Kittitornkun, Surin

Preferred name

Kittitornkun, Surin

Alternative Name

Kittitornkun, S.

Main Affiliation

School of Engineering

surin.ki@kmitl.ac.th

Now showing 1 - 10 of 19

Some of the metrics are blocked by your
consent settings
A FPGA-based deep packet inspection engine for network intrusion detection system
(2012-10-02)
Thinh, Tran Ngoc
;
Hieu, Tran Trung
;
Dung, Van Quoc
;
Kittitornkun, Surin
Pattern matching has became a bottleneck of software based Network Intrusion Detection System (NIDS) as the number of signature have recently increased dramatically. Many FPGA-based architectures for detecting malicious patterns have been proposed recently. However, these approaches have just considered matching pattern separately while more and more complex combination of several patterns are utilized to describe intrusion activities. In this paper we present our work which concentrates on multi-pattern signature and propose a FPGA-based deep packet inspection engine for NIDS. The system can support both static and dynamic patterns. We employ Snort signature set and realize our system on NetFPGA platform. The evaluation on real network environment shows that our system can maintain gigabit line rate throughput without dropping packets. © 2012 IEEE.
Some of the metrics are blocked by your
consent settings
Performance analysis & improvement of SNPHAP on Multi-core CPUs
(2013-09-02)
Ranokphanuwat, Ratthaslip
;
Kittitornkun, Surin
;
Tongsima, Sissades
In this paper, we attempt to analyse this highly computational problem by parallelizing a haplotype inference algorithm, called SNPHAP. The analysis is based on both the orignal (sequential) algorithm and its corresponding run time complexity in Big-O notations. Then, we improve its performance using OpenMP 3.0 and test on a 4-core Intel Core i7-2600 (Hyper-Threading), an 8-core Intel XeonE5405, an 8-core Intel Xeon E5520 (Hyper-Threading) and a 32-core AMD Opteron 8356 Linux machines. The achievements in terms of maximum speedups are 260%, 316%, 410% and 488%, respectively. The factors that affect the speedup of SNPHAP are the specific parallelized code fraction, the suitable OpenMP constructs, the number of physical cores, the sizes of cache memories within/among CPU cores, the clock frequency and finally the memory technology. © 2013 IEEE.
Some of the metrics are blocked by your
consent settings
A Spatio-Temporal malware and country clustering algorithm: 2012 IIJ MITF case study
(2017-10-01)
Sisaat, Khamphao
;
Kittitornkun, Surin
;
Kikuchi, Hiroaki
;
Yukonhiatou, Chaxiong
;
Terada, Masato
A huge number of botnet malware variants can be downloaded by zombie personal computers as secondary injections and upgrades according to their botmasters to perform different distributed/coordinated cyber attacks such as phishing, spam e-mail, malicious Web sites, ransomware, DDoS. In order to generate a faster response to new threats and better understanding of botnet activities, grouping them based on their malicious behaviors has become extremely important. This paper presents a Spatio-Temporal malware clustering algorithm based on its (weekly-hourly-country) features. The dataset contains more than 32 million of malware download logs from 100 honeypots set up by Malware Investigation Task Force (MITF) of Internet Initiative Japan Inc. (IIJ) from 2011 to 2012. The Top-20 malware clustering results coincidentally correspond to Conficker.B and Conficker.C with relatively high precision and recall rates up to 100.0, 88.9 % and 91.7, 100.0 %, respectively. On the other hand, the resulting two clusters of Top-20 countries are comparable to those with high and low growth rates recently reported in 2015 by Asghari et al. Therefore, our approach can be validated and evaluated to yield precision and recall of up to 75.0 and 86.7 %, respectively.
Some of the metrics are blocked by your
consent settings
Geographical visualization of malware download for anomaly detection
(2012-11-06)
Hiroguchi, Naoki
;
Sisaat, Khamphao
;
Kikuchi, Hiroaki
;
Kittitornkun, Surin
We study a linkage between attacks in cyberspace and incidents in our real world. For example, the Internet had been closed down in Egypt for preventing protests against President Hosni Mubarak. Meanwhile, for more than two weeks we have observed that no port-scan packet were sent from Egypt to Japan. This motivates us for this study to find any incident between botnet attacks which were involved many vulnerable servers and the real events occurred in the world. For this purpose, we developed the virtualization system on Google Earth service for plotting source IP addresses of botnet communications. We investigated the actual malware downloading events observed by more than 70 distributed honey pots in the Japanese backbone network. In order to automate the detection process, we study some anomaly detection schemes base on the entropy of honey pot activities. Our analysis shows some evidences that botnet attacks are involved in our real world. © 2012 IEEE.
Some of the metrics are blocked by your
consent settings
Parallel hybrid dual pivot sorting algorithm
(2017-11-03)
Taotiamton, Surapong
;
Kittitornkun, Surin
Sorting is one of the common problems in Computer Science and data analytics. This paper presents empirical results of parallel Hybrid Dual Pivot Sort (HDPSort) for multicore/manycore CPU systems. HDPSort makes use of both classic Lomuto and Hoare partioning algorithms with two pivot values in parallel. It is developed in C++ with OpenMP 3.0 or better. HDPSort is benchmarked with the sequential STLSort in terms of run time, instruction count and branch load. The Speedups of HDPSort are up to 3.02× and 2.79× faster than the STLSort on 8-core AMD FX-8320 and 4-core Intel i7-2600 Linux systems, respectively. An indepth analysis shows that HDPSort gains the Speedup by 300% over STLSort at the expense of 1%-4% of branch mispredictions.
Some of the metrics are blocked by your
consent settings
TCP reassembly for signature-based network intrusion detection systems
(2012-10-02)
Thinh, Tran Ngoc
;
Tomiyama, Shigenori
;
Kittitornkun, Surin
;
Vu, Tran Huy
Rapid development of network makes it a very important and vulnerable part of every field of life. Many intrusion detection systems are developed to protect the network using signature-based matching technique. For connection oriented protocols, such as Transmission Control Protocol, the data should be reassembled before being scanned by the matching engine. Several techniques are introduced to reassemble TCP packets on FPGA. However, they have some disadvantages such as inefficient memory, unscalable system, and unsupported complex TCP connections. In this paper, we propose a multi-linked-list approach and a combination of edge buffering scheme for TCP reassembly, which helps detecting cross packets intrusion signatures. Our architecture not only supports TCP connections with up to 4 concurrent holes, but also uses memory more efficiently than others. The experimental results show that our system can hold about 256K connections simultaneously and support up to 46K out-of-sequence connections with only 64MB DRAM. © 2012 IEEE.
Some of the metrics are blocked by your
consent settings
Scheduling algorithms for the revised pdpsort
(2019-07-01)
Rattanatranurak, Apisit
;
Kittitornkun, Surin
Parallel sorting algorithms for manycore CPU systems are needed in data science and big data era. The PDPSort (Parallel Dual Pivot STLSort) can be revised and extended to achieve higher and more stable Speedups. This paper experiments four scheduling algorithms, Always Left (LAL), Always Right (RAL), Longer Partition First (LPF) and Shorter Partition First (SPF). Eventually, the revised PDPSort can achieve faster Speedup by upto 7.35×, 4.83× and 4.43× over the STLSort on AMD R7-1700, AMD FX-8320, and Intel i7-2600 Linux systems, respectively. Moreover, the LPF algorithm yields more stable Speedup's than others.
Some of the metrics are blocked by your
consent settings
Clustering Top-10 malware/bots based on download behavior
(2013-01-01)
Yukonhiatou, Chaxiong
;
Kittitornkun, Surin
;
Kikuchi, Hiroaki
;
Sisaat, Khamphao
;
Terada, Masato
Malware can be spread over the Internet via especially download mechanism to the victim computers. This work tries to cluster malware/bots download behavior of Top-10 malware based on 2010 and 2011 CCC (Cyber Clean Center) datasets. The datasets contain more than one million download logs collected from several independent honeypots in Japan to observe malware/bot traffic and activities. Although the daily and hourly patterns are quite similar in 2010, those of 2011 are quite different. As a result, the proposed Integral Correlation Coefficient can cluster 3 and 4 groups of Top-10 malware/bots in 2010 and 2011, respectively. © 2013 IEEE.
Some of the metrics are blocked by your
consent settings
Multithreading bioinformatics software with OpenMP: SNPHAP case study
(2010-12-01)
Ranok, Udom
;
Kittitornkun, Surin
;
Tongsima, Sissades
This paper presents a parallelization framework for infer- ring haplotypes using an expectation maximization (EM) algorithm. Our framework utilizes GProf profiling tool, OpenMP library, and ompP profiling tool to parallelize the algorithm by determining the hotspot functions, mul- tithreading, and executing them on the Multi-core CPUs. In our experiments, we choose the SNPHAP program for this case study and run it on an 8-core Xeon Linux ma- chine. The results show that our framework can signifi- cantly speedup up to 214% on a large data set with 151 loci of a 10,000 data samples. In addition, deep profiles of multithreaded SNPHAP support our discovery that maxi- mum speedup can be achieved when the number of parallel threads equals to the number of physical cores.
Some of the metrics are blocked by your
consent settings
A multithreading methodology with OpenMP on multi-core CPUs: SNPHAP case study
(2011-08-12)
Ranok, Udom
;
Kittitornkun, Surin
;
Tongsima, Sissades
This paper presents a multithreading methodology for OpenMP library. The methodology can be applied to convert existing sequential and demanding programs to be multithreaded programs with OpenMP running on the Multi-core CPUs. In our experiments, we apply this methodology to SNPHAP, which is one of the best haplotype inference bioinformatics program in terms of speed. The results show that our significant achievement is the maximum Speedup 316% for Intel Xeon E5405 (8-core 2.0 GHz) and 410% for Intel Xeon E5520 (8-Core with HyperThreading 2.66GHz) faster than its own sequential version. © 2011 IEEE.

Kittitornkun, Surin

Filters

Settings

Sort By

Results per page