A Study on Improving M2M Network Security through Abnormal Traffic Control

Round 1

Reviewer 1 Report

In my opinion, the introduction should be further improved to better specify the motivation of the work and the characteristics of the methodology. As it is, it is not clear how it works. Additionally, the author should state clearly in which aspect this work extends the state of the art, i.e., what is the novelty?

Add a structure of the paper in the introduction. Also, highlight the research gap in existing research and literature. The importance of the proposed integrated approach with respect to the problem statement should have been in focus.

 

About the related works, further papers should be added to the literature review. Each paper should clearly specify what is the proposed methodology, novelty and results with experimentation. At the end of related works, highlight better in some lines what overall technical gaps are observed in existing works, that led to the design of the proposed approach. To better delineate the context and the different possible solutions, you can consider the following papers as references: https://ieeexplore.ieee.org/abstract/document/9409962 and https://www.sciencedirect.com/science/article/abs/pii/S0957417421012598.

The future scope of the methodology should be extended/highlighted. Improve the conclusion, and clarify the conclusion of this article with its significance for follow-up research.

 

 

Author Response

Reviewer 1

In my opinion, the introduction should be further improved to better specify the motivation of the work and the characteristics of the methodology. As it is, it is not clear how it works. Additionally, the author should state clearly in which aspect this work extends the state of the art, i.e., what is the novelty?

Add a structure of the paper in the introduction. Also, highlight the research gap in existing research and literature. The importance of the proposed integrated approach with respect to the problem statement should have been in focus.

About the related works, further papers should be added to the literature review. Each paper should clearly specify what is the proposed methodology, novelty and results with experimentation. At the end of related works, highlight better in some lines what overall technical gaps are observed in existing works, that led to the design of the proposed approach. To better delineate the context and the different possible solutions, you can consider the following papers as references:

https://ieeexplore.ieee.org/abstract/document/9409962 and https://www.sciencedirect.com/science/article/abs/pii/S0957417421012598.

The future scope of the methodology should be extended/highlighted. Improve the conclusion, and clarify the conclusion of this article with its significance for follow-up research.

Reply: The application of security is an application-level security measure to prevent data or code within an application from being stolen or hacked. The global nature of the Internet exposes web assets to attacks from multiple locations and varying levels and complexity. When you use a security filter, you can defend against a more stable DDoS attack. Therefore, it is related to build the security filter for a more stable defense against the DDoS attack.

At the end of the paper, the following parts are added

In addition to M2M intelligent network devices used for the study, it is necessary to verify the packet specificity of more devices and to have more accurate policy tuning methods in the future.

The two references are added in the introduction part.

Thank you.

Reviewer 2 Report

The article is well written and easy to understand but requires some proof reading. The scientific value of the research is high. It was conducted reliably. The authors' good knowledge of the research technique was demonstrated. The article is an original scientific work. The research problem has been correctly defined and the topic (title) of the article corresponds well to it. Few of my feedback can be considered to improve the quality of the paper:

1. The paper's title should be concise and as short as possible. Do not use any acronyms in the paper's title. 2. Include a paragraph at the end of the Introduction describing the organization of the paper.

3. Write some future directions in the conclusion section. Please improve the quality of figures.

4. The difference between your proposal and related works is not clear, you could do details better.
I suggest add a comparative table in ''Related Literature'' to contrast your solution in front of related works.

The article is well written and easy to understand but requires some proof reading. The scientific value of the research is high. It was conducted reliably. The authors' good knowledge of the research technique was demonstrated. Therefore paper can be accepted after revision.

 

Author Response

The article is well written and easy to understand but requires some proofreading. The scientific value of the research is high. It was conducted reliably. The authors' good knowledge of the research technique was demonstrated. The article is an original scientific work. The research problem has been correctly defined and the topic (title) of the article corresponds well to it. Few of my feedback can be considered to improve the quality of the paper:

1. The paper's title should be concise and as short as possible. Do not use any acronyms in the paper's title.

Reply: I think, the word used in the title is familiar and everybody can understand it and it’s not jargon.

2. Include a paragraph at the end of the Introduction describing the organization of the paper.

Reply: It’s done.

3. Write some future directions in the conclusion section. Please improve the quality of the figures.

Reply: In addition to M2M intelligent network devices used for the study, it is necessary to verify the packet specificity of more devices and to have more accurate policy tuning methods in the future.

We will soon update the quality of the Figures.

4. 
   The difference between your proposal and related works is not clear, you could do details better.
   I suggest add a comparative table in ''Related Literature'' to contrast your solution in front of related works.
   
   

Reply: We could not find the related papers with a similar research environment. If available, please send the link to the related paper.

The article is well written and easy to understand but requires some proof reading. The scientific value of the research is high. It was conducted reliably. The authors' good knowledge of the research technique was demonstrated. Therefore paper can be accepted after revision.

Reply: Thank you very much.

Reviewer 3 Report

 

This work proposes different network filters to improve the security of Machine-to-Machine (M2M) networks. To build such filters, it uses the iptables utility and defines some rules to block some traffic. The proposal is tested using the Ostinato traffic generator tool.

First of all, I fail to see a real contribution in this paper. It seems to work because the scenario is prepared to work under those circumstances. That is, the proposed filter is able to filter out the self-generated network traffic and all the details of such generated traffic are known by the authors.

There are several things that are unclear, and they are important to judge the contribution of the paper properly. For example, the thread model is completely unclear, which capabilities has the attacker and against which threats can the filters protect a M2M network? The choices of the rules are not justified, why are some flags considered malicious? Additionally, another tool is mentioned, “conntrack”, but it is not explained how it is used exactly. The sentence “conntrack leaves a record of the session through conntrack” is also unclear.

The proposal seems to assume that all the devices that are part of M2M networks have a OS or something similar which is able to run the iptables utility. It is also unclear if all the devices should include the filters or not. This should be clarified in the manuscript and the limitations of the proposal should be clearly stated.

Finally, the experimental results section should be extended and the scenarios should be described in such a way that any researcher reading the paper is able to reproduce similar results.

Minor issues:

I do not completely get how a M2M network (page 2, line 69) can include a human as a distributed element of such network.

In the paper there are some sentences that sound weird to me, but also some mistakes and typos and also there is a repeated sentence at the end of page 3. The same comment applies to the ending of section 2 (repeated paragraphs).

 

Author Response

This work proposes different network filters to improve the security of Machine-to-Machine (M2M) networks. To build such filters, it uses the iptables utility and defines some rules to block some traffic. The proposal is tested using the Ostinato traffic generator tool.

First of all, I fail to see a real contribution in this paper. It seems to work because the scenario is prepared to work under those circumstances. That is, the proposed filter is able to filter out the self-generated network traffic and all the details of such generated traffic are known by the authors.

Reply: This work is focused on how fast we can respond against the DDoS attack. You can refer about this content in Table 3 and 4.

There are several things that are unclear, and they are important to judge the contribution of the paper properly. For example, the thread model is completely unclear, which capabilities has the attacker and against which threats can the filters protect a M2M network? The choices of the rules are not justified, why are some flags considered malicious? Additionally, another tool is mentioned, “conntrack”, but it is not explained how it is used exactly. The sentence “conntrack leaves a record of the session through conntrack” is also unclear.

Reply: When we apply such filter in the network, we can response/process/retrieve the data quickly, so we used this filtering concept.

"Conntrack" is a part of Linux network stack, specifically part of the firewall subsystem. This part is added to the paper.

The proposal seems to assume that all the devices that are part of M2M networks have an OS or something similar which is able to run the iptables utility. It is also unclear if all the devices should include filters or not. This should be clarified in the manuscript and the limitations of the proposal should be clearly stated.

Reply: If there are new attacks in the network, the speed of retrieving the data of the victim side can be delayed or almost does not work. These are the limitation of the work.

Finally, the experimental results section should be extended and the scenarios should be described in such a way that any researcher reading the paper is able to reproduce similar results.

Reply: I have added at the end of the paper about the future works as follows:

In addition to M2M intelligent network devices used for the study, it is necessary to verify the packet specificity of more devices and to have more accurate policy tuning methods in the future.

Minor issues:

I do not completely get how a M2M network (page 2, line 69) can include a human as a distributed element of such network.

 Reply: I have delated the word ‘human’.

 In the paper there are some sentences that sound weird to me, but also some mistakes and typos and also there is a repeated sentence at the end of page 3. The same comment applies to the ending of section 2 (repeated paragraphs).

 Reply: Repeated sentences are deleted.

Thank you.

Round 2

Reviewer 1 Report

The authors addressed all my concerns; therefore the paper can be published in its current form.

Reviewer 2 Report

Authors updated the paper as per my comments.