@article {282, title = {Socioscope: Human Relationship and Behavior Analysis in Social Networks}, journal = {IEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans}, volume = {41}, year = {2011}, month = {Nov}, pages = {1122-1143}, abstract = {

In this paper, we propose a socioscope model for social-network and human-behavior analysis based on mobile-phone call-detail records. Because of the diversity and complexity of human social behavior, no one technique will detect every attribute that arises when humans engage in social behaviors. We use multiple probability and statistical methods for quantifying social groups, relationships, and communication patterns and for detecting human-behavior changes. We propose a new index to measure the level of reciprocity between users and their communication partners. This reciprocity index has application in homeland security, detection of unwanted calls (e.g., spam), telecommunication presence, and product marketing. For the validation of our results, we used real-life call logs of 81 users which contain approximately 500 000 h of data on users{\textquoteright} location, communication, and device-usage behavior collected over eight months at the Massachusetts Institute of Technology (MIT) by the Reality Mining Project group. Also, call logs of 20 users collected over six months by the University of North Texas (UNT) Network Security team are used. The MIT and UNT data sets contain approximately 5000 callers. The experimental results show that our model is effective.

}, keywords = {behavioural sciences computing, Change points, communication pattern, Data models, human relationship analysis, human social behavior, human-behavior change detection, Humans, IEEE, Massachusetts Institute of Technology, Mobile handsets, probability, Reality Mining Project group, reciprocity index, Social factors, social group, social groups, social network analysis, Social network services, social networking (online), Social networks, social relationship, social relationships, social sciences computing, socioscope, Statistical analysis, statistical method, University of North Texas}, issn = {1083-4427}, doi = {10.1109/TSMCA.2011.2113335}, author = {Zhang, Huiqi and Ram Dantu and Cangussu, Jo{\~a}o} } @inbook {54, title = {Email Shape Analysis}, booktitle = {Distributed Computing and Networking: 11th International Conference, ICDCN 2010, Kolkata, India, January 3-6, 2010. Proceedings}, year = {2010}, pages = {18{\textendash}29}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Berlin, Heidelberg}, abstract = {

Email has become an integral part of everyday life. Without a second thought we receive bills, bank statements, and sales promotions all to our inbox. Each email has hidden features that can be extracted. In this paper, we present a new mechanism to characterize an email without using content or context called Email Shape Analysis. We explore the applications of the email shape by carrying out a case study; botnet detection and two possible applications: spam filtering, and social-context based finger printing. Our in-depth analysis of botnet detection leads to very high accuracy of tracing templates and spam campaigns. However, when it comes to spam filtering we do not propose new method but rather a complementing method to the already high accuracy Bayesian spam filter. We also look at its ability to classify individual senders in personal email inbox{\textquoteright}s.

}, isbn = {978-3-642-11322-2}, doi = {10.1007/978-3-642-11322-2_7}, url = {http://dx.doi.org/10.1007/978-3-642-11322-2_7}, author = {Sroufe, Paul and Phithakkitnukoon, Santi and Ram Dantu and Cangussu, Jo{\~a}o}, editor = {Kant, Krishna and Pemmaraju, Sriram V. and Sivalingam, Krishna M. and Wu, Jie} } @article {228, title = {Spam Classification Based on E-Mail Path Analysis}, journal = {Pervasive Information Security and Privacy Developments: Trends and Advancements: Trends and Advancements}, year = {2010}, pages = {332}, author = {Palla, Srikanth and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {53, title = {BBN-based Privacy Management System for Facebook}, booktitle = {Proceedings of the 2009 IEEE International Conference on Intelligence and Security Informatics}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

Online social networking sites (SNSs) has changed our lifestyle and become a main medium of communication among young adults to stay in touch with their friends, to organize events, to make friends, to promote themselves, to date, etc. To create content rich environment, SNSs make their platform available for third-party developers. The developers can build their applications based on users{\textquoteright} social graph containing their personal and social information. Unfortunately, any information users posted on their profile can be harvested and used for unethical purposes due to Facebook{\textquoteright}s lack of application privacy configuration. In this paper we propose a privacy-management system for Facebook applications. The system can take advantage of the correlation between some profile features and network privacy settings, in this way it can automatically configure a users privacy settings. Our preliminary result show promising result.

}, isbn = {978-1-4244-4171-6}, url = {http://dl.acm.org/citation.cfm?id=1706428.1706467}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu and Tang, Yan and Cangussu, Jo{\~a}o} } @conference {59, title = {Change Point Detection Based on Call Detail Records}, booktitle = {Proceedings of the 2009 IEEE International Conference on Intelligence and Security Informatics}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

In this paper we propose a method for combining wavelet denoising and sequential approach for detecting change points on mobile phone based on detailed call records. The Minmax method is used to estimate the thresholds of frequency and call duration for denoising. This work is useful to enhance homeland security, detecting unwanted calls (e.g., spam) and commercial purposes. For validation of our results, we randomly choose actual call logs of 20 users from 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. Simulation data is also used to validate the results. The experimental results show that our model achieves good performance with high accuracy.

}, isbn = {978-1-4244-4171-6}, url = {http://dl.acm.org/citation.cfm?id=1706428.1706438}, author = {Zhang, Huiqi and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {29, title = {Email Shape Analysis for Spam Botnet Detection}, booktitle = {Proceedings of the 6th IEEE Conference on Consumer Communications and Networking Conference}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

Botnets have become the major sources of spamming, which generates massive unwanted traffic on networks. An effective detection mechanism can greatly mitigate the problem. In this paper, we present a novel botnet detection mechanism based on the email "shape" analysis that relies on neither content nor reputation analysis. Shape is our new way of characterizing an email by mimicking human visual inspection. A set of email shapes are derived and then used to generate a botnet signature. Our preliminary results show greater than 80\% classification accuracy (without considering email content or reputation analysis). This work investigates the discriminatory power of email shape, for which we believe will be a significant complement to other existing techniques such as a network behavior analysis.

}, isbn = {978-1-4244-2308-8}, url = {http://dl.acm.org/citation.cfm?id=1700527.1700792}, author = {Sroufe, Paul and Phithakkitnukoon, Santi and Ram Dantu and Cangussu, Jo{\~a}o} } @article {16, title = {Issues and challenges in securing VoIP}, journal = {Computers \& Security}, volume = {28}, year = {2009}, pages = {743-753}, abstract = {

Voice over the Internet protocol (VoIP) is being rapidly deployed, and the convergence of the voice and data worlds is introducing exciting opportunities. Lower cost and greater flexibility are the key factors luring enterprises to transition to VoIP. Some security problems may surface with the widespread deployment of VoIP. In this article, we discuss these security problems and propose a high-level security architecture that captures required features at each boundary-network-element in the VoIP infrastructure. We describe mechanisms to efficiently integrate information between distributed security components in the architecture.

}, keywords = {Feedback, Security solutions, Threats, VoIP attacks, VoIP security}, doi = {10.1016/j.cose.2009.05.003}, author = {Ram Dantu and Fahmy, Sonia and Schulzrinne, Henning and Cangussu, Jo{\~a}o} } @article {20, title = {Network risk management using attacker profiling}, journal = {Security and Communication Networks}, volume = {2}, year = {2009}, pages = {83{\textendash}96}, abstract = {

Risk management refers to the process of making decisions that minimize the effects of vulnerabilities on the network hosts. This can be a difficult task in the context of high-exploit probability and the difficult to identify new exploits and vulnerabilities. For many years, security engineers have performed risk analysis using economic models for the design and operation of risk-prone, technological systems using attack profiles. Based on the type of attacker identified, security administrators can formulate effective risk management policies for a network. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs representing all the possible attack paths to all the critical resources. The risk level is computed based on these graphs and are used as a measure of the vulnerability of the resource and forming an effective basis for a system administrator to perform suitable changes to network configuration. Copyright {\textcopyright} 2008 John Wiley \& Sons, Ltd.

}, keywords = {attack graphs, behavior, risk management}, issn = {1939-0122}, doi = {10.1002/sec.58}, url = {http://dx.doi.org/10.1002/sec.58}, author = {Ram Dantu and Kolan, Prakash and Cangussu, Jo{\~a}o} } @conference {78, title = {Penetration Testing for Spam Filters}, booktitle = {Proceedings of the 2009 33rd Annual IEEE International Computer Software and Applications Conference - Volume 02}, year = {2009}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Seattle, WA}, abstract = {

Despite all the advances on techniques to block spam e-mail messages we still receive them on a frequent basis. This is due mainly to the ability of the spammers to modify the message and pass the filters. Therefore a testing technique that could resemble the behavior of spammers would improve the number of scenarios tested and allow filters to be developed based on the potential changes made by the spammers. An approach based on Natural Language Processing (NLP) for the penetration of spam filters is proposed here. Preliminary results using SpamAssassin are provided indicating the feasibility of the proposed approach.

}, keywords = {mutation testing, penetration testing, spam filter}, isbn = {978-0-7695-3726-9}, doi = {10.1109/COMPSAC.2009.168}, url = {http://dx.doi.org/10.1109/COMPSAC.2009.168}, author = {Madhavan, Yugesh and Cangussu, Jo{\~a}o and Ram Dantu} } @conference {41, title = {Quantifying Reciprocity in Social Networks}, booktitle = {2009 International Conference on Computational Science and Engineering}, year = {2009}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Washington, DC, USA}, abstract = {

In this paper we propose a new reciprocity index for quantifying social relationships based on mobile phone call detail records and Twitter blogs. We use this reciprocity index to measure the level of reciprocity between users. This work is useful for detecting unwanted calls (e.g., spam) and product marketing. For validation of our results, we used actual call logs of 100 users collected at MIT by the Reality Mining Project group for a period of 8 months and Twitter blogs of 460 users collected by the Network Security team at UNT for a period of 12 months. The experimental results show that our model achieves results with high accuracy.

}, isbn = {978-0-7695-3823-5}, doi = {10.1109/CSE.2009.399}, url = {http://dx.doi.org/10.1109/CSE.2009.399}, author = {Zhang, Huiqi and Ram Dantu and Cangussu, Jo{\~a}o} } @article {65, title = {A Virtual Environment for Network Testing}, journal = {J. Netw. Comput. Appl.}, volume = {32}, year = {2009}, pages = {184{\textendash}214}, abstract = {

The testing of network-based solutions demands a series of tedious tasks such as the deployment of the solution at different nodes and the configuration of different topologies. The manual execution of these tasks is very time consuming and a configurable environment to facilitate these tasks and consequently improve testing performance is desired. In this paper a virtual network environment that can be easily re-configured is presented to address this problem. The environment has been evaluated by a series of case studies: one dealing with the deployment and containment of a worm propagation attack and one dealing with detecting a denial of service attack. Three smaller case studies have also been developed. The results are a clear indication of the flexibility and usefulness of the virtual network environment.

}, keywords = {Re-configuration, Software testing, Virtual network}, issn = {1084-8045}, doi = {10.1016/j.jnca.2008.03.008}, url = {http://dx.doi.org/10.1016/j.jnca.2008.03.008}, author = {Fagen, Wade and Cangussu, Jo{\~a}o and Ram Dantu} } @article {71, title = {Classification of phishers}, journal = {Journal of Homeland Security and Emergency Management}, volume = {5}, year = {2008}, abstract = {

Phishing attackers masquerade as genuine senders and try to steal consumers{\textquoteright} personal identity data and financial account credentials. In spite of aggressive efforts, technology companies have had limited success in restricting phishing attacks. Unfortunately the nature of phishing attacks changed over time from passive, such as password guessing and eavesdropping to active attacks, such as employing Trojans to intercept traffic and adopting social engineering techniques. No matter how many authentication techniques we develop, phishers always adapt. However, phishers cannot become part of the recipient{\textquoteright}s social network without consent. Though they can forge certain fields in an email header, phishers do not have access to the complete header. In this paper, we describe techniques for detecting phishers based on their traffic paths, traffic patterns, and on the receivers{\textquoteright} social network. Considering such issues, we based our solution on the trustworthiness of the relays participating in routing the emails. We examine the email{\textquoteright}s header rather than the content. We designed our classifier to perform the following analyses in four steps: i) DNS-header analysis, ii) Social network analysis, iii) Wantedness analysis, and iv) Proactive classification. We classify phishers into: i) Serial phishers, ii) Recent phishers, iii) Prospective phishers, and iv) Suspects. Finally, our classifier appends an alert level or label to the email{\textquoteright}s "subject" before adding the email to the inbox.

}, keywords = {application security, network security, phishing, spam}, author = {Ram Dantu and Palla, Srikanth and Cangussu, Jo{\~a}o} } @article {31, title = {Estimation of Defects Based on Defect Decay Model: ED^\{3\}M}, journal = {IEEE Transactions on Software Engineering}, volume = {34}, year = {2008}, pages = {336 - 356}, abstract = {

An accurate prediction of the number of defects in a software product during system testing contributes not only to the management of the system testing process but also to the estimation of the product{\textquoteright}s required maintenance. Here, a new approach called ED3M is presented that computes an estimate of the total number of defects in an ongoing testing process. ED3M is based on estimation theory. Unlike many existing approaches the technique presented here does not depend on historical data from previous projects or any assumptions about the requirements and/or testers{\textquoteright} productivity. It is a completely automated approach that relies only on the data collected during an ongoing testing process. This is a key advantage of the ED3M approach, as it makes it widely applicable in different testing environments. Here, the ED3M approach has been evaluated using five data sets from large industrial projects and two data sets from the literature. In addition, a performance analysis has been conducted using simulated data sets to explore its behavior using different models for the input data. The results are very promising; they indicate the ED3M approach provides accurate estimates with as fast or better convergence time in comparison to well-known alternative techniques, while only using defect data as the input.

}, keywords = {Costs, defect decay model, defect estimation, Defect prediction, estimation theory, Inspection, Metrics/Measurement, Phase estimation, Productivity, program testing, Programming, Software maintenance, software metrics, software product, Software systems, Software testing, Statistical methods, System testing, system testing process, Testing and Debugging}, doi = {10.1109/TSE.2008.23}, author = {Haider, Syed and Cangussu, Jo{\~a}o and Cooper, Kendra and Ram Dantu} } @article {37, title = {Nuisance Level of a Voice Call}, journal = {ACM Trans. Multimedia Comput. Commun. Appl.}, volume = {5}, year = {2008}, pages = {6:1{\textendash}6:22}, abstract = {

In our everyday life, we communicate with many people such as family, friends, neighbors, and colleagues. We communicate with them using different communication media such as email, telephone calls, and face-to-face interactions. While email is not real-time and face-to-face communications require geographic proximity, voice and video communications are preferred over other modes of communication. However, real-time voice/video calls may create nuisance to the receiver. In this article, we describe a mathematical model for computing nuisance level of incoming voice/video calls. We computed the closeness and nuisance level using the calling patterns between the caller and the callee. To validate the nuisance model, we collected cell phone call records of real-life people at our university and computed the nuisance value for all voice calls. We validated the nuisance levels using the feedback from those real-life people. Such a nuisance model is useful for predicting unwanted voice and video sessions in an IP communication network.

}, keywords = {behavior, Multimedia communications, nuisance, presence, Security, tolerance, unwantedness}, issn = {1551-6857}, doi = {10.1145/1404880.1404886}, url = {http://doi.acm.org/10.1145/1404880.1404886}, author = {Kolan, Prakash and Ram Dantu and Cangussu, Jo{\~a}o} } @article {274, title = {Spam Classification Based on E-Mail Path Analysis}, journal = {International Journal of Information Security and Privacy (IJISP)}, volume = {2}, year = {2008}, month = {April}, pages = {46-69}, abstract = {

Email spam is the most effective form of online advertising. Unlike telephone marketing, email spamming does not require huge human or financial resources investment. Most existing spam filtering techniques concentrate on the emails{\^a}{\texteuro}{\texttrademark} content. However, most spammers obfuscate their emails{\^a}{\texteuro}{\texttrademark} content to circumvent content-based spam filters. An integrated solution for restricting spam emails is needed as content analyses alone might not provide a solution for filtering unsolicited emails. Here we present a new method for isolating unsolicited emails. Though spammers obfuscate their emails{\^a}{\texteuro}{\texttrademark} content, they do not have access to all the fields in the email header. Our classification method is based on the path an email traverses instead of content. Overall, our classifier produced fewer false positives when compared to current filters such as SpamAssassin. We achieved a precision of 98.65\% which compares well with the precisions achieved by SPF, DNSRBL blacklists.

}, doi = {doi:10.4018/jisp.2008040104}, url = {https://ideas.repec.org/a/igg/jisp00/v2y2008i2p46-69.html}, author = {Palla, Srikanth and Ram Dantu and Cangussu, Jo{\~a}o} } @article {85, title = {An Architecture for Automatic and Adaptive Defense}, journal = {Journal of Information Privacy and Security}, volume = {3}, year = {2007}, pages = {37-58}, abstract = {

Network attacks have become so fast that human mitigation cannot cope with security requirements. In addition, attackers have become smarter by creating attacks which mutate themselves to prevent detection. Therefore, defense mechanisms must be automated to keep up with attack speed and adapted to seek out mutations. An architecture to support this trend in defense mechanisms is proposed here. The architecture is based upon three conceptual pillars. First is the use of a multi-feedback loop control to slow down an attack. Second, machine learning concepts are employed to properly distinguish between normal and abnormal e-attack traffic. And, third, trust and reputation levels are determined through social networks. A case study on the application of the proposed architecture to a worm propagation attack provides the initial evidence of the e-attack and applicability of the approach.

}, doi = {10.1080/15536548.2007.10855815}, url = {http://dx.doi.org/10.1080/15536548.2007.10855815}, author = {Ram Dantu and Cangussu, Jo{\~a}o} } @article {18, title = {Fast Worm Containment Using Feedback Control}, journal = {IEEE Transactions on Dependable and Secure Computing}, volume = {4}, year = {2007}, pages = {119 - 136}, abstract = {

In a computer network, network security is accomplished using elements such as firewalls, hosts, servers, routers, intrusion detection systems, and honey pots. These network elements need to know the nature or anomaly of the worm a priori to detect the attack. Modern viruses such as Code Red, Sapphire, and Nimda spread quickly. Therefore, it is impractical if not impossible for human mediated responses to these fast-spreading viruses. Several epidemic studies show that automatic tracking of resource usage and control provides an effective method to contain the damage. In this paper, we propose a novel security architecture based on the control system theory. In particular, we describe a state-space feedback control model that detects and control the spread of these viruses or worms by measuring the velocity of the number of new connections an infected host makes. The mechanism{\textquoteright}s objective is to slow down a worm{\textquoteright}s spreading velocity by controlling (delaying) the number of new connections made by an infected host. A proportional and integral (PI) controller is used for a continuous control of the feedback loop. The approach proposed here has been verified in a laboratory setup, and we were able to contain the infection so that it affected less than 5 percent of the hosts. We have also implemented a protocol for exchanging control-specific information between the network elements. The results from the simulation and experimental setup combined with the sensitivity analysis demonstrate the applicability and accuracy of the approach.

}, keywords = {communication/networking and information technology, computer networks, Computer systems organization, control engineering computing, general, invasive software, network security, network-level security and protection, PI control, process control systems., proportional-integral controller, special-purpose and application-based systems, state feedback, state-space feedback control, state-space methods, telecommunication security, worm containment}, doi = {10.1109/TDSC.2007.1002}, author = {Ram Dantu and Cangussu, Jo{\~a}o and Patwardhan, Sudeep} } @conference {62, title = {Goliath: A Configurable Approach for Network Testing}, booktitle = {Testbeds and Research Infrastructure for the Development of Networks and Communities, 2007. TridentCom 2007. 3rd International Conference on}, year = {2007}, month = {May}, abstract = {

When testing a network environment and/or application many aspects need to be taken into consideration. For example, different software needs to be deployed at different nodes and different topologies may also need to be tested. The manual execution of these tasks are very time consuming and a configurable environment to facilitate these tasks and consequently improve testing performance is desired. In this paper a virtual network environment that can be easily reconfigured is presented to address this problem. Also presented is a case study with the results of deployment and containing a worm propagation attack.

}, keywords = {automated network testing, Computational modeling, computer networks, Computer science, Computer worms, Distributed computing, Goliath, Intrusion detection, network topologies, Network topology, Protocols, security of data, Software testing, System testing, telecommunication computing, telecommunication network topology, telecommunication security, virtual network environment, virtual private networks, worm propagation attack}, doi = {10.1109/TRIDENTCOM.2007.4444667}, author = {Fagen, Wade and Cangussu, Jo{\~a}o and Ram Dantu} } @conference {73, title = {An Architecture for Network Security Using Feedback Control}, booktitle = {Proceedings of the 2005 IEEE International Conference on Intelligence and Security Informatics}, year = {2005}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Atlanta, GA}, isbn = {3-540-25999-6, 978-3-540-25999-2}, doi = {10.1007/11427995_84}, url = {http://dx.doi.org/10.1007/11427995_84}, author = {Ram Dantu and Cangussu, Jo{\~a}o} } @conference {81, title = {Sensitivity Analysis of an Attack Containment Model}, booktitle = {Proceedings of the 2005 IEEE International Conference on Intelligence and Security Informatics}, year = {2005}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Atlanta, GA}, abstract = {

A feedback control model has been previously proposed to regulate the number of connections at different levels of a network. This regulation is applied in the presence of a worm attack resulting in a slow down of the spreading worm allowing time to human reaction to properly eliminate the worm in the infected hosts. The feedback model constitutes of two queues, one for safe connections and another for suspected connections. The behavior of the proposed model is based on three input parameters to the model. These parameters are: (i) the portion of new connection requests to be sent to the suspect queue, (ii) the number of requests to be transferred from the suspect to the safe queue, and (iii) the time out value of the requests waiting in the suspect queue. The more we understand the effects of these parameters on the model, the better we can calibrate the model. Based on this necessity, a sensitivity analysis of the model is presented here. The analysis allows for the computation of the effects of changing parameters in the output of the model. In addition, the use of a sensitivity matrix permits the computations of not only changes in one parameter but also combined changes of these parameters. From the sensitivity analysis we have verified our assumption that the changes in the input parameters have no effect on the overall system stability. However, there will be a short period of instability before reaching a stable state.

}, isbn = {3-540-25999-6, 978-3-540-25999-2}, doi = {10.1007/11427995_11}, url = {http://dx.doi.org/10.1007/11427995_11}, author = {Ram Dantu and Cangussu, Jo{\~a}o and Turi, Janos} } @conference {19, title = {Dynamic Control of Worm Propagation}, booktitle = {Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC{\textquoteright}04) Volume 2 - Volume 2}, year = {2004}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Washington, DC, USA}, isbn = {0-7695-2108-8}, url = {http://dl.acm.org/citation.cfm?id=977403.978411}, author = {Ram Dantu and Cangussu, Jo{\~a}o and Yelimeli, Arun} }