@conference {334, title = {Automatic Feedback Control for Graceful Degradation of Real-Time Services in the Face of an Attack}, booktitle = {2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC)}, year = {2018}, month = {Oct}, abstract = {

Distributed denial of service (DDoS) attacks continue to pose a serious threat to various businesses and consumers. With the growth in the number of devices connected to the internet, these attacks continue to grow in number. Despite the availability of security tools, the attacks continue to happen and are causing various businesses to sweat. These tools may take anywhere from a few hours to a few days to counter the attacks, which is unacceptable. In this paper, we put forth a novel feedback control mechanism to minimize the effect of volumetric attacks such as DDoS. During an attack, the feedback control model detects and reduces the impact of the attack by maintaining the service level agreements (SLA) of the network service. The controller makes intelligent decisions to ensure the quality of service (QoS) metrics are gracefully degraded by tuning the micro-firewall rules such as the committed information rate and burst size. A proportional Integral (PI) controller is used as a closed-loop feedback controller to maintain the stability of the network in spite of an attack. This proposed architecture is verified in a lab setup, and we observe that we are able to minimize the degradation of the real-time service so that the user{\textquoteright}s quality of experience (QoE) is preserved. We validate the proposed architecture with a model generated by using the system identification technique. Results from the setup show that the closed-loop feedback control model stabilizes the network in real-time.

}, keywords = {authorisation, automatic feedback control, closed loop systems, closed-loop feedback control model, Computer crime, computer network management, computer network security, DDoS, Distributed Denial of Service attacks, feedback control, Graceful Degradation, Internet, Mathematical model, network service, Packet loss, PI control, proportional Integral controller, QoE, QoS, quality of experience, quality of service, Real Time Services, real-time service, real-time systems, Resilient, service level agreements, service metrics, SLA, state space, Streaming media, System Identification, volumetric attacks}, doi = {10.1109/CIC.2018.00-37}, author = {Vempati, Jagannadh and Ram Dantu} } @conference {340, title = {Uninterrupted Video Surveillance in the Face of an Attack}, booktitle = {2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)}, year = {2018}, month = {Aug}, abstract = {

Distributed denial of service (DDoS) attacks continue to plague businesses and consumers alike, and due to an ever-growing digital landscape, these attacks are expected to grow in size and complexity. Current mitigation techniques ranging from hours to days are completely unacceptable given the cost and inconvenience these attacks place in our society. This paper puts forth three feedback control mechanisms to minimize the effects of DDoS attacks on real-time traffic. The first, called differentiated services code point (DSCP) Markdown, is a passive approach that uses micro firewall rules to lower the priority of out-of-profile packets while a second mechanism actively drops the out-of-profile packets based on rate and burst size parameters. The third technique uses parallel links when feedback is applied to stabilize the network after an attack has been detected. Results from all three techniques have shown to have a positive effect on real-time traffic. The first two approaches were able to stabilize network traffic in real-time, while the parallel links technique resulted in a slight delay. We validate the feedback mechanisms with our model that was generated using the system identification technique. Results show that the feedback architecture provides a fit accuracy with positive results.

}, keywords = {attack mitigation techniques, authorisation, autoregressive processes, burst size parameters, Computer crime, computer network security, DDoS, DDoS attacks, differentiated services code point markdown, DiffServ networks, distributed denial of service attack, DSCP, DSCP Markdown approach, feedback control, feedback mechanisms, Internet, IP networks, Jitter, Mathematical model, micro-firewall, out-of-profile packets, parallel links technique, QoS, quality of service, real-time services, real-time systems, Resilient, Streaming media, system identification technique, uninterrupted video surveillance, video surveillance}, doi = {10.1109/TrustCom/BigDataSE.2018.00121}, author = {Vempati, Jagannadh and Ram Dantu and Thompson, Mark} } @conference {107, title = {An opportunistic encryption extension for the DNS protocol}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

Confidentiality for DNS transactions has been a low-priority concern in DNS security for a long time due to performance requirements for the functionality of DNS and the fact that data in the DNS is considered public. However, the information carried in DNS transactions, if collected and analyzed, can pose real threats to personal privacy. This makes DNS a good target for passive eavesdropping to collect data for many purposes some of which may be malicious. The protocol described in this document is intended to facilitate an opportunistic negotiation of encryption in the DNS to provide confidentiality for the last mile of DNS resolution. It defines procedures to discover encryption-aware servers and how to establish a relationship with them with minimum overhead.

}, keywords = {computer network security, cryptographic protocols, DNS protocol, DNS security, DNS transactions, encryption, Internet, opportunistic encryption extension, passive eavesdropping, performance requirements, personal privacy, pose real threats, Privacy, Protocols, Public key, servers}, doi = {10.1109/ISI.2015.7165976}, author = {Bucuti, Theogene and Ram Dantu} } @conference {271, title = {PhD Forum: A System Identification Approach to Monitoring Network Traffic Security}, booktitle = {2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing}, year = {2015}, month = {Nov}, abstract = {

Network security is a growing area of interest for cyber systems, especially given the increasing number of attacks on companies each year. Though there are a vast amount of tools already available, System Identification (SI) complements intrusion detection systems to help manage network traffic stability. SI is the science of building mathematical models of dynamic systems. This paper introduces the use of SI for modeling network traffic and utilizes a linear time invariant model to analyze performance of real connections and attack instances. We generated several ARX models where each represented a different threat state in the network. We utilized the KDD CUP 1999{\textquoteright}s DARPA dataset to analyze the performance when dealing with different attacks. Results show that the average model fit was 84.14\% when determining if the system was experiencing normal traffic. This value is promising because it shows how well the system is able to determine a network state in a given time when fed input.

}, keywords = {ARX, ARX model, autoregressive processes, Computational modeling, computer network security, Computer security, cyber system, dynamic system, Electronic mail, intrusion detection system, linear time invariant model, Mathematical model, Models, network traffic security, network traffic stability, Predictive models, Security, Silicon, System Identification, system identification approach, telecommunication traffic}, doi = {10.1109/CSCloud.2015.85}, author = {Mayo, Quentin and Bryce, Renee and Ram Dantu} }