@article {71,
	title = {Classification of phishers},
	journal = {Journal of Homeland Security and Emergency Management},
	volume = {5},
	year = {2008},
	abstract = {<p>Phishing attackers masquerade as genuine senders and try to steal consumers{\textquoteright} personal identity data and financial account credentials. In spite of aggressive efforts, technology companies have had limited success in restricting phishing attacks. Unfortunately the nature of phishing attacks changed over time from passive, such as password guessing and eavesdropping to active attacks, such as employing Trojans to intercept traffic and adopting social engineering techniques. No matter how many authentication techniques we develop, phishers always adapt. However, phishers cannot become part of the recipient{\textquoteright}s social network without consent. Though they can forge certain fields in an email header, phishers do not have access to the complete header. In this paper, we describe techniques for detecting phishers based on their traffic paths, traffic patterns, and on the receivers{\textquoteright} social network. Considering such issues, we based our solution on the trustworthiness of the relays participating in routing the emails. We examine the email{\textquoteright}s header rather than the content. We designed our classifier to perform the following analyses in four steps: i) DNS-header analysis, ii) Social network analysis, iii) Wantedness analysis, and iv) Proactive classification. We classify phishers into: i) Serial phishers, ii) Recent phishers, iii) Prospective phishers, and iv) Suspects. Finally, our classifier appends an alert level or label to the email{\textquoteright}s "subject" before adding the email to the inbox.</p>
},
	keywords = {application security, network security, phishing, spam},
	author = {Ram Dantu and Palla, Srikanth and Cangussu, Jo{\~a}o}
}
@article {18,
	title = {Fast Worm Containment Using Feedback Control},
	journal = {IEEE Transactions on Dependable and Secure Computing},
	volume = {4},
	year = {2007},
	pages = {119 - 136},
	abstract = {<p>In a computer network, network security is accomplished using elements such as firewalls, hosts, servers, routers, intrusion detection systems, and honey pots. These network elements need to know the nature or anomaly of the worm a priori to detect the attack. Modern viruses such as Code Red, Sapphire, and Nimda spread quickly. Therefore, it is impractical if not impossible for human mediated responses to these fast-spreading viruses. Several epidemic studies show that automatic tracking of resource usage and control provides an effective method to contain the damage. In this paper, we propose a novel security architecture based on the control system theory. In particular, we describe a state-space feedback control model that detects and control the spread of these viruses or worms by measuring the velocity of the number of new connections an infected host makes. The mechanism{\textquoteright}s objective is to slow down a worm{\textquoteright}s spreading velocity by controlling (delaying) the number of new connections made by an infected host. A proportional and integral (PI) controller is used for a continuous control of the feedback loop. The approach proposed here has been verified in a laboratory setup, and we were able to contain the infection so that it affected less than 5 percent of the hosts. We have also implemented a protocol for exchanging control-specific information between the network elements. The results from the simulation and experimental setup combined with the sensitivity analysis demonstrate the applicability and accuracy of the approach.</p>
},
	keywords = {communication/networking and information technology, computer networks, Computer systems organization, control engineering computing, general, invasive software, network security, network-level security and protection, PI control, process control systems., proportional-integral controller, special-purpose and application-based systems, state feedback, state-space feedback control, state-space methods, telecommunication security, worm containment},
	doi = {10.1109/TDSC.2007.1002},
	author = {Ram Dantu and Cangussu, Jo{\~a}o and Patwardhan, Sudeep}
}
