@conference {17, title = {Behavior analysis of spam botnets}, booktitle = {2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE {\textquoteright}08)}, year = {2008}, abstract = {

Compromised computers, known as bots, are the major source of spamming and their detection helps greatly improve control of unwanted traffic. In this work we investigate the behavior patterns of spammers based on their underlying similarities in spamming. To our knowledge, no work has been reported on identifying spam botnets based on spammerspsila temporal characteristics. Our study shows that the relationship among spammers demonstrates highly clustering structures based on features such as content length, time of arrival, frequency of email, active time, inter-arrival time, and content type. Although the dimensions of the collected feature set is low, we perform principal component analysis (PCA) on feature set to identify the features which account for the maximum variance in the spamming patterns. Further, we calculate the proximity between different spammers and classify them into various groups. Each group represents similar proximity. Spammers in the same group inherit similar patterns of spamming a domain. For classification into Botnet groups, we use clustering algorithms such as Hierarchical and K-means.We identify Botnet spammers into a particular group with a precision of 90\%.

}, keywords = {behavior pattern analysis, Botnets, Classification algorithms, clustering algorithm, Clustering algorithms, Correlation, Electronic mail, feature set, Filtering, information filtering, invasive software, maximum variance, pattern classification, pattern clustering, PCA, principal component analysis, spam filtering, Time frequency analysis, unsolicited e-mail, unwanted traffic control}, doi = {10.1109/COMSWA.2008.4554418}, author = {Husna, Husain and Phithakkitnukoon, Santi and Palla, Srikanth and Ram Dantu} } @inbook {46, title = {Behavioral Entropy of a Cellular Phone User}, booktitle = {Social Computing, Behavioral Modeling, and Prediction}, year = {2008}, pages = {160{\textendash}167}, publisher = {Springer US}, organization = {Springer US}, address = {Boston, MA}, abstract = {

The increase of advanced service offered by cellular networks draws lots of interest from researchers to study the networks and phone user behavior. With the evolution of Voice over IP, cellular phone usage is expected to increase exponentially. In this paper, we analyze the behavior of cellular phone users and identify behavior signatures based on their calling patterns. We quantify and infer the relationship of a person{\textquoteright}s randomness levels using information entropy based on the location of the user, time of the call, inter-connected time, and duration of the call. We use real-life call logs of 94 mobile phone users collected at MIT by the Reality Mining Project group for a period of nine months. We are able to capture the user{\textquoteright}s calling behavior on various parameters and interesting relationship between randomness levels in individual{\textquoteright}s life and calling pattern using correlation coeffi- cients and factor analysis. This study extends our understanding of cellular phone user behavior and characterizes cellular phone users in forms of randomness level.

}, isbn = {978-0-387-77672-9}, doi = {10.1007/978-0-387-77672-9_18}, url = {http://dx.doi.org/10.1007/978-0-387-77672-9_18}, author = {Phithakkitnukoon, Santi and Husna, Husain and Ram Dantu}, editor = {Liu, Huan and Salerno, John J. and Young, Michael J.} } @conference {60, title = {Quantifying presence using calling patterns}, booktitle = {Communication Systems Software and Middleware and Workshops, 2008. COMSWARE 2008. 3rd International Conference on}, year = {2008}, month = {Jan}, abstract = {

Presence technology is going to be an integral part of the next generation of communication technology. It can eliminate telephone tag between two parties (caller and callee), which will increase productivity of the parties and reduce unnecessary bandwidth usage of unwanted calls. In this paper, we propose a Willingness Estimator that computes willingness level of a callee for receiving calls from a specified caller. By knowing the willingness value of the callee the caller can decide on proceeding with the call or not. The proposed Willingness Estimator is tested with real mobile user data, and these results are highly accurate. We measure willingness based on calling patterns (arrival time, location, day) of a caller to a callee and this could serve as one of the future presence based services. The results can be used in telecommunication networks such as PSTN, Cellular networks, and Voice over IP networks.

}, keywords = {cellular networks, Communications technology, Computer science, Computer security, Intrusion detection, Laboratories, Mobile handsets, mobile user data, Network servers, next generation communication, Next generation networking, presence technology, Productivity, PSTN, telecommunication networks, telephony, user calling pattern, voice over IP networks, willingness estimator}, doi = {10.1109/COMSWA.2008.4554403}, author = {Husna, Husain and Phithakkitnukoon, Santi and Baatarjav, Enkh-Amgalan and Ram Dantu} } @conference {32, title = {Traffic Shaping of Spam Botnets}, booktitle = {2008 5th IEEE Consumer Communications and Networking Conference}, year = {2008}, month = {01/2008}, address = {Las Vegas, NV}, abstract = {

Compromised computers, known as bots, are the major source of spamming. Detecting them can help greatly improve control of unwanted traffic. In this paper, we develop a traffic control mechanism to detect and delay the traffic of suspicious senders and bots. By delaying spammer{\textquoteright}s traffic, it has been reported that 90\% of spam emails can be eliminated. In our proposed mechanism, we group spammers based on their behavior and transmission patterns. These patterns of spammers show high correlation between group members irrespective of geographic location, network ID, content, and kind of receivers. After identification of these botnet groups we applied traffic shaping techniques a pre-filtering analysis to avoid use of automated machines(bots) to spam a particular domain. Thus the source for majority of spam is blocked before reaching email servers. We also identify how randomly the botnets behave and how easy it is to capture a botnet behavior, based on Information theory. To our knowledge, there is no work reported on detecting and mitigating botnets based on their behavior and in particular transmission patterns.

}, keywords = {automated machine, compromised computer, E-mail server, Internet, prefiltering analysis, spam botnets, spammer traffic, spamming, suspicious senders, telecommunication network management, telecommunication traffic, traffic control mechanism, traffic shaping, unsolicited e-mail}, doi = {10.1109/ccnc08.2007.181}, author = {Husna, Husain and Phithakkitnukoon, Santi and Ram Dantu} } @article {47, title = {HIPAA: Securing Medical Networks}, journal = {Network Security}, volume = {2007}, year = {2007}, pages = {13{\textendash}16}, abstract = {

The Health Information Portability and Accountability Act of 1996 (HIPAA) imposes strict regulations on healthcare institutions and commercial vendors to indemnify clinical data against unscrupulous users. Security vulnerabilities concerning hospital information systems not only negatively impact patient healthcare, but may also represent a potential federal violation. For a comprehensive understanding of the security of a radiology communication network, a detailed survey of the Picture Archiving and Communication Systems (PACS) was compiled. In this paper, we present survey results and a set of recommendations for implementing PACS security.

}, issn = {1353-4858}, doi = {10.1016/S1353-4858(07)70055-7}, url = {http://dx.doi.org/10.1016/S1353-4858(07)70055-7}, author = {Ram Dantu and Oosterwijk, Herman and Kolan, Prakash and Husna, Husain} }