# A Study on Improving M2M Network Security through Abnormal Traffic Control
## 4 Experiment Results  
The Ostinato environment for security filter verification is a cross-platform-based program that can generate IPv4-based packets and operates on Windows, BSD, MAC OS, and so on. Ostinato can analyze network traffic for GUI-based API network test automation. It is developed for non-commercial purposes and is being used as a research program. It supports various standard protocols including TCP, UDP, ICMPv4, ICMPv6 (6 over4, 4 over6, 4 over4, 6 over4, 6 over6) TCP/UDP/IP-in-IP, 'Ethernet/802.3/LLC SNAP, VLAN, IGMP, MLD and any text-based protocol (HTTP, SIP, RTSP, NNTP etc.)' and detailed modifications are possible [33]. In addition, simulation of DoS and DDoS attacks that can occur in the M2M intelligent network environment is possible by defining packet transmission. In order to verify the improved security filter, data packets are generated by Ostinato environment settings as shown in Figure 4, assuming an abnormal packet triggering state of an M2M intelligent network device. We set up about 100 pps for testing on low-capacity lines. We set the source IP as the actual IP of the object internet device and the destination of the packet as the test PC. Figure 4: Ostinato settings environment (**a**) set up packet transmission and, (**b**) generate packets. Figure 3: TCP header and control flag structure. The Iptables environment for implementing the security filter is built into the environment, where Centos and two network cards are installed to handle the inbound/outbound traffic separately. Iptables is implemented as a security filter in the internet environment using the control options as shown in Figure 5, and devices other than the object internet are to be used through exception processing. The security filter implementation is shown in Figure 5, which is explained as follows: Firstly, abnormal packets that do not fit the IP communication scheme, do not meet the TCP Flag combination condition, and fragmented packets are blocked. Secondly, M2M intelligent network devices in test environments, when it is confirmed that the ICMP packet is not used, block all ICMP that can be used for attacks such as DDoS and DoS. Finally, the most important security filter setting in the actual M2M intelligent network environment applies the thresholds shown in the actual filters to the M2M intelligent network devices 'TCP Syn 5/s, TCP Ack 25/s, UDP 5/s'. The threshold level is also used to confirm that there is no communication problem in the applied setting. Experiments were conducted in an M2M intelligent network environment and abnormal traffic was generated using Ostinato. We compared the device response in terms of speed and network stability before and after applying the filter. First, it was confirmed whether the use of each M2M intelligent network device was normal when the network security was applied. Second, in the case of an M2M intelligent network device DDoS attack, we verified the resource status of the damage system before and after security filter implementation in case of DDoS attack to an external system. Finally, in the case of M2M intelligent network equipment, an M2M intelligent network device was used to measure the response speed of internet devices. Experimental results show that after the application of the network security filter, the traffic that was generated during the control process of the object internet device did not exceed the traffic setting for normal service or the threshold value, and this is shown in Figure 6. The black line indicates total traffic, red indicates TCP Ack traffic, and green indicates TCP Syn traffic. Figure 6a shows the M2M intelligent network device air cleaner filter operation function time was 0.800/0.900 milliseconds, and Figure 6b shows the M2M intelligent network device 220v plugin which was 2000/2200 milliseconds. In a general application environment, it was difficult to sense these numerical results. Next, we tested a scenario where a DDoS attack was performed from outside on a M2M intelligent network device.