page Accelerator (HPA), and a third connection is between the HPA and the server. The RPA performs all necessary handshaking with the client browser. The HPA can decrypt the SSL trafﬁc from the server and perform the desired object pre-fetching. The major drawback of this scheme is that it requires a high level of trust in the intermediate nodes, which might be unacceptable when absolute end-to-end security is desired. The DSSL concept is partly similar to the multiple-channel

SSL concept proposed in [12]. However, there the authors do not differentiate encryption in primary and secondary SSL records - they suggest that HTTP trafﬁc with lower security requirements be encrypted entirely with keys known to intermediate nodes. For our security requirements, that approach would be unacceptable.

VII. CONCLUSION

In this work, we have investigated the adverse effects of IPSEC and SSL on unicast communication in satellite networks. As a solution to the problem, we have proposed the use of layered IPSEC with modiﬁed IKE for securing unicast communication while allowing performance optimization algorithms to function simultaneously. We have also proposed the DSSL protocol with three variations, to replace SSL for

secure HTTP in hybrid satellite networks. Through simulations we have shown that the performance of the proposed protocols compare favorably to standard IPSEC and SSL in hybrid networks.

ACKNOWLEDGMENT

The material is based upon work supported by the National Aeronautics and Space Administration under award No. NCC8235. Any opinions, ﬁndings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reﬂect the views of the National Aeronautics and Space Administration.

REFERENCES

[1] J. Border, M. Kojo, J. Griner, G. Montenegro, and Z. Shelby, Performance enhancing proxies intended to mitigate link-related degradations,

IETF RFC3135, June 2001.

[2] N. Ehsan, M. Liu, and R. Ragland, “Evaluation of performance enhancing proxies in internet over satellite,” Wiley Int. J. Communication Syst.,

vol. 16, pp. 513–534, August 2003.

[3] R. Atkinson and S. Kent, Security Architecture for the Internet Protocol,

IETF RFC 2401, November 1998.

[4] The SSL Protocol Version 3.0, IETF Transport Layer Security Working

Group, http://wp.netscape.com/eng/ssl3/draft302.txt, November 1996.

[5] Y. Zhang, “A multilayer IP security protocol for TCP performance

enhancement in wireless networks,” IEEE Journal on Selected Areas

in Communications, vol. 22, no. 4, pp. 767–776, May 2004.

[6] M. Karir and J. Baras, “LES: Layered encryption security,” in Proceedings of the Third International Conference on Networking (ICN’04),

Guadeloupe, French Caribbean, March 2004.

[7] D. Harkins and D. Carrel, The Internet Key Exchange (IKE), IETF RFC

2409, November 1998.

[8] “Opnet Modeler,” http://www.opnet.com/products/modeler/home.html.

[9] E. Olechna, P. Feighery, and S. Hryckiewicz, “Virtual private network

issues using satellite based networks,” in Military Communications

Conference (MILCOM) 2001, vol. 2, 2001, pp. 785–789.

[10] P. Chitre, M. Karir, and M. Hadjitheodosiou, “TCP in the IPSEC

environment,” in 22nd AIAA International Communications Satellite

Systems Conference and Exhibit (ICSSC) 2004. Monterey, California:

AIAA, May 2004.

[11] SSL Accelerator, Spacenet Inc., http://www.spacenet.com/technology/

advantages/ssl.html.

[12] Y. Song, V. Leung, and K. Beznosov, “Supporting end-to-end security

across proxies with multiple-channel SSL,” in Proceedings of the 19th

IFIP Information Security Conference (SEC 2004). Toulouse, France:

IFIP, August 23-26 2004, pp. 323–337.

WIRELESS SENSOR NETWORK SECURITY ANALYSIS-paper presenattion

2012-10-23T10:16:00.001-07:00

International Journal of Next-Generation Networks (IJNGN),Vol.1, No.1, December 2009

WIRELESS SENSOR NETWORK SECURITY ANALYSIS

Hemanta Kumar Kalita and Avijit Kar
Department of Computer Engineering, Jadavpur University, Kolkata, India
hemanta91@yahoo.co.in
Department of Computer Engineering, Jadavpur University, Kolkata, India
avijit.kar@gmail.com

ABSTRACT
The emergence of sensor networks as one of the dominant technology trends in the coming decades has posed numerous unique challenges to researchers. These networks are likely to be composed of hundreds,and potentially thousands of tiny sensor nodes, functioning autonomously, and in many cases, without access to renewable energy resources. Cost constraints and the need for ubiquitous, invisible deployments will result in small sized, resource-constrained sensor nodes. While the set of challenges in sensor networks are diverse, we focus on security of Wireless Sensor Network in this paper. We proposesome of the security goal for Wireless Sensor Network. Further, security being vital to the acceptance and use of sensor networks for many applications; we have made an in depth threat analysis of Wireless Sensor Network. We also propose some countermeasures against these threats in Wireless Sensor Network.

KEYWORDS
Wireless Sensor Network (WSN), Security

1. INTRODUCTION
We use the term sensor network to refer to a heterogeneous system combining tiny sensors and
actuators with general purpose computing elements. The Application domains of Wireless
Sensor Network are diverse due to the availability of micro-sensors and low-power wireless
communications. Unlike the traditional sensors, in the remote sensor network, a vast numbers of
sensors are densely deployed. These sensor nodes will perform significant signal processing,
computation, and network self-configuration to achieve scalable, robust and long-lived
networks[5]. More specifically, sensor nodes will do local processing to reduce
communications, and consequently, energy costs. We believe that most efficient and adaptive
routing model for WSN is cluster based hierarchical model. For a cluster based sensor network,
the cluster formation plays a key factor to the cost reduction, where cost refers to the expense of
setup and maintenance of the sensor networks.
In this paper, we will take a more in-depth look at security in WSN and discuss counter
measures.
2.WSN ARCHITECTURE
In a typical WSN we see following network components –
• Sensor motes (Field devices) – Field devices are mounted in the process and must be
capable of routing packets on behalf of other devices. In most cases they characterize or
control the process or process equipment. A router is a special type of field device that
does not have process sensor or control equipment and as such does not interface with
the process itself.
• Gateway or Access points – A Gateway enables communication between Host
application and field devices.
• Network manager – A Network Manager is responsible for configuration of the
network, scheduling communication between devices (i.e., configuring super frames),
management of the routing tables and monitoring and reporting the health of the
network.
• Security manager – The Security Manager is responsible for the generation, storage, and management of keys

3.WSN SECURITY ANALYSIS

Simplicity in Wireless Sensor Network with resource constrained nodes makes them extremely

vulnerable to variety of attacks. Attackers can eavesdrop on our radio transmissions, inject bits

in the channel, replay previously heard packets and many more. Securing the Wireless Sensor

Network needs to make the network support all security properties: confidentiality, integrity,

authenticity and availability. Attackers may deploy a few malicious nodes with similar hardware

capabilities as the legitimate nodes that might collude to attack the system cooperatively. The

attacker may come upon these malicious nodes by purchasing them separately, or by "turning" a

few legitimate nodes by capturing them and physically overwriting their memory. Also, in

some cases colluding nodes might have high-quality communications links available for

coordinating their attack. Sensor nodes may not be tamper resistant and if an adversary

compromises a node, she can extract all key material, data, and code stored on that node. While

tamper resistance might be a viable defense for physical node compromise for some networks,

we do not see it as a general purpose solution. Extremely effective tamper resistance tends to

add significant per-unit cost, and sensor nodes are intended to be very inexpensive [1] [2] [3]

[4].

We identify and categorize attacks in Wireless Sensor Network as follows:

3.1. Denial of Service

Denial of Service (DoS) is any event that diminishes or eliminates a network's capacity to

perform its expected function [16].

Attack 3.1 DoS/Physical Layer/Jamming. Jamming. To jam a node or set of nodes, in this case,

this is simply the transmission of a radio signal that interferes with the radio frequencies being

used by the sensor network. Jamming the channel with an interrupting signal.

Attack 3.2 DoS/Physical Layer/Tampering. Physical Tampering. Nodes are vulnerable to

physical harm, or tampering (i.e. reverse engineering).

Attack 3.3 DoS/Data Link Layer/Collision.

Attack 3.4 DoS/Data Link Layer/Exhaustion.

Attack 3.5 DoS/Data Link Layer/Unfairness.

Attack 3.6 DoS/Network Layer/Neglect and Greed.

Attack 3.7 DoS/Network Layer/Homing.

Attack 3.8 DoS/Network Layer/Spoofing. Misdirection. In this type of attack adversaries may

be able to create routing loops, attract or repel network traffic, extend or shorten source routes,

generate false error messages, partition the network, increase end-to-end latency, etc.

Attack 3.9 DoS/Network Layer/Black Holes.

Attack 3.10 DoS/Network Layer/Flooding.

Attack 3.11 DoS/Transport Layer/Flooding.

Attack 3.12 DoS/Transport Layer/De-synchronization.

3.2. Interrogation

Attack 3.13 Interrogation/Data Link Layer.

3.3. Sybil

Sybil attack is defined as a "malicious device illegitimately taking on multiple identities". Using

the Sybil attack [7], an adversary can "be in more than one place at once" as a single node

presents multiple identities to other nodes in the network which can significantly reduce the

effectiveness of fault tolerant schemes such as distributed storage [8], dispersity [9] and

multipath. It may be extremely difficult for an adversary to launch such an attack in a network

where every pair of neighboring nodes uses a unique key to initialize frequency hopping or

spread spectrum communication. Sybil attacks also pose a significant threat to geographic

routing protocols.

Attack 3.14 Sybil/Physical Layer.

Attack 3.15 Sybil/Data Link Layer/Data Aggregation.

Attack 3.16 Sybil/Data Link Layer/Voting. Stuffing the ballot box of a voting scheme, for

example.

Attack 3.17 Sybil/Network Layer.

3.4. Wormhole International Journal of Next-Generation Networks (IJNGN),Vol.1, No.1, December 2009

In the wormhole attack [10], an adversary tunnels messages received in one part of the network

over a low latency link and replays them in a different part. An adversary situated close to a

base station may be able to completely disrupt routing by creating a well-placed wormhole. An

adversary could convince nodes who would normally be multiple hops from a base station that

they are only one or two hops away via the wormhole. This can create a sinkhole: since the

adversary on the other side of the wormhole can artificially provide a high-quality route to the

base station, potentially all traffic in the surrounding area will be drawn through her if alternate

routes are significantly less attractive.

Attack 3.18 Wormhole/Network Layer. A routing attack where an adversary convinces a

network node of a shorter, or zero, path to the base station, for example, and can disrupt the

network in this manner.

3.5. Sinkhole (Black hole)

Sinkhole attacks typically work by making a compromised node look especially attractive to

surrounding nodes with respect to the routing algorithm and lure nearly all the traffic from a

particular area through a compromised node, creating a metaphorical sinkhole with the

adversary at the center. Because nodes on, or near, the path that packets follow have many

opportunities to tamper with application data, sinkhole attacks can enable many other attacks

(selective forwarding, for example).

Attack 3.19 Sinkhole/Network Layer.

3.6. Manipulating Routing Information

Attack 3.20 Manipulating Routing Information/Network Layer.

3.7. Selective Forwarding

In a selective forwarding attack, malicious nodes behaves like black hole and may refuse to

forward certain messages and simply drop them, ensuring that they are not propagated any

further. However, such an attacker runs the risks that neighboring nodes will conclude that she

has failed and decide to seek another route. A more subtle form of this attack is when an

adversary selectively forwards packets. An adversary interested in suppressing or modifying

packets originating from a select few nodes can reliably forward the remaining traffic and limit

suspicion of her wrongdoing.

Attack 3.21 Selective Forwarding/Network Layer.

3.8. Hello Flood

Many protocols require nodes to broadcast HELLO packets to announce themselves to their

neighbors, and a node receiving such a packet may assume that it is within (normal) radio range

of the sender. This assumption may be false: a laptop-class attacker broadcasting routing or

other information with large enough transmission power could convince every node in the

network that the adversary is its neighbor and begin exchanging information with the nodes.

Attack 3.22 Hello Flood/Network Layer.

3.9. Acknowledgement Spoofing

Several sensor network routing algorithms rely on implicit or explicit link layer

acknowledgements. Due to the inherent broadcast medium, an adversary can spoof link layer

acknowledgments for "overheard" packets addressed to neighboring nodes. Goals include

convincing the sender that a weak link is strong or that a dead or disabled node is alive.

Attack 3.23 Acknowledgement spoofing.

3.10. Cloning

Attack 3.24 Cloning/Application Layer.

3.11. Impersonation

Attack 3.25 Node Replication. Also called Multiple Identity, Impersonation. An attacker seeks

to add a node to an existing sensor network by copying (replicating) the node ID of an existing

sensor node. Node replication attacks can occur if an adversary can copy the node identification

of a network node. In this manner packets could be corrupted, misrouted or deleted, and if this

adversary could perform this replication it is possible that cryptographic keys could be

disclosed.

3.12. Eavesdropping

Attack 3.26 Monitor and eavesdropping. Also called confidentiality. By listening to the data,

the adversary could easily discover the communication contents. Network traffic is also

susceptible to monitoring and eavesdropping. This should be no cause for concern given a

robust security protocol, but monitoring could lead to attacks similar to those previously

described. It could also lead to wormhole or black hole attacks.

3.13. Traffic Analysis

Attack 3.27 Traffic Analyses. Traffic analysis attacks are forged where the base station is

determinable by observation that the majority of packets are being routed to one particular node.

If an adversary can compromise the base station then it can render the network useless.

3.14. Mote Class

Also called Insider Attacks. The attackers have an authorized participant in the sensor network.

Insider attacks may be mounted from either compromised sensor nodes running malicious code

or adversaries who have stolen the key material, code, and data from legitimate nodes, and who

then use one or more laptop-class devices to attack the network. Mote-class attacker [6] has

access to a few sensor nodes with similar capabilities to our own, but not much more than this.

Using ordinary sensors attacker might only be able to jam the radio link in its immediate

vicinity.

Attack 3.28 Mote-class/Control of Sensor Node. Malicious programs, access cryptographic

keys.

3.15. Invasive

Attack 3.29 Invasive. Reverse engineering, probing. Extract keys, new code, software

vulnerabilities.

3.16. Non-Invasive

Attack 3.30 Non-Invasive. Mote not physically tampered. Side-channel attacks – Differential

power analysis.

3.17. Laptop Class International Journal of Next-Generation Networks (IJNGN),Vol.1, No.1, December 2009

Also called Outsider Attacks. The attacker has no special access to the sensor network. Laptop

class attacker may have access to more powerful devices, like laptops or their equivalent which

supersede the legitimate nodes when deployed for action: they may have greater battery power,

a more capable CPU, a high-power radio transmitter, or a sensitive antenna. Laptop-class

attacker might be able to jam the entire sensor network using its stronger transmitter. A single

laptop-class attacker might be able to eavesdrop on an entire network. Also, laptop-class

attackers might have a high bandwidth, low-latency communications channel not available to

ordinary sensor nodes, allowing such attackers to coordinate their efforts.

Attack 3.31 Laptop-class/Passive Eavesdropping.

Attack 3.32 Laptop-class/Traffic Injection.

3.18. Attack on Protocols

Attack 3.33 Key Management.

Attack 3.34 Reputation Assignment Scheme.

Attack 3.35 Data Aggregation.

Attack 3.36 Time Synchronization.

Attack 3.37 Intrusion Detection Systems.

4. COUNTER MEASURES

In this section, we discuss some of the counter measures.

4.1. Outsider attacks and link layer security

The majority of outsider attacks against sensor network routing protocols can be prevented by

simple link layer encryption and authentication using a globally shared key. Major classes of

attacks not countered by link layer encryption and authentication mechanisms are wormhole

attacks and HELLO flood attacks because, although an adversary is prevented from joining the

network, nothing prevents her from using a wormhole to tunnel packets sent by legitimate nodes

in one part of the network to legitimate nodes in another part to convince them they are

neighbors or by amplifying an overheard broadcast packet with sufficient power to be received

by every node in the network.

Link layer security mechanisms using a globally shared key are completely ineffective in

presence of insider attacks or compromised nodes. Insiders can attack the network by spoofing

or injecting bogus routing information, creating sinkholes, selectively forwarding packets, using

the Sybil attack, and broadcasting HELLO floods. More sophisticated defense mechanisms are

needed to provide reasonable protection against wormholes and insider attacks. We focus on

countermeasures against these attacks in the remaining sections.

4.2. The Sybil attacks

An insider cannot be prevented from participating in the network, but she should only be able to

do so using the identities of the nodes she has compromised. Using a globally shared key allows

an insider to masquerade as any (possibly even nonexistent) node. Identities must be verified. In

the traditional setting, this might be done using public key cryptography, but generating and

verifying digital signatures is beyond the capabilities of sensor nodes. One solution is to have

every node share a unique symmetric key with a trusted base station. Two nodes can then use a

Needham-Schroeder like protocol to verify each other's identity and establish a shared key. A

pair of neighboring nodes can use the resulting key to implement an authenticated, encrypted

link between them. In order to prevent an insider from wandering around a stationary network

and establishing shared keys with every node in the network, the base station can reasonably

limit the number of neighbors a node is allowed to have and send an error message when a node

exceeds it. Thus, when a node is compromised, it is restricted to (meaningfully) communicating

only with its verified neighbors. This is not to say that nodes are forbidden from sending

messages to base stations or aggregation points multiple hops away, but they are restricted from

using any node except their verified neighbors to do so. In addition, an adversary can still use a

wormhole to create an artificial link between two nodes to convince them they are neighbors,

but the adversary will not be able to eavesdrop on or modify any future communications

between them.

4.3. HELLO flood attacks

The simplest defense against HELLO flood attacks is to verify the bi directionality of a link

before taking meaningful action based on a message received over that link. The identity

verification protocol is sufficient to prevent HELLO flood attacks. Not only does it verify the

bidirectional link between two nodes, but even if a well-funded adversary had a highly sensitive

receiver or had wormholes to a multiple locations in the network, a trusted base station that

limits the number of verified neighbors for each node will still prevent HELLO flood attacks on

large segments of the network when a small number of nodes have been compromised.

4.4. Wormhole and Sinkhole attacks

Wormhole and sinkhole attacks are very difficult to defend against, especially when the two are

used in combination. Wormholes are hard to detect because they use a private, out-of-band

channel invisible to the underlying sensor network. Sinkholes are difficult to defend against in

protocols that use advertised information such as remaining energy or an estimate of end-to-end

reliability to construct a routing topology because this information is hard to verify. Routes that

minimize the hop-count to a base station are easier to verify, however hop-count can be

completely misrepresented through a wormhole. When routes are established simply based on

the reception of a packet as in TinyOS beaconing or directed diffusion, sinkholes are easy to

create because there is no information for a defender to verify. A technique for detecting

wormhole attacks is presented in [10], but it requires extremely tight time synchronization and

is thus infeasible for most sensor networks. Because it is extremely difficult to retrofit existing

protocols with defenses against these attacks, the best solution is to carefully design routing

protocols in which wormholes and sinkholes are meaningless.

4.5. Leveraging Global Knowledge

A significant challenge in securing large sensor networks is their inherent self organizing,

decentralized nature. When the network size is limited or the topology is well structured or

controlled, global knowledge can be leveraged in security mechanisms. Consider a relatively

small network of around 100 nodes or less. If it can be assumed that no nodes are compromised

during deployment, then after the initial topology is formed, each node could send information

such as neighboring nodes and its geographic location (if known) back to a base station. Using

this information, the base station(s) can map the topology of the entire network. To account for

topology changes due to radio interference or node failure, nodes would periodically update a

base station with the appropriate information. Drastic or suspicious changes to the topology

might indicate a node compromise, and the appropriate action can be taken. We have discussed

why geographic routing can be relatively secure against wormhole, sinkhole, and Sybil attacks,

but the main remaining problem is that location information advertised from neighboring nodes

must be trusted. A compromised node advertising its location on a line between the targeted

node and a base station will guarantee it is the destination for all forwarded packets from that

node. Probabilistic selection of a next hop from several acceptable destinations or multipath

routing to multiple base stations can help with this problem, but it is not perfect. When a node

must route around a "hole", an adversary can "help" by appearing to be the only reasonable node

to forward packets to. Sufficiently restricting the structure of the topology can eliminate the

requirement for nodes to advertise their locations if all nodes' locations are well known.

4.6. Selective forwarding

Even in protocols completely resistant to sinkholes, wormholes, and the Sybil attack, a

compromised node has a significant probability of including itself on a data flow to launch a

selective forwarding attack if it is strategically located near the source or a base station.

Multipath routing can be used to counter these types of selective forwarding attacks. Messages

routed over paths whose nodes are completely disjoint are completely protected against

selective forwarding attacks involving at most compromised nodes and still offer some

probabilistic protection whenever nodes are compromised. However, completely disjoint paths

may be difficult to create. Braided paths [11] may have nodes in common, but have no links in

common (i.e., no two consecutive nodes in common). The use of multiple braided paths may

provide probabilistic protection against selective forwarding and use only localized information.

Allowing nodes to dynamically choose a packet's next hop probabilistically from a set of

possible candidates can further reduce the chances of an adversary gaining complete control of a

data flow.

4.7. Authenticated broadcast and flooding

If we have base stations trustworthy, adversaries must not be able to spoof broadcast or flooded

messages from any base station. This requires some level of asymmetry: since every node in the

network can potentially be compromised, no node should be able to spoof messages from a base

station, yet every node should be able to verify them. Authenticated broadcast is also useful for

localized node interactions. Many protocols require nodes to broadcast HELLO messages to

their neighbors. These messages should be authenticated and impossible to spoof. Proposals for

authenticated broadcast intended for use in a more conventional setting either use digital

signatures and/or have packet overhead that well exceed the length of typical sensor network

packet. TESLA [12] is a protocol for efficient, authenticated broadcast and flooding that uses

only symmetric key cryptography and requires minimal packet overhead. SPIN [13] and

gossiping algorithms [14], [15] are techniques to reduce the messaging costs and collisions

which still achieve robust probabilistic dissemination of messages to every node in the network.

4.8. OSI Layer wise threats and countermeasures

In this section, we discuss some of the known threats and countermeasures classifying in

different OSI layers.

Physical Layer: In Table 1, we describe Physical Layer Threats & Countermeasures in case of

Wireless Sensor Network.

Table 1 Physical Layer Threats and Countermeasures

Threat	Countermeasure
Interference	Channel hopping and Blacklisting
Jamming	Channel hopping and Blacklisting
Sybil	Physical Protection of devices
Tampering	Protection and Changing of key

Data-link Layer: In Table 2, we describe Data-Link Layer Threats & Countermeasures in case
of Wireless Sensor Network.

Table 2 Data-link Layer Threats and Countermeasures

Threat	Countermeasure
Collision	CRC and Time diversity
Exhaustion	Protection of Network ID and other information that is required to joining device
Spoofing	Use different path for re-sending the message
Sybil	Regularly changing of key
De-synchronization	Using different neighbors for time synchronization
Traffic analysis	Sending of dummy packet in quite hours; and regular monitoring WSN network
Eavesdropping	Key protects DLPDU from Eavesdropper

Network Layer: In Table 3, we describe Network Layer Threats & Countermeasures in case of

Wireless Sensor Network.

Threat	Countermeasure
Wormhole	Physical monitoring of Field devices and regular monitoring of network using Source Routing. Monitoring system may use Packet Leach techniques.
Selective forwarding	Regular network monitoring using Source Routing
DoS	Protection of network specific data like Network ID etc. Physical protection and inspection of network
Sybil	Resetting of devices and changing of session keys.
Traffic Analysis	Sending of dummy packet in quite hours; and regular monitoring WSN network
Eavesdropping	Session keys protect NPDU from Eavesdroppers.

5. CONCLUSION

Security in Wireless Sensor Network is vital to the acceptance and use of sensor networks. In

particular, Wireless Sensor Network product in industry will not get acceptance unless there is a

fool proof security to the network. In this paper, we have made a threat analysis to the Wireless

Sensor Network and suggested some counter measures. Link layer encryption and

authentication mechanisms may be a reasonable first approximation for defense against mote

class outsiders, but cryptography is not enough to defend against laptop-class adversaries and

insiders: careful protocol design is needed as well.

REFERENCES

[1] S. Sharma, “Energy-efficient Secure Routing in Wireless Sensor Networks”, Dept of Computer

Science and Engineering, National Institute of Technology Rourkela, Rourkela, Orissa, 769 008,

India, 2009.

[2] D. Boyle, T. Newe,”Securing Wireless Sensor Networks: Security Architectures”, Journal of

Networks, 2008, 3 (1)

[3] X. Du, H. Chen, "Security in Wireless Sensor Networks", IEEE Wireless Communications,

2008.

[4] J. Granjal, R. Silva, J. Silva, "Security in Wireless Sensor Networks", CISUC UC, 2008.

[5] Y. Zou, K. Chakrabarty, "Sensor deployment and target localization based on virtual forces",

INFOCOM 2003. Twenty- Second Annual Joint Conference of the IEEE Computer and

Communications Societies. IEEE, Volume: 2, Pages: 1293 - 1303, April 2003.

[6] Chris Karlof, David Wagner, "Secure Routing in Wireless Sensor Networks: Attacks and

Countermeasures", University of California at Berkeley.

[7] J. R. Douceur, "The Sybil Attack," in 1st International Workshop on Peer-to-Peer Systems

(IPTPS '02), March 2002.

[8] Castro and Liskov, "Practical byzantine fault tolerance," in OSDI: Symposium on Operating

Systems Design and Implementation. USENIX Association, Co-sponsored by IEEE TCOS and

ACM SIGOPS, 1999.

[9] A. Banerjea, "A taxonomy of dispersity routing schemes for fault tolerant real-time channels," in

Proceedings of ECMAST, vol. 26, May 1996, pp.129-148.

[10] Y.-C. Hu, A. Perrig, and D. B. Johnson, "Wormhole detection in wireless ad hoc networks,"

Department of Computer Science, Rice University, Tech. Rep. TR01-384, June 2002.

[11] D. Ganesan, R. Govindan, S. Shenker, and D. Estrin, "Highly-resilient, energy-efficient

multipath routing in wireless sensor networks," Mobile Computing and Communications

Review, vol. 4, no. 5, October 2001.

[12] A. Perrig, R. Szewczyk, V.Wen, D. Culler, and J. Tygar, "SPINS: Security protocols for sensor

networks," in Proceedings of Mobile Networking and Computing 2001, 2001.

[13] J. Kulik, W. R. Heinzelman, and H. Balakrishnan, "Negotiation-based protocols for

disseminating information in wireless sensor networks," Wireless Networks, vol. 8, no. 2-3, pp.

169-185, 2002.

[14] M.-J. Lin, K. Marzullo, and S. Masini, "Gossip versus deterministic flooding: Low message

overhead and high reliability for broadcasting on small networks, Tech. Rep. CS1999-0637, 18,

1999.

[15] L. Li, J. Halpern, and Z. Haas, "Gossip-based ad hoc routing," in IEEE Infocom 2002, 2002.

[16] Mona Sharifnejad, Mohsen Shari, Mansoureh Ghiasabadi and Sareh Beheshti, A Survey on

Wireless Sensor Networks Security, SETIT 2007.

karma-2012 jobfair

2012-10-20T00:04:00.000-07:00

karma jobfair organised by recruiterz and Government engineering college (Barton Hill) on 21 october 2012

karma 2012 free registration form

karma 2012                                                                   highlights:more than 40+companies
venue:Government Engineering College Bartonhill                         are recruting from tis job fair
        TVM-695035                                                                      *this event is being organised by
date:21st october 2012                                                                  recruiterz
time:9:00am to 5:00pm                                                                  India's First Free job portal for Job
                                                                                                   seeker / Employer /college&freshers
   contact: recruiterz

NEUROMORPHIC VLSI DESIGN USING BAT ECHOLOCATION - paper presentation

2012-10-16T10:45:00.003-07:00

NEUROMORPHIC VLSI DESIGN USING BAT ECHOLOCATION 1. ABSTRACT: Birds and bats have long been the envy of engineers, demonstrating fast, accurate sensing and agile flight control in complex, confined 3D spaces, all in a tiny package. Their ability to fly rapidly through cluttered forest environments in search of food far exceeds the capabilities of any existing man-made system. The technology that is developing and propose to bring to this application domain is neuromorphic
VLSI. For more than a decade, a growing number of VLSI researchers worldwide have been developing a common toolbox of hybrid analog and digital VLSI techniques to mimic the signal processing of neural systems. This effort has spawned many projects in smart vision sensors and systems: silicon cochleae,
retinal and cochlear prosthetics, neural prosthetics, biologically realistic legged robotics, on-chip learning systems and many more. Using these design techniques, our laboratory recently has pursued the development of echolocation circuits that mimic the neural processing in the big brown bat, Eptesicus fuscus. One population of neurons that we have designed is ons that we have designed is tuned to detect the angle of echo arrival as determined by the relative loudness at two microphones placed on a model bat head. These biological algorithms are implemented in commercially available CMOS fabrication processes (e.g., the MOSIS service) and operate in real-time with power consumption in the range of milli watts. 2.INTRODUCTION: From a computational neuroscience perspective, bats are remarkable because of the very short timescale on which they operate. The barrage of returning sonar echoes from a bat's near-environment lasts approximately 30 milliseconds following a sonar emission with the echo from a specific target lasting, at most, a few milliseconds. At this timescale, a particular neuron has the opportunity to fire only one or two spikes to represent the echo. Unlike the “traditional” view of cortical processing where many spikes are integrated over time to compute an average rate, the bat must rely on populations of neurons that respond transiently but selectively to different objects in the environment. In these neural circuits, the details of spike timing, synaptic dynamics, and neuron biophysics become extremely important. Flying at speeds anywhere from 1m/s to 6 m/s, a bat’s sensory world jumps from pulse to pulse as it flies through the world. Sensory prediction is therefore likely to be very important in this animal. In spite of all this behavioral specialization, the bat brain is organized like most other mammalian brains suggesting that echolocation arises from only small modifications of the typical mammalian auditory system. 3.GOAL: Our goal is to construct a flying bat-sized creature that uses ultrasonic echolocation to both navigate and scrutinize its environment sufficiently to distinguish between obstacles and "insects". The bat's sensory and motor system will be constructed from neural models and implemented using "neuromorphic" VLSI techniques. Our intention is two-fold: 1) to test these neural algorithms in a real-time, closed-loop behavioral situation, and 2) to develop useful sonar sensors for use in miniature aircraft systems. BAT HEAD: We are working with two different hardware systems: a physically larger single-frequency sonar system ("narrowband") and a tiny broadband system. The narrowband system is being used to rapidly test concepts following initial software tests. Photos of these two systems are found below: In the photo to the left is our narrowband sonar system that operates only on a frequency of 40 kHz. The fixed arrangement of the microphones was chosen to produce a difference in echo amplitude with azimuthal direction. The current system roughly extracts direction and range and is capable of servoing the head (which is mounted on an model airplane servo) to track moving targets in real-time. On the right, we have a photo of our broadband system using a baked polymer clay bat head with a tiny Knowles (FG3329) microphone soldered to the end of a group of wires. This system has two broadband ultrasonic (and audio) microphones that will feed our silicon cochleae chips. Both of these physical heads produce intensity difference cues at each microphone that allows the system to determine the angle of the arriving echo. 4.AN ULTRASONIC COCHLEA: Echo locating bats specialize in high-frequency hearing using echolocation sounds that typically range in frequency from 20 kHz to 100 kHz. While some bats are specialized for specific frequencies with cochlear filtering at extremely high Q10dB values, we are studying bats that use a broadband vocalization and are ultrasonic frequency generalists (e.g., Myotis lucifugus) with Q10dB values in the range of 10 to 30. Good frequency resolution is important for vertical localization, discriminating close objects as well as for prey determination. To support our ongoing work in modeling bat echolocation, a binaural, ultrasonic cochlea-like filter bank has been designed with moderate quality (Q) factor (as high as 65) with spiking neurons that are driven by the filter outputs. The neuron addresses are reported off chip at the time of the spike in an un-arbitrated fashion and in current-mode to reduce the amount of capacitively- coupled feedback into the filters. This chip was fabricated in a commercially- .5 um CMOS process and consumes 0.425 milli watts at 5 volts. When echoes arrive from different directions, the number of spikes generated in the auditory nerve and the cochlear nucleus varies with the intensity at each ear. Using this information, the first binaural nucleus in the mammalian auditory system, the lateral superior olive (or LSO) becomes selective to the direction of arrival. These cells are excited by the intensity from one ear and inhibited by the intensity from the other ear. The binaural LSO response and the monaural response from the cochlear nucleus are projected to the inferior colliculus (IC) via the doral nucleus of the lateral lemniscus (or DNLL), resulting in very similar responses in both DNLL and IC. With similar responses in the LSO as in the IC, one can ask the question, "What kind of computation is going on here?" In the figure above is a set of tuning curves for three LSO cells that have different synaptic weightings from the left and right ears. By comparing the responses of the population of LSO cells, each of which have different synaptic weightings, we can determine which direction an echo is arriving from. 5.DELAY TUNED CELLS (RANGE TUNING): Information about target range has many uses for bats during both prey-capture and navigation tasks. Beyond the extraction of distance and velocity, it may be important for less obvious tasks, such as optimizing the parameters of the echolocation process. For example, as a bat approaches a target, it alters the repetition rate, duration, spectral content, and amplitude of it vocalizations. Not only is echolocation used for insect capture, it provides to the bat information about obstacles, roosts, altitude, and other flying creatures. In the bat’s brainstem and midbrain exist neural circuits that are sensitive to the specific difference in time between the outgoing sonar vocalization and the returning echo. While some of the details of the neural mechanisms are known to be species-specific, a basic model of reference-triggered, post-inhibitory rebound timing is reasonably well supported by available data. Neurons have been found in bats that show a ‘facilitated’ response to paired sounds (a simulated vocalization and an echo) presented at particular delays. The cells’ responses to sounds presented at the appropriate delays are much greater than the sum of the responses to the individual sounds presented alone. These cells are part of a larger class of neurons called ‘combination-sensitive’ neurons, and are specifically referred to as delay-tuned cells. Delay-tuned cells are found at many levels in the bat auditory system. They have been found in the inferior colliculus (IC), the medial geniculate body (MGB), and the auditory cortex. Disruption of cortical delay-tuned cells has been shown to impair a bat’s ability to discriminate artificial pulse-echo pair delays. It is likely that delay- tuned neurons play a role in forming the bat’s perception of range, although delay-tuned cells have also been shown to respond to the social calls of other bats. 6.COMMERCIAL APPLICATIONS: There are many obvious commercial and industrial applications of integrated sensory systems implemented in low-power VLSI. The development of a small, sophisticated, power-efficient, low-cost echolocation system has many potential applications beyond neural modeling. In the biomedical realm, such devices are beginning to be used as another option for collision avoidance and spatial sensing for blind or low vision patients. These devices when properly scaled down could also be used to guide endoscopic instruments or provide additional information about distance to monocular, visually guided surgical tools. Air-coupled sonar, las a basic sensor module for; mobile robotics, has not advanced significantly beyond a narrow-beam, closest-target sensor, despite decades of use, with robotic vacuum cleaners finally hitting the market, a low power module with significantly more sensing capability at low cost could facilitate a new range of commercial products and toys that have the ability to sense objects in the near-field like a full set of whiskers. From a micro- aerial vehicle (MAV) perspective, while GPS have successfully enabled long-range navigation, the final leg of many desirable machines occurs in locations where the lack of GPS signals and unmapped obstacles make Navigation untenable; such locations include inside building, under the forest canopy, in canyons, and in caves. Obtaining the range to objects directly, while computing azimuth, sonar systems are a natural complement to vision systems for these challenging environments. When combined with an ornithopter airframe, a nearly silent device (to humans), the ability to fly in darkness seems to be within reach. 7.CONCLUSION: Overall this paper proves to be wonderful framework of in which to pursue different types of scientific engineering-oriented research and education. Understanding bat echolocation involves many interesting problems of signal processing within the context of biological data representations and neural hardware. BIBILOGRAPHY: 1.signal processing journal (IEEE)

Network security -paper presentation-3

2012-10-16T10:41:00.003-07:00

Network Security Abstract. This paper will give you a basic understanding of security threats and give you an overview of how to defend your network. It will not make specific recommendations as to what your security policy should be. Every network in every organization has different security needs, and security strategies must be adapted to each specific situation. Because it’s not always easy to
distinguish between threats to individual users and threats to networks, this paper will cover a simple range of threats from simple scams to large-scale, denial-of service attacks. 1. Introduction. In today’s world it’s impractical if not impossible to isolate your network. Networks are interconnected and usually feature a full-time connection to the Internet, which can be a dangerous place. Although the vast majority of Internet users are honest and benign, there are a few who, motivated by greed or maliciousness, will
attempt to directly or indirectly hurt you or your network. They can destroy your operating system, damage data, steal information, overwhelm Web sites, and clog e-mail servers. Even if your network isn’t connected to the Internet or other networks, it’s still vulnerable to attacks transported by portable media such as CDs, Zip disks, or USB flash drives, or from individuals with access to your network. Attacks are surprisingly common. 2. Threats to your network. There are four primary threats to your network: • Malicious software (Malware) • Hackers • Network overload • Physical threats 2.1 Malware. Malware includes viruses, Trojan horses, adware, and spyware. What these kinds of software all have in common is that they all install themselves on your computers without your informed consent. Malware's effects can range from invisible to annoying to devastating. 2.1.1 Viruses. Viruses are bits of software code usually disguised as something innocent that replicate themselves in PCs. The term virus is generally used as a generic word for a wide range of malicious codes, some of which are not technically viruses. Creating or distributing a virus is classified as a computer crime and is a prosecutable offense. Laws enacted against the creation of viruses include the Electronic Privacy Act of 1986 in the United States and the Computer Misuse Act of 1991 in Europe. Some viruses need help to reproduce, some replicate all by themselves, but all reproduce without your permission or knowledge. Viruses often have an infection phase where they reproduce and an attack phase where they do damage. The ability to infect varies from virus to virus, as does the damage viruses can cause. Viruses are the number one method of computer vandalism with new ones being identified every day. There are more than 200,000 known computer viruses. 2.1.1.1 File-infecting viruses. File-infecting viruses are the most common ones in the virus family. They infect executable files by adding their own code to that of the original file. You get file-infecting viruses on your computer when you run an executable file—a game, for instance—received in your e-mail or brought in on hard media such as a floppy disk. As soon as you run the infected file, the virus attaches itself to other executable files on your hard drive. 2.1.1.2 Worms. Worms are self-replicating viruses. Unlike an ordinary virus, which depends on the transfer of a host file in order to replicate, a worm is an independent entity that usually spreads itself without needing a computer user to transfer a file. Many of the newer computer viruses that make the news are worms. Most travel primarily by e-mail but some also spread through nontraditional means such as the Internet Relay Chat (IRC), peer-to-peer networks, or even Web sites— it’s possible to be infected by a worm simply by visiting a compromised Web site. 2.1.1.3 Trojan horses. A Trojan horse (also known as a Trojan) is a software program, often a game or utility that seems to do one thing but has incorporated within itself another, secret function that will cause damage, pass on information about your computer, or enable its sender to hijack your computer. Trojans are often part of hybrid or multipartite viruses. For instance a Trojan may be “planted” in an application by a worm or it may incorporate a virus within itself. Sometimes a Trojan horse will cause obvious damage, but often it looks and acts like a legitimate program, hiding its illicit work in the background where you don’t notice it. Some Trojan horses are used to spy on your activities and steal information; however, the hackers that use Trojan horses to get to your PC are usually not at all interested in your data. What they’re after is a PC with an “always up” broadband connection to the Internet. When they find a vulnerable PC, they use it to distribute pornography or spam e-mail or to launch a Distributed Denial of Service (DDoS) attack in which they use remote PCs to attack a Web site or e-mail server. The reason they use your PC as a host for these activities is because, to the recipient, it looks like the unwanted traffic is coming from your machine. This hides the culprits from ISPs and law enforcement, making them nearly impossible to find. Trojan horses can be very sneaky—if you’re not looking, you may never notice that your computer has been used this way. A common Trojan horse is the Backdoor Trojan which comes in many variations, usually enabling a hacker to access your computer through the Internet Relay Chat (IRC). 2.1.1.4 Macro viruses. Macro viruses are written in the internal macro language provided with many applications. A macro is a set of instructions within a program that you record and assign to a short key code. Then, when you type the key code, the recorded instructions execute. Macros can simplify day-to-day operations such as formatting documents because you can record and play back repetitive instructions instead of having to do them yourself one by one. Many programs enable you to extend the macro language provided with an application with more complex programming languages, so you can set up very complex routines as macros. It’s not only possible, it’s downright easy to write viruses or modify existing viruses within this format. Macro viruses are extremely common—especially within Microsoft Excel® and Microsoft Word® files—with thousands of variants identified. They spread easily because they travel in documents, which are often shared—unlike executable files—and also because many of them, in wormlike fashion, e-mail themselves to everyone they find in your address book. Because macro viruses are so easy to write and modify, new ones pop up all the time. Additionally, because macro viruses spread within an application, they may spread between operating systems—for instance from a PC to a Mac®. Macro viruses activate when an infected document is opened. The degree of damage varies depending on the particular virus. 2.1.1.5 Boot sector viruses. Boot sector viruses infect the Master Boot Record (MBR) on a hard drive by overwriting the original boot code with its own code. The MBR generally resides on the first sectors of your hard disk and controls the boot sequence when you start up your computer. A virus that infects these sectors is especially dangerous because every time you start up your computer, it’s loaded into memory from where it can spread to other parts of the hard disk or to another disk. 2.1.1.6 Stealth viruses. Stealth viruses go to great lengths to actively hide themselves by residing in memory while running. They fool the operating system by modifying and forging the results of calls to functions in the infected file, so the system believes it’s reading the original file. A stealth virus can even hide the fact that it’s consuming memory. Stealth viruses hide themselves so well, they can sometimes fool antivirus products into thinking a computer is virus free. 2.1.1.7 Polymorphic viruses. A polymorphic virus attempts to defeat virus-scanning software by using an algorithm to encrypt itself each time it infects a new host. The encrypted virus escapes detection by the anti-virus software and then decrypts itself to infect the computer. This virus is very difficult to detect because its signature is different every time it infects a new host. 2.1.1.8 Multipartite viruses. Multipartite viruses are the hybrids of the virus world they’re most commonly a combination of boot sector viruses and file infecting viruses, and infect both system sectors and files. These viruses are fairly rare because they’re difficult to write but tend to be particularly nasty when they occur. 2.1.1.9 Invasive software. Adware, spyware, scumware, drug dealer ware, and theftware are all kinds of software that arrive on your computer— sometimes with your permission—and set about the business of polluting your screen with ads, sending information about you out onto the Internet, and generally making a nuisance of themselves by slowing down your system or even causing system crashes. 2.1.2 Adware. Adware is commonly acquired when you download it yourself from the Internet. Freeware or shareware—software available for free or for a small fee on the Internet—often comes with hidden adware. Adware has even turned up in software sold through normal commercial channels. In the usual scenario, you decide to download a program— often a game or useful utility—that’s available free on the Internet. When you download the software, you have to click through a page of unintelligible legal stuff that includes things like copyright and, in the very fine print, permission to install adware along with the software. You click okay to download your software. Soon you start noticing that you’re getting more popup windows than usual. What you may not notice is that your PC is reporting your Web browsing habits to someone out on the Internet 2.1.3 Spyware. Spyware sneaks into your computer without bothering to ask for your permission. As with adware, you may download it along with other software, except spyware doesn’t even have a fine-print page that mentions you’re also getting unwanted features. Some spyware even does a “drive-by download” and installs itself when you just visit a Web page—sometimes as a mere cookie, sometimes even as a complete application. Much spyware is more properly classified as a worm or Trojan horse. Spyware often hides itself so that it’s difficult to find and eradicate from your hard drive. Some spyware will resist being removed and even take parts of your operating system with it when you attempt to eradicate it. Spyware usually has many of the same functions as adware, putting up ads while you’re browsing the Web. 2.1.4 Other unpleasant software options. Adware and spyware have some unsavory relatives. Scumware is designed to steal revenue and traffic from legitimate Web sites. Drug dealer ware offers free software and then shuts down and demands payment months later when you’ve presumably gotten used to using it. Theftware hijacks ad space on Web pages, replacing the page’s ads with its own ads. 2.2 Hackers. At the beginning of the computer age, way back in the Jurassic...er...the 80s, the word “hacker” referred to a person who was very good with computers. Today, the same word usually refers to a person who maliciously breaks into networks, breaks the security on application software, or creates viruses. The hackers we hear the most about are the system crackers who hack into individual computers or into networks. They’ve broken into networks at banks, universities, and military bases. They've infiltrated networks at the Pentagon. Corporate networks are common victims—most have been hit by hackers at least once. Hackers have changed Web sites, accessed unauthorized services, altered and removed files, and stolen information. Often a hacker breaks in just to see if he can do it, looks around, and leaves without doing any damage. Sometimes the damage is minimal—a common trick is to alter the victim’s Web site. However, hackers can and do cause very serious damage to systems and have even been known to erase evidence of their activities by altering logs, leaving network administrators unaware they’ve been hacked. Hackers often use known security holes in operating systems to penetrate your network. These holes are well-known and are repairable with software patches. 2.3 Network overload. Too much traffic can grind a network to a halt. Many types of network overload are caused maliciously, most notably by the denial-of-service attack and spam e-mail, but overload may also be generated inadvertently—for instance, your Web site might get mentioned on national TV, leading to more traffic than your server can handle. 2.3.1 Denial-of-service attacks. Denial-of-service attacks swamp your Web server or e-mail server with more requests than it can handle, causing it to become so slow as to be unusable or even crash entirely. This kind of attack can be instigated by a hacker or it can be caused by a virus. The most common kind of denial-of-service attack, called a buffer attack, is simply to send more traffic to a network address than it can handle. Often a buffer attack deliberately sends oversized packets or large e-mail attachments. A SYN attack is when attacker sends a number of connection requests very rapidly and then fails to respond to the replies. This makes it difficult for legitimate session requests to get established. 2.3.2 Spam. It wastes our time; it eats up network bandwidth, and clogs e-mail servers. Its spam and it’s a problem exploding across the Internet. Spam on the Internet is the junk e-mail that arrives in floods and torrents. It fills in-boxes with offers for dubious products, links to pornographic sites, chain letters, hoaxes, and scams of all kinds. At best, spam is merely a nuisance, but if you’re not paying attention, spam can also be dangerous. Spammers usually get their address lists by mining Usenet newsgroups and searching the Web for e-mail addresses. Sometimes they will buy an address list from another spammer. 2.3.2.1 Advertising spam. Most spam is advertising. And most of what spam advertises is deceptive or fraudulent. Popular advertisements include get-rich-quick business opportunities, work-at-home schemes, miracle cures, dubious investments, illegal cable descrambler kits, credit and credit repair offers, vacation prize scams, and sexually explicit ads. 2.3.2.2 Dangerous spam. Some spam will “bite you” by carrying viruses or by trying to lure you into providing credit card numbers. Some dangerous “spam” e-mail comes, not from spammers, but from worms, that generate infected e-mail from the computers of unsuspecting hosts. For instance, the recent invasive Swen infestation clogged e-mail boxes to the point that many people found in-boxes stuffed with more e-mails that were infected than not. Scams that try to part you from your money are also quite popular on the Internet. Recently many people got e-mails that appeared to be from eBay or PayPal telling them that they needed to update their accounts. The e-mails looked real, complete with the appropriate logos, and provided a link to what looked like legitimate eBay or PayPal Web pages. 2.3.2.3 Hoax spam. Some spam is propagated, not by professional spammers or viruses, but by well-meaning people just like you who pass on chain letters, pleas for the return of “missing” children, and fake virus alerts. Chain letters are letters that promise a large return for small effort and often also threaten bad luck if you break the chain. If they involve the exchange of money, they’re not only a nuisance, they’re illegal. Heart-tugging appeals to our sense of altruism also account for a lot of spam e-mail. Often these urge us to look for missing children or send e-mails to sick children. A variation appeals to our sense of outrage. 2.4 Physical threats. It’s important to remember that all threats to your network do not happen in the data stream. Your network’s physical plant is subject to damage as well. Power surges are the most common problem, but networks are also subject to hazards such as fire, flood, and vandalism, not to mention simple theft. 3. Building effective network security on your wired network. “It is easy to run a secure computer system. You merely have to disconnect all dial-up connections and permit only direct-wired terminals, put the machine and its terminals in a shielded room, and put a guard at the door.” — F. T. Grampp and R. H. Morris, Bell System Technical Journal, 63(8), October 1984. Although this was written more than 20 years ago, the basic principle remains the same: The only 100% sure way to protect your network is to physically isolate it from all contact from the outside world. But disconnecting your network from the Internet and locking it up in a safe room all by itself really isn’t an option in today’s world. 3.1 Make a plan. For effective network security, you need a plan. Generally, the larger the network you’re administering, the more formalized the plan should be. For a tiny network with a broadband or dialup Internet connection, the entire plan can be to keep the virus software updated and not open any suspicious e-mails. A large enterprise network may require a complex, well-choreographed, thoroughly documented plan implemented after a formal risk assessment and analysis of the network. Your security plan should include: • User education • Access policies • Software • Firewall • Backups 3.2 Education. The first line of defense against security threats from the Internet is education and common sense. Keep on top of the latest hoaxes and viruses and make sure your network users know about them. 3.2.1 Be suspicious. A suspicious mind is definitely an advantage on the Internet. Learn to be on the lookout for anything that doesn’t look “right” and encourage your network users to do the same. 3.2.2 Never reply to or forward spam. Never reply to spam. Some spam tells you that you can opt out of future e-mails by clicking on a link. Don’t do it. This is how spammers verify that your e-mail address is a real working address. Never forward spam. You don’t want it—why would your friends want it? That includes chain letters, even a chain letter from a dear, dear friend cursed with a hundred years of bad luck if you don’t forward it. 3.2.3 Keep an eye out for hoaxes and scams. There is no lost child named Penny Brown. Microsoft does not have an e-mail tracking program and will not pay you to forward e-mail. No one in Nigeria wants to give you 20 million dollars for the use of your bank account. You have not won a lottery in Uruguay requiring you to send tax payments. Your mobile phone will not contract a virus if you answer a call from “unavailable.” eBay does not need your credit card information to update your account nor do you need to give your credit card information to cancel laundry charged to your account. 3.2.4 Use caution when opening e-mail attachments. The most common way to acquire a virus is in an e-mail attachment. Ideally, you should install an antivirus program at your gateway to keep them from ever showing up in your in-box in the first place. However, a virus filter isn’t foolproof and sometimes the critters do sneak in. As a rule, don’t open any suspicious attachments. You can consider it suspicious if it’s from someone you don’t know. If it’s an unexpected attachment from someone you do know, check with that person before opening it—some viruses mail themselves and look like an e-mail from a familiar person. If you verify that the e-mail attachment is from a person you know and it’s an executable file, check to see where they got it before opening—that neat little game could be a Trojan horse. 3.2.5 Use caution when opening e-mail. Although most viruses that arrive in e-mail travel as attachments, recently worms have appeared that only require that you open an e-mail to infect your computer. The most infamous of these is the BubbleBoy virus, which carries the subject line “BubbleBoy is back!”. If you open or even preview this e-mail, it will forward itself to everyone in your Outlook address book. BubbleBoy and his relatives take advantage of a security hole in Microsoft Outlook and can be easily prevented by keeping up-to-date on software patches. 3.2.6 Be careful when downloading software. As a rule, it’s not good practice to download software from the Internet, however, there are some very useful utilities out there that are worth downloading. The best way to download useful-looking, but possibly dangerous, software is to first do an Internet search on it to see what kind of a reputation the software has. Carefully read any licensing agreements before clicking on the “agree” button and consider using software that guards against unwanted adware. 3.2.7 Don’t stray into bad neighborhoods. The Internet has its bad neighborhoods. If you start poking around on sites that offer pornography, gambling, and toogood- to-be true (It just fell off the back of a truck, really…) deals, you’re more likely to be exposed to viruses and scams. Stick with sites you trust. An easy way to wander into a bad neighborhood is to type a Web site name into your browser carelessly or to type in what you think a site might be called. There are parasite Web sites with almost the same name as the “real” Web site. These sites get their traffic by counting on people carelessly entering the wrong Web address. These parasite sites are very likely to offer pornography or infect your computer with a worm. 3.3 Access policies. Although this paper focuses on network threats that come from outside your network, be aware that security breaches happen “at home,” too. Anyone with network access can steal or damage your data or networking devices. No amount of firewall protection is going to save a server if someone steals it. Take the time to look at who has access to what, keep essential network devices under lock and key, and implement password access to sensitive data. 3.4 Software that protects your network. 3.4.1 Antivirus software. A crucial component of your security plan is virus software. There are two major types of antivirus software: scanners and check summers. Scanners, the most popular variety of antivirus software, scan your hard drive or scan each file in real time as it’s accessed. Scanners work by comparing files to known viruses. They’re easy to use but must be kept up-to-date with the latest virus information to remain effective. Because viruses change files, check summers look for these changes to find signs of infection. They have the advantage of detecting unknown viruses that a scanner can’t detect, however they also have trouble distinguishing between legitimate change and a virus infection. Another marked disadvantage of check summers is that they can only detect infection after it happens—they’re useless for virus prevention. Most antivirus software from major vendors is primarily of the scanner type, some adding check summers for maximum effectiveness. Regular scans of hard drives on servers and desktop PCs should pick up the rest. Software on desktop PCs should also be set to scan portable media in order to nab viruses that arrive, not through the network, but on diskettes and CDs. 3.4.2 Keep up-to-date. To stay effective, antivirus software needs to be constantly updated with the signatures of recently discovered viruses. 3.4.3 Spam filters. A spam filter is software that gets rid of junk e-mail before it reaches your in-box to annoy you. There are two basic kinds of spam filters: the client-side filter, which operates at the level of your e-mail program, and the server-side filter, which operates on the e-mail server. Client-side filters work on mail that has been downloaded from the e-mail server, examining the mail for spam characteristics and putting it into a separate folder. This kind of filter gives the user more control over spam because it can be examined before it’s permanently deleted. Server-side filters, which filter spam before it gets to local e-mail programs, often tag and delete spam before the end user has a chance to see it. Many ISPs offer server-side filters as one of their services. Both client-side and server-side spam filters offer a number of filtering options: • The challenge-response filter will only allow e-mail from pre-approved addresses. If an e-mail arrives from an unapproved address, the filter automatically sends back a message asking the sender for validation—often by typing in apassword presented as a graphics file. This method has a number of problems including that of the message asking for validation getting trapped in the sender’s spam filter. • Rules-based filtering looks for characteristics common to spam and filters out these messages. For instance, a filter may kickout any reference to prescription drugs. The trouble with this method is that spammers quickly learn how to modify their messages to get past these filters. • Blacklist filtering removes e-mails coming from the addresses of spammers. Usually, you can easily add an address to this list with a simple click, blocking all further e-mails from that address. In an extreme case you can blacklist an entire domain. The trouble with this method is that spammers often change their addresses and frequently send e-mail through perfectly innocent hacked networks, which are then added to your blacklist. • Bayesian analysis uses mathematical formulas to decide which e-mail is likely spam. This kind of filter relies on you telling it which e-mails are spam and then learns to differentiate them from legitimate e-mail. This method does require that you “train” your filter to recognize spam, but it’s usually the most effective method. 3.4.4 Patch holes. Modern software is very complex, making it difficult to thoroughly test for security holes. Often these holes are discovered after software has been out for a while. At this point, the vendor releases a software patch, usually available on its Web site. Many computer break-ins can be prevented simply by keeping your software patches up-to-date. Regularly schedule a check of software patches issued by your software vendors and use them where needed. Remember, do NOT install software patches that arrive unsolicited through your e-mail. These are worms. 3.4.5 Use adware eliminators. This is a specialized kind of software that helps you track down adware and spyware, and block those annoying popups. This is not the same thing as antivirus software, although some spyware is actually a virus and will be nabbed by your antivirus software. You can get adware and popup blockers for free on the Internet, but be careful what you download so you don’t actually bring in more adware. 3.4.6 Don’t use file-sharing programs. If the dubious legality of file sharing doesn’t faze you, consider this: File-sharing programs such as Kazaa are major culprits when it comes to dumping adware and spyware on your computer. They usually inform you in a disclosure box that they are supported by—and will install—adware. Read this box carefully before you click on the “agree” button—you may be agreeing to as many as ten different adware programs. Some even install spyware that they tell you nothing about. 3.4.7 Screen your cookies. Many Web sites leave behind markers or cookies in your system. These cookies are used by Web sites to track you— for instance, to tell if you’re a repeat visitor. Your browser preferences can be set to alert you with a dialog box before it accepts a cookie. This enables you to only accept cookies from Web sites you want to be known to. 3.4.8 Never respond to spam e-mail in any way. Some spam e-mail includes a link to be taken off the e-mailers mailing list. Do not click on this link. By clicking on the link, you only enable the spammer to verify that your e-mail address is valid. Your valid e-mail address then becomes a valuable commodity for future spamming and for sale to other spammers. Spammers often send out large batches of spam to what they hope are valid e-mail addresses. This process is called fishing and when you answer, they’ve caught their fish. 3.4.9 Some miscellaneous security precautions. • Don’t give out more information than you have to when you register software or buy something on-line. • Turn off computers when you’re not using them—today’s broadband Internet connections are on all the time, leaving your PC open to invasion. But PCs can’t be hacked when they’re off. • Some e-mail programs have multiple security holes, making them easily infected. Don’t just use the e-mail reader that came with your operating system. • Disinfect PCs with antivirus software before connecting them to your network. • Scan all removable media. • Disable Java and JavaScript. This limits your interaction with some Web sites but protects you from malicious scripts. 3.5 Broadband routers—simple, cheap firewalls, sort of. An inexpensive but effective way to add a layer of rudimentary firewall protection to a small network with a broadband Internet connection is to use a broadband router instead of a switch to connect to your cable modem or DSL modem. The router provides an important buffer between your network and the Internet through the use of Network Address Translation (NAT). NAT enables several network users to share a single IP address and also provides an important security buffer for your network by hiding your real IP address from the Internet. An Internet Protocol (IP) address is a 32-bit number that identifies an Internet host. IP addresses provide universal addressing across the Internet. IP addresses are placed in the IP packet header and are used to route packets to their destinations. Because IP addresses are difficult to remember, most also have text equivalents such as whitehouse.gov or blackbox.com. A database program called Domain Name Service (DNS) keeps track of the names and translates them into their numeric equivalents. NAT assigns a local IP number to each PC or other network device and then maps local LAN IP addresses to your Internet IP address and vice versa. This masks your internal IP addresses from the world, making it far more difficult to hack into your PCs. 3.6 Firewalls. A firewall controls traffic between two networks. The most common application for a firewall is to control traffic between a private network and the Internet in order to intercept outsiders trying to break into the private network. A firewall exerts this control by applying rules to information—primarily IP addresses and port numbers—found in incoming network packets. The word firewall is most often used to describe a freestanding firewall appliance that provides intelligent, port-based security, although some low-end firewalls are software based. Often services, such as NAT, that are provided by a broadband router are also described as being a firewall. Although the primary purpose of firewalls is to protect your network against unauthorized logins from outside your network, they’re also sometimes used in companies or schools to prevent users from going out to the Internet. For instance, you can set the firewall so users can use e-mail but can’t browse the Web. 3.6.1 How firewalls work. Computer services are based on ports. These ports are not the holes in the back of your computer that you plug cables into. These TCP ports for IP services are abstract, logical connections in your computer that enable it to handle multiple applications over a single network connection. Every computer has 65,000 ports. Which ports provide which services is established by convention. For instance, Web browsing and HTTP traffic generally goes to Port 80, e-mail traffic uses Port 25. Your computer looks at which port data is entering to decide how to treat it. Because there are only five commonly used Internet services, computers have thousands upon thousands of unused ports. These ports can be either open or blocked. Applications open ports to connect to services—for instance, when you start an e-mail program, it opens Port 25 to “listen” for SMTP traffic. Many applications open ports without your permission or knowledge. Hackers probe computer networks by experimentally sending code to different ports. They’re looking for responses from open ports—the unused ports that your applications left open behind your back. When a hacker finds an open port, he’s found a way into your network. Your goal is to make sure that unused ports are blocked and that your network only accepts legitimate requests for service. This is where a firewall comes in. The firewall blocks unwanted traffic while letting through the traffic you want. It makes decisions that allow or deny access to services and ports on your firewall. A firewall enforces your access control policy, but it’s up to you to decide what that access control policy is. You can block whole ranges of ports—everything that you do not require to be open. Firewalls generally come preconfigured to deny all access to all ports. It’s then up to you to instruct your firewall to allow network traffic through to specific ports on specific PCs in your network. The trick is to set it up to allow only necessary traffic through to the right ports, leaving all unused ports protected by the firewall. When a request for a service is made, the firewall inspects the request to make sure the type of request matches an available port. Only traffic for advertised services is allowed through the firewall—all other traffic is dropped. The firewall hides computers from the Internet altogether if they don’t provide services to Internet users. However, hackers have learned to get around this by launching a DDoS attack in which they hijack other computers or spoof addresses, making it look like the attack is coming from many different IP addresses. Your options to defend against these attacks are extremely limited. One step you can take is to request that your ISP apply egress filtering to make sure that their outgoing packets carry only IP addresses that belong to that ISP. You may also scan for and remove DDoS clients, so that your PCs aren’t used as attack tools. These steps, unfortunately, help to protect other sites from attack but don’t do much for your immediate problem. However, if everyone scans their PCs for DDoS clients and more ISPs implement egress filtering, it can help to make life more difficult for hackers trying this method of attack. 3.6.2 Keeping track of your firewall. A firewall is valuable for its logging and auditing functions, providing summaries about what type and volume of traffic passed through it, and also what kinds of break-ins were attempted. When you check firewall logs, you’ll find that network probes are surprisingly common—the Black Box network firewall records thousands daily. The logs will show you where hackers are trying to break in. You should examine logs on a regular basis—preferably once a week—and adjust the firewall accordingly. Some ports are favorites with hackers and you should pay special attention to attempts to access these ports. You should also regularly scan your network to find open ports. Block any unused ports you find open. 3.6.3 What a firewall doesn’t protect against. As important as a firewall is to protect against hackers, it’s important to remember that it does NOT provide complete network protection. A firewall can’t protect you from traffic that does not pass through the firewall, for instance, sabotage from inside your network or corporate secrets leaked out on portable media such as flash drives. A firewall generally doesn’t guard against viruses that typically piggyback on what looks like legitimate traffic. Many firewalls are sold as offering virus protection but only filter out some common types of viruses. A very few high-end firewalls offer complete virus protection, but generally you must run separate virus-protection software in addition to your firewall. 3.6.4 Types of firewalls. A wide range of firewall options is available for applications ranging from a single PC with a broadband Internet connection to a large corporate network. Firewalls can be software that runs on a PC or a separate hardware device that has built-in firewall software. Software firewalls have the advantage of running on a PC so you don’t need to buy any extra hardware. Another advantage is that they’re generally inexpensive—some good basic firewall protection can even be had for free. The downside of software firewall protection is that it’s really only suitable for small applications such as protecting an individual PC or home network with a broadband connection. Also, because these firewalls are software programs that reside on your hard drive, they can be corrupted. Hardware firewalls can refer to minor firewall capabilities, such as NAT, built into a broadband router, but more often they refer to a specialized firewall appliances that provide intelligent filtering and logging services as well as NAT and basic virus protection. These dedicated firewall appliances generally provide more protection than software firewalls and are more suitable for large networks. Plus, because their operating system is permanently encoded in hardware, they’re more difficult to take down than software firewalls are. Packet filtering or network layer (Layer 3) firewalls make decisions based on the source and destination addresses and ports in IP packets. This fastest and simplest form of firewall protection is really no more than a simple sorting algorithm. Generally these firewalls enable you to have some control through the use of access lists. Packet filtering can also often be performed by other network devices such as routers and is generally what you get when you download free firewall software. Packet filtering works well for small networks but when applied to larger networks, it can quickly become very complex and difficult to configure. Packet filtering also cannot be used for content-based filtering and cannot, for instance, remove e-mail attachments. This type of firewall often has little or no logging capability, making it difficult to determine if it’s been attacked. The more sophisticated proxy or application layer firewall deals with network traffic by passing all packets through a separate “proxy” application that examines data at an application level. A proxy firewall doesn’t allow a direct connection between your network and the Internet. Instead it accepts requests and executes them on behalf of the user. For instance, if you’re on network behind a proxy firewall and type in http://www.blackbox.com, the request goes to the firewall, which gets the page on your behalf and passes it to you. This process is transparent to users. This proxy system enables you to set a firewall to accept or reject packets based on not only addresses and port information but also on application information. For instance, you can set the firewall to filter out all incoming packets belonging to .EXE files, which are often infected with viruses and worms. Proxy firewalls generally keep very detailed logs, including information on the data portions of packets. Proxy firewalls are slower and require more hardware than packet filtering; however their greater versatility enables you to enforce tighter security policies. 3.6.5 DeMilitarized Zone (DMZ). Your network may include Web servers, FTP servers, or mail servers that are regularly accessed from the Internet. These servers, by their very nature, need to be open to the Internet. But you don’t want the computers in your internal network open to the Internet and vulnerable to hacking. For this reason, it’s a good idea to isolate public servers from your private network in a DMZ. A DMZ is a separate network that’s home for your public servers. Both users from the Internet and users from the secure network may access servers in the DMZ. Traffic may not travel from the Internet or DMZ directly to the secure network without first going through a proxy server (usually a firewall appliance). 3.6.6 Dual-homed gateway. An easy way to build a DMZ into your network is through the use of a dual-homed gateway. A dual-homed gateway is usually a firewall, although it may also be a router. It features two LAN ports—one for your secure network and one for your “public” network—as well as a WAN port for connection for the Internet. One LAN port connects to the DMZ; one connects to your secure network. Each port has a different security policy, allowing a different type of access. The firewall automatically directs traffic to the appropriate port by IP address. The dual-homed gateway serves as a secure point of control between these two network segments and the Internet, intercepting all traffic between the Internet and your secure site and screening all services and access through proxy servers on the firewall. The dual-homed gateway firewall has the advantage of being both simple to set up and very secure. Many firewalls are specifically Figure 1 Simple Dual - Homed Gateway Application designed to support the dual-homed-gateway configuration and offer a convenient way to set up a DMZ, even in a very small network. Dual-homed gateway firewalls tend to be rather inflexible, but they have the advantage of being easily managed by nearly anyone with basic networking skills. This makes them a popular choice with administrators of small-to-medium-sized networks who must have an e-mail and a Web server open to the Internet while at the same time protecting a secure, private network. Other, more complex firewall configurations, such as screened subnet, offer more versatility and are more suitable to large networks but require a great deal of expertise to implement effectively. 3.7 Backup and recovery. It’s easier and less expensive to prevent problems before they happen, but even in well-defended networks, you have to assume that eventually the unthinkable will happen—a virus will get through and spread among your PCs or a hacker will break into your system and destroy files. And remember, there are other, more mundane dangers to your network— for instance, equipment failure, flood, or theft—that can cause at least as much damage as a virus infection. With a bit of planning, you can contain problems and restore network CPUs quickly. 4 The special security needs of your wireless network. Wireless networks need the same protection as wired networks do. But wireless networks, because of their very nature, present additional security challenges. The number one problem is that, because wireless signals are transmitted to the entire surrounding area, a rogue user with a laptop computer can join your network without being physically linked to it. To keep unwanted visitors from crashing your party, you need to implement security measures designed specifically for wireless networks. 4.1 The new wireless security standards. Until quite recently, wireless Ethernet was regarded as a weak link in network security. The WEP encryption included with 802.11b wireless was easy to crack and provided only the most basic protection from hackers. However, recent advances have brought us WPA and WPA2 (also called IEEE 802.11i) encryption. 4.2 Steps to secure your wireless network. 4.2.1 Use the security you have. A surprising number of wireless networks aren’t secured at all and most intrusions into wireless networks are from casual users taking advantage of unsecured networks. 4.2.2 Change the default channel. Changing the default channel on your wireless router makes it more difficult for unwanted users to find. This is a very easy step that should take you less than five minutes. 4.2.3 Change the default SSID. The Service Set Identifier (SSID) is a unique identification number attached to wireless packets. The SSID is essentially the password a mobile device needs to connect to an access point. The SSID doesn’t really act to secure your wireless network because it can easily be found in packets simply by using a packet sniffer. 4.2.4 Turn on your encryption and change the factory setting. Wireless devices often come with their security features turned off. Make sure you turn on encryption and that you use the highest level of encryption available with your device. In other words, choose WPA or WPA2 over WEP. Change the factory default password to something longer than the usual 6- to 8-character password and do not include English words within the password. 4.2.5 Take advantage of the new security standards. You do have to invest in new hardware to enjoy the high security provided by IEEE 802.11i or WPA2 AES encryption. However, if you have anything you MUST keep secure; the additional cost is well worth the expense. For the highest level of encryption generally available, look for FIPS 140-2 certified devices. 4.2.6 Use more than just wireless encryption. Wireless computers on your network need the same virus protection, spyware protection, and firewall protection as any other computer on your network. 4.2.7 Turn it off. Small office and home wireless networks should be turned off at night and on weekends when they’re not being used. Hackers can’t access what isn’t turned on. 4.2.8 Screen your users. Wireless routers can usually be set to allow only specific MAC addresses to access your wireless network. Hackers can mimic MAC addresses, so this is not a complete security measure, but it will go a long way to discourage the casual freeloader. 4.2.9 Don’t let your employees install unauthorized access points. Unauthorized access points can range from a nuisance to a real security threat in a large network. Because it’s so easy for users to plug in an access point, you have to constantly guard against it. Just one unsecured access point can be a vulnerable entry point for an entire network. 4.2.10 Watch out for strange hotspots. Usually, when you think about wireless security, you think about outsiders hacking into your network through your wireless access points. Keep in mind, though, that your network’s most vulnerable point may be where you link to your home network through someone else’s wireless network. When you use a wireless hotspot in a coffee shop or hotel, this unsecured network can provide a quick back door to your network. A type of attack that can happen is the rogue wireless access point. A hacker sets up an access point with a stronger signal than that of the hotspot, then, when you turn on your computer, this rogue access point offers to connect you to what seems like the correct network. You wind up entering your username and password for the hacker to access. Fortunately, this type of rogue access point attack is quite rare. 4.2.11 Hang onto those laptops. Theft of laptop and notebook computers is sadly a common occurance. A stolen computer can provide express entry into your network. Use physical locks and lock access to the computer itself with password security or even with a fingerprint scanner. If a computer is stolen, change network passwords immediately. 5. Conclusion. Every network administrator is faced with this dilemma: the Internet can be a dangerous thing for your network, but your network needs to be connected to it. Reduce your risk to an acceptable level by implementing the following steps: • Have a plan. • Use common sense and know what to avoid. • Keep viruses and other nasty critters at bay with the appropriate software. • Protect Internet-connected networks with a firewall. • Back up data on a regular schedule. • Take full advantage of wireless encryption. 6. Reference [1]. Black Box Network Security www.blackbox.com [2]. Internal Network Security Mark Bouchard, http://www.consentry.com/download/MissingLink_Inline.pdf [3]. Wireless Network Security http://www.insight.co.uk/files/datasheets/Wireless%20Network%20Security%20(Datasheet).pdf

paper presentation on Network Security

2012-10-16T10:39:00.001-07:00

ABSTRACT Network security is a complicated subject, historically only tackled by well-trained and experienced experts. However, as more and more people become “wired”, an increasing number of people need to understand the basics of security in a networked world. Network security consists of the provisions made in an underlying computer network infrastructure, policies adopted by
the network administrator to protect the network and the network-accessible resources from unauthorized access and the effectiveness (or lack) of these measures combined together. Network security is becoming more and more important as people spend more and more time connected.
Compromising network security is often much easier than compromising physical or local security, and is much more common. Network security starts from authenticating any user. Once authenticated, firewall enforces access policies such as what services are allowed to be accessed by the network users. Though effective to prevent unauthorized access, this component fails to check potentially harmful contents such as computer worms being transmitted over the network. An intrusion prevention system (IPS) helps detect and prevent such malware. IPS also monitors for suspicious network traffic for contents, volume and anomalies to protect the network from attacks such as denial of service. Communication between two hosts using the network could be encrypted to maintain privacy. Individual events occurring on the network could be tracked for audit purposes and for a later high level analysis. Introduction to Networking  What is a Network? A “network” has been defined as “any set of interlinking lines resembling a net, a network of roads || an interconnected system, a network of alliances.” This definition suits our purpose well: a computer network is simply a system of interconnected computers. How they're connected is irrelevant, and as we'll soon see, there are a number of ways to do this.  What are some Popular Networks? Over the last 25 years or so, a number of networks and network protocols have been defined and used. We're going to look at two of these networks, both of which are “public” networks. Anyone can connect to either of these networks, or they can use types of networks to connect their own hosts (computers) together, without connecting to the public networks. Each type takes a very different approach to providing network services.  UUCP UUCP (Unix-to-Unix Copy) was originally developed to connect UNIX (surprise!) hosts together. UUCP has since been ported to many different architectures, including PCs, Macs, Amigas, Apple IIs, VMS hosts, everything else you can name, and even some things you can't. Additionally, a number of systems have been developed around the same principles as UUCP. • Batch-Oriented processing. UUCP and similar systems are batch-oriented systems: everything that they have to do is added to a queue, and then at some specified time, everything in the queue is processed. • Implementation Environment. UUCP networks are commonly built using dial-up (modem) connections. This doesn't have to be the case though: UUCP can be used over any sort of connection between two computers, including an Internet connection. Building a UUCP network is a simple matter of configuring two hosts to recognize each other, and know how to get in touch with each other. Adding on to the network is simple; if hosts called A and B have a UUCP network between them, and C would like to join the network, then it must be configured to talk to A and/or B. Naturally, anything that C talks to must be made aware of C's existence before any connections will work. Now, to connect D to the network, a connection must be established with at least one of the hosts on the network, and so on. A Sample UUCP Network In a UUCP network, users are identified in the format host!userid. The ``!'' character (pronounced ``bang'' in networking circles) is used to separate hosts and users. A bangpath is a string of host(s) and a userid like A!cmcurtin or C!B!A!cmcurtin. If I am a user on host A and you are a user on host E, I might be known as A!cmcurtin and you as E!you. Because there is no direct link between your host (E) and mine (A), in order for us to communicate, we need to do so through a host (or hosts!) that has connectivity to both E and A. In our sample network, C has the connectivity we need. So, to send me a file, or piece of email, you would address it to C!A!cmcurtin. Or, if you feel like taking the long way around, you can address me as C!B!A!cmcurtin. The ``public'' UUCP network is simply a huge worldwide network of hosts connected to each other. • Security. UUCP, like any other application, has security tradeoffs. Some strong points for its security is that it is fairly limited in what it can do, and it's therefore more difficult to trick into doing something it shouldn't; it's been around a long time, and most its bugs have been discovered, analyzed, and fixed; and because UUCP networks are made up of occasional connections to other hosts, it isn't possible for someone on host E to directly make contact with host B, and take advantage of that connection to do something naughty. On the other hand, UUCP typically works by having a system-wide UUCP user account and password. Any system that has a UUCP connection with another must know the appropriate password for the uucp or nuucp account. Identifying a host beyond that point has traditionally been little more than a matter of trusting that the host is who it claims to be, and that a connection is allowed at that time. More recently, there has been an additional layer of authentication, whereby both hosts must have the same sequence number , that is a number that is incremented each time a connection is made. Hence, if I run host B, I know the uucp password on host A. If, though, I want to impersonate host C, I'll need to connect, identify myself as C, hope that I've done so at a time that A will allow it, and try to guess the correct sequence number for the session. While this might not be a trivial attack, it isn't considered very secure.  The Internet  What is the Internet? The Internet is the world's largest network of networks . When you want to access the resources offered by the Internet, you don't really connect to the Internet; you connect to a network that is eventually connected to the Internet backbone , a network of extremely fast network components. This is an important point: the Internet is a network of networks -- not a network of hosts. A simple network can be constructed using the same protocols and such that the Internet uses without actually connecting it to anything else. Such a basic network is shown in. Figure 3: A Simple Local Area Network I might be allowed to put one of my hosts on one of my employer's networks. We have a number of networks, which are all connected together on a backbone , that is a network of our networks. Our backbone is then connected to other networks, one of which is to an Internet Service Provider (ISP) whose backbone is connected to other networks, one of which is the Internet backbone. If you have a connection ``to the Internet'' through a local ISP, you are actually connecting your computer to one of their networks, which is connected to another, and so on. To use a service from my host, such as a web server, you would tell your web browser to connect to my host. Underlying services and protocols would send packets (small datagrams) with your query to your ISP's network, and then a network they're connected to, and so on, until it found a path to my employer's backbone, and to the exact network my host is on. My host would then respond appropriately, and the same would happen in reverse: packets would traverse all of the connections until they found their way back to your computer, and you were looking at my web page. Network is designated ``LAN 1'' and shown in the bottom-right of the picture. This shows how the hosts on that network are provided connectivity to other hosts on the same LAN, within the same company, outside of the company, but in the same ISP cloud , and then from another ISP somewhere on the Internet. Fig Figure4:A Wider View of Internet-connected Networks The Internet is made up of a wide variety of hosts, from supercomputers to personal computers, including every imaginable type of hardware and software.  TCP/IP: The Language of the Internet TCP/IP (Transport Control Protocol/Internet Protocol) is the “language” of the Internet. Anything that can learn to “speak TCP/IP” can play on the Internet. Consequently, a host that has TCP/IP functionality (such as UNIX, OS/2, MacOS, or Windows NT) can easily support applications (such as Netscape’s Navigator) that use the network.  IP As noted, IP is a “network layer” protocol. This is the layer that allows the hosts to actually “talk” to each other. Such things as carrying datagrams, mapping the Internet address (such as 10.2.3.4) to a physical network address (such as 08:00:69:0a:ca:8f), and routing, which takes care of making sure that all of the devices that have Internet connectivity can find the way to each other. Understanding IP IP has a number of very important features which make it an extremely robust and flexible protocol. For our purposes, though, we're going to focus on the security of IP, or more specifically, the lack thereof. Attacks Against IP A number of attacks against IP are possible. Typically, these exploit the fact that IP does not perform a robust mechanism for authentication, which is proving that a packet came from where it claims it did. A packet simply claims to originate from a given address, and there isn't a way to be sure that the host that sent the packet is telling the truth. This isn't necessarily a weakness, per se , but it is an important point, because it means that the facility of host authentication has to be provided at a higher layer on the ISO/OSI Reference Model. Today, applications that require strong host authentication (such as cryptographic applications) do this at the application layer. IP Spoofing. This is where one host claims to have the IP address of another. Since many systems (such as router access control lists) define which packets may and which packets may not pass based on the sender's IP address, this is a useful technique to an attacker: he can send packets to a host, perhaps causing it to take some sort of action. Additionally, some applications allow login based on the IP address of the person making the request.  TCP TCP is a transport-layer protocol. It needs to sit on top of a network-layer protocol, and was designed to ride atop IP. (Just as IP was designed to carry, among other things, TCP packets.) Because TCP and IP were designed together and wherever you have one, you typically have the other, the entire suite of Internet protocols are known collectively as “TCP/IP”. Guaranteed Packet Delivery Probably the most important is guaranteed packet delivery. Host A sending packets to host B expects to get acknowledgments back for each packet. If B does not send an acknowledgment within a specified amount of time, A will resend the packet. Applications on host B will expect a data stream from a TCP session to be complete, and in order. As noted, if a packet is missing, it will be resent by A, and if packets arrive out of order, B will arrange them in proper order before passing the data to the requesting application. This is suited well toward a number of applications, such as a telnet session. A user wants to be sure every keystroke is received by the remote host, and that it gets every packet sent back, even if this means occasional slight delays in responsiveness while a lost packet is resent, or while out-of-order packets are rearranged. It is not suited well toward other applications, such as streaming audio or video, however. In these, it doesn't really matter if a packet is lost (a lost packet in a stream of 100 won't be distinguishable) but it does matter if they arrive late (i.e., because of a host resending a packet presumed lost), since the data stream will be paused while the lost packet is being resent. Once the lost packet is received, it will be put in the proper slot in the data stream, and then passed up to the application.  UDP UDP (User Datagram Protocol) is a simple transport-layer protocol. It does not provide the same features as TCP, and is thus considered “unreliable.” Again, although this is unsuitable for some applications, it does have much more applicability in other applications than the more reliable and robust TCP. One of the things that makes UDP nice is its simplicity. Because it doesn't need to keep track of the sequence of packets, whether they ever made it to their destination, etc., it has lower overhead than TCP. This is another reason why it's more suited to streaming-data applications: there's less screwing around that needs to be done with making sure all the packets are there, in the right order, and that sort of thing. Types And Sources Of Network Threats : The types of threats there are against networked computers, and then some things that can be done to protect yourself against various threats. Denial-of-Service DoS (Denial-of-Service) attacks are probably the nastiest, and most difficult to address. These are the nastiest, because they're very easy to launch, difficult (sometimes impossible) to track, and it isn't easy to refuse the requests of the attacker, without also refusing legitimate requests for service. The premise of a DoS attack is simple: send more requests to the machine than it can handle. There are toolkits available in the underground community that make this a simple matter of running a program and telling it which host to blast with requests. The attacker's program simply makes a connection on some service port, perhaps forging the packet's header information that says where the packet came from, and then dropping the connection. If the host is able to answer 20 requests per second, and the attacker is sending 50 per second, obviously the host will be unable to service all of the attacker's requests, much less any legitimate requests. Some things that can be done to reduce the risk of being stung by a denial of service attack include • Not running your visible-to-the-world servers at a level too close to capacity • Using packet filtering to prevent obviously forged packets from entering into your network address space. Obviously forged packets would include those that claim to come from your own hosts, addresses reserved for private networks. • Keeping up-to-date on security-related patches for your hosts' operating systems. Unauthorized Access ``Unauthorized access'' is a very high-level term that can refer to a number of different sorts of attacks. The goal of these attacks is to access some resource that your machine should not provide the attacker. For example, a host might be a web server, and should provide anyone with requested web pages. However, that host should not provide command shell access without being sure that the person making such a request is someone who should get it, such as a local administrator. Executing Commands Illicitly It's obviously undesirable for an unknown and untrusted person to be able to execute commands on your server machines. There are two main classifications of the severity of this problem: normal user access, and administrator access. A normal user can do a number of things on a system (such as read files, mail them to other people, etc.) that an attacker should not be able to do. This might, then, be all the access that an attacker needs. On the other hand, an attacker might wish to make configuration changes to a host (perhaps changing its IP address, putting a start-up script in place to cause the machine to shut down every time it's started or something similar). In this case, the attacker will need to gain administrator privileges on the host. Confidentiality Breaches : We need to examine the threat model: what is it that you're trying to protect yourself against? There is certain information that could be quite damaging if it fell into the hands of a competitor, an enemy, or the public. In these cases, it's possible that compromise of a normal user's account on the machine can be enough to cause damage (perhaps in the form of PR, or obtaining information that can be used against the company, etc.) Destructive Behavior : Among the destructive sorts of break-ins and attacks, there are two major categories. Data Diddling: The data diddler is likely the worst sort, since the fact of a break-in might not be immediately obvious. Perhaps he's toying with the numbers in your spreadsheets, or changing the dates in your projections and plans. Maybe he's changing the account numbers for the auto-deposit of certain paychecks. In any case, rare is the case when you'll come in to work one day, and simply know that something is wrong. An accounting procedure might turn up a discrepancy in the books three or four months after the fact. Trying to track the problem down will certainly be difficult, and once that problem is discovered, how can any of your numbers from that time period be trusted? Data Destruction: Some of those perpetrate attacks are simply twisted jerks who like to delete things. In these cases, the impact on your computing capability -- and consequently your business -- can be nothing less than if a fire or other disaster caused your computing equipment to be completely destroyed. Tools To Assist Network Security: Packet Sniffers One of the most common ways intruders gain access to more systems on your network is by employing a packet sniffer on a already compromised host. This "sniffer" just listens on the Ethernet port for things like password and login and su in the packet stream and then logs the traffic after that. This way, attackers gain passwords for systems they are not even attempting to break into. Clear-text passwords are very vulnerable to this attack. Example: Host A has been compromised. Attacker installs a sniffer. Sniffer picks up admin logging into Host B from Host C. It gets the admins personal password as they login to B. Then, the admin does a su to fix a problem. They now have the root password for Host B. Later the admin lets someone telnet from his account to Host Z on another site. Now the attacker has a password/login on Host Z. In this day and age, the attacker doesn't even need to compromise a system to do this: they could also bring a laptop or pc into a building and tap into your net. SATAN, ISS, and Other Network Scanners: There are a number of different software packages out there that do port and service-based scanning of machines or networks. SATAN, ISS, SAINT, and Nessus are some of the more well-known ones. This software connects to the target machine (or all the target machines on a network) on all the ports they can, and try to determine what service is running there. Based on this information, you can tell if the machine is vulnerable to a specific exploit on that server. SATAN (Security Administrator's Tool for Analyzing Networks) is a port scanner with a web interface. It can be configured to do light, medium, or strong checks on a machine or a network of machines. It's a good idea to get SATAN and scan your machine or network, and fix the problems it finds. ISS (Internet Security Scanner) is another port-based scanner. It is faster than Satan, and thus might be better for large networks. However, SATAN tends to provide more information. Nessus is a free security scanner. It has a GTK graphical interface for ease of use. It is also designed with a very nice plug in setup for new port-scanning tests. Detecting Port Scans: There are some tools designed to alert you to probes by SATAN and ISS and other scanning software. However, if you liberally use tcp_wrappers, and look over your log files regularly, you should be able to notice such probes. Even on the lowest setting, SATAN still leaves traces in the logs on a stock Red Hat system. There are also "stealth" port scanners. A packet with the TCP ACK bit set (as is done with established connections) will likely get through a packet-filtering firewall. The returned RST packet from a port that _had no established session_ can be taken as proof of life on that port. I don't think TCP wrappers will detect this. NFS (Network File System) Security: NFS is a very widely-used file sharing protocol. It allows servers running nfsd and mountd to "export" entire file systems to other machines using NFS file system support built in to their kernels (or some other client support if they are not Linux machines). mountd keeps track of mounted file systems in /etc/mtab, and can display them with show mount. There is some small amount of security allowed in exporting file systems. You can make your nfsd map the remote root user (uid=0) to the nobody user, denying them total access to the files exported. However, since individual users have access to their own (or at least the same uid) files, the remote root user can login or su to their account and have total access to their files. This is only a small hindrance to an attacker that has access to mount your remote file systems. NIS (Network Information Service) (formerly YP): Network Information service (formerly YP) is a means of distributing information to a group of machines. The NIS master holds the information tables and converts them into NIS map files. These maps are then served over the network, allowing NIS client machines to get login, password, home directory and shell information (all the information in a standard /etc/passwd file). This allows users to change their password once and have it take effect on all the machines in the NIS domain. NIS is not at all secure. It was never meant to be. It was meant to be handy and useful. Anyone that can guess the name of your NIS domain (anywhere on the net) can get a copy of your passwd file, and use "crack" and "John the Ripper" against your users' passwords. Also, it is possible to spoof NIS and do all sorts of nasty tricks. If you must use NIS, make sure you are aware of the dangers. Firewalls In order to provide some level of separation between an organization's intranet and the Internet, firewalls have been employed. A firewall is simply a group of components that collectively form a barrier between two networks. Firewalls are a means of controlling what information is allowed into and out of your local network. Typically the firewall host is connected to the Internet and your local LAN, and the only access from your LAN to the Internet is through the firewall. This way the firewall can control what passes back and forth from the Internet and your LAN. Firewalls are a very useful and important technique in securing your network. However, never think that because you have a firewall, you don't need to secure the machines behind it. This is a fatal mistake.A number of terms specific to firewalls and networking are: Bastion host: A general-purpose computer used to control access between the internal (private) network (intranet) and the Internet (or any other untrusted network). Typically, these are hosts running a flavor of the UNIX operating system that has been customized in order to reduce its functionality to only what is necessary in order to support its functions. Many of the general-purpose features have been turned off, and in many cases, completely removed, in order to improve the security of the machine. Router: A special purpose computer for connecting networks together. Routers also handle certain functions, such as routing , or managing the traffic on the networks they connect. Access Control List (ACL): Many routers now have the ability to selectively perform their duties, based on a number of facts about a packet that comes to it. This includes things like origination address, destination address, destination service port, and so on. These can be employed to limit the sorts of packets that are allowed to come in and go out of a given network. Demilitarized Zone (DMZ): The DMZ is a critical part of a firewall: it is a network that is neither part of the untrusted network, nor part of the trusted network. But, this is a network that connects the untrusted to the trusted. The importance of a DMZ is tremendous: someone who breaks into your network from the Internet should have to get through several layers in order to successfully do so. Those layers are provided by various components within the DMZ. Proxy: This is the process of having one host act in behalf of another. A host that has the ability to fetch documents from the Internet might be configured as a proxy server. And host on the intranet might be configured to be proxy clients. Types of Firewalls There are three basic types of firewalls, and we'll consider each of them. Application Gateways The first firewalls were application gateways, and are sometimes known as proxy gateways. These are made up of bastion hosts that run special software to act as a proxy server. This software runs at the Application Layer of our old friend the ISO/OSI Reference Model, hence the name. Clients behind the firewall must be proxitized (that is, must know how to use the proxy, and be configured to do so) in order to use Internet services. Traditionally, these have been the most secure, because they don't allow anything to pass by default, but need to have the programs written and turned on in order to begin passing traffic. A sample application gateway These are also typically the slowest, because more processes need to be started in order to have a request serviced. Packet Filtering Packet filtering is a technique whereby routers have ACLs (Access Control Lists) turned on. By default, a router will pass all traffic sent it, and will do so without any sort of restrictions. Employing ACL’s is a method for enforcing your security policy with regard to what sorts of access you allow the outside world to have to your internal network, and vice versa. There is less overhead in packet filtering than with an application gateway, because the feature of access control is performed at a lower ISO/OSI layer (typically, the transport or session layer). Due to the lower overhead and the fact that packet filtering is done with routers, which are specialized computers optimized for tasks related to networking, a packet filtering gateway is often much faster than its application layer cousins. shows a packet filtering gateway. Because we're working at a lower level, supporting new applications either comes automatically, or is a simple matter of allowing a specific packet type to pass through the gateway. (Not that the possibility of something automatically makes it a good idea; opening things up this way might very well compromise your level of security below what your policy allows.) There are problems with this method, though. Remember, TCP/IP has absolutely no means of guaranteeing that the source address is really what it claims to be. As a result, we have to use layers of packet filters in order to localize the traffic. We can't get all the way down to the actual host, but with two layers of packet filters, we can differentiate between a packet that came from the Internet and one that came from our internal network. We can identify which network the packet came from with certainty, but we can't get more specific than that. Hybrid Systems In an attempt to marry the security of the application layer gateways with the flexibility and speed of packet filtering, some vendors have created systems that use the principles of both. A sample packet filtering gateway In some of these systems, new connections must be authenticated and approved at the application layer. Once this has been done, the remainder of the connection is passed down to the session layer, where packet filters watch the connection to ensure that only packets that are part of an ongoing (already authenticated and approved) conversation are being passed. Other possibilities include using both packet filtering and application layer proxies. The benefits here include providing a measure of protection against your machines that provide services to the Internet (such as a public web server), as well as provide the security of an application layer gateway to the internal network. Additionally, using this method, an attacker, in order to get to services on the internal network, will have to break through the access router, the bastion host, and the choke router. Secure Network Devices It's important to remember that the firewall is only one entry point to your network. Modems, if you allow them to answer incoming calls, can provide an easy means for an attacker to sneak around (rather than through) your front door (or, firewall). Just as castles weren't built with moats only in the front, your network needs to be protected at all of its entry points. Secure Modems; Dial-Back Systems If modem access is to be provided, this should be guarded carefully. The terminal server, or network device that provides dial-up access to your network needs to be actively administered, and its logs need to be examined for strange behavior. Its passwords need to be strong -- not ones that can be guessed. Accounts that aren't actively used should be disabled. In short, it's the easiest way to get into your network from remote: guard it carefully. There are some remote access systems that have the feature of a two-part procedure to establish a connection. The first part is the remote user dialing into the system, and providing the correct user id and password. The system will then drop the connection, and call the authenticated user back at a known telephone number. Once the remote user's system answers that call, the connection is established, and the user is on the network. This works well for folks working at home, but can be problematic for users wishing to dial in from hotel rooms and such when on business trips. Other possibilities include one-time password schemes, where the user enters his userid, and is presented with a ``challenge,'' a string of between six and eight numbers. He types this challenge into a small device that he carries with him that looks like a calculator. He then presses enter, and a ``response'' is displayed on the LCD screen. The user types the response, and if all is correct, he login will proceed. These are useful devices for solving the problem of good passwords, without requiring dial-back access. However, these have their own problems, as they require the user to carry them, and they must be tracked, much like building and office keys. Crypto-Capable Routers A feature that is being built into some routers is the ability to use session encryption between specified routers. Because traffic traveling across the Internet can be seen by people in the middle who have the resources (and time) to snoop around, these are advantageous for providing connectivity between two sites, such that there can be secure routes. See the Snake Oil FAQ for a description of cryptography, ideas for evaluating cryptographic products, and how to determine which will most likely meet your needs. CONCLUSION: Security is a very difficult topic. Everyone has a different idea of what ``security'' is, and what levels of risk are acceptable. The key for building a secure network is to define what security means to your organization. Once that has been defined, everything that goes on with the network can be evaluated with respect to that policy. Projects and systems can then be broken down into their components, and it becomes much simpler to decide whether what is proposed will conflict with your security policies and practices. Many people pay great amounts of lip service to security, but do not want to be bothered with it when it gets in their way. It's important to build systems and networks in such a way that the user is not constantly reminded of the security system around him. Users who find security policies and systems too restrictive will find ways around them. It's important to get their feedback to understand what can be improved, and it's important to let them know why what's been done has been, the sorts of risks that are deemed unacceptable, and what has been done to minimize the organization's exposure to them. Security is everybody's business, and only with everyone's cooperation, an intelligent policy, and consistent practices, will it be achievable.

dazziling ece

REMOTE CONTROLLED METAL DETECTING ROBOT

yeahhhh........

i will continue this blog again with more great things that will be useful for you

its over an year after the last post ......

expect all you support to continue with great passion

da thadiyaaaaa part 2

da thadiyaaaaaaaaaaaaa...

kidilam sanjay

our own sanju mon.......he rocks

Data Allocation Using Genetic Algorithm for MPSoC Systems with Hybrid Scratch-Pad Memory-paper presentation

Data Allocation Using Genetic Algorithm for MPSoC Systems with Hybrid Scratch-Pad Memory

Abstract

1 Introduction

3.1 Initialization

3.2 Fitness Function

3.3 GA Operations

4 Experiments

5 Conclusions and Future Work

Acknowledgements

References

Computer Network Routing with a Fuzzy Neural Network-paper presentation

Computer Network Routing with a Fuzzy Neural Network

ABSTRACT

Introduction

Research Methodology:

Manipulating Fuzzy Sets:

Neural Networks:

Conclusions:

Future Research:

routing process.

References

Geographically Distributed Virtual Test Environments for Distributed Embedded Control System using Model-based Design - paper presentation

Geographically Distributed Virtual Test Environmentsfor Distributed Embedded Control System using Model-based Design

Abstract

1 Introduction

2 Control System Design

.1. Requirement Specification:

2. Architecture Design:

3. ECU/Hardware/Software Design:

4. Implementation:

3 Functionalities of geographically dis-tributed virtual test environment

Communication middleware:

Multiple types of control software execution:

Service adaption layer:

Execution controller:

4 Conclusion

Acknowledgments

Neural Network Trainer through Computer Networks -paper presentation

Neural Network Trainer through Computer Networks

Abstract -

I. INTRODUCTION

II. OVERVIEW OF NEURAL NETWORK

III. OVERVIEW OF NETWORK PROGRAMMING

IV. NEURAL NETWORK TRAINER

A. Training Algorithms

C. Parameter Settings

D. Training Information

E. Plot Area

V. EXAMPLE

VI. CONCLUSION

REFERENCES

Performance Evaluation of TOFU System Area Network Design for High-Performance Computer Systems -paper presentation

Performance Evaluation of TOFU System Area Network Design for High-Performance Computer Systems

Abstract

1 Introduction

2 Switch design

3 TOFU System Area Network Design

4 Experimental Framework

4.1 Platform

4.2 Simulation Tool

4.3 Simulation Experiments and Result

ACKNOWLEDGEMENTS

Allianz Cornhill Information Services Pvt Ltd customer service job

Allianz Cornhill Information Services Pvt Ltd CUSTOMER SERVICE / CUSTOMER SUPPORT / CUSTOMER CARE / CLIENT SERVICE / CLIENT SUPPORT (VOICE)

ELECTRONICS & COMMUNICATION ENGINEER Fresher / Experience Walk In Interview

Tactearnhome.com ELECTRONICS & COMMUNICATION ENGINEER Fresher / Experience Walk In Interview

FPGA: An Efficient And Promising Platform For Real-Time Image Processing Applications -paper presentation

Proceedings of the National Conference on Research and Development in Hardware & Systems (CSI-RDHS 2008) June 20-21, 2008, Kolkata, India

FPGA: An Efficient And Promising Platform For Real-Time Image Processing Applications

Allianz Cornhill Information Services Pvt Ltd

CUSTOMER SERVICE / CUSTOMER SUPPORT / CUSTOMER CARE / CLIENT SERVICE /
CLIENT SUPPORT (VOICE)

Tactearnhome.com

ELECTRONICS & COMMUNICATION ENGINEER Fresher /
Experience Walk In Interview

Proceedings of the National Conference on

Research and Development in Hardware & Systems

(CSI-RDHS 2008)

June 20-21, 2008, Kolkata, India

1Muhammad Subali
2 Sarifuddin Madenda