@conference {576, title = {Adaptive and Predictive SDN Control During DDoS Attacks}, booktitle = {2020 IEEE International Conference on Intelligence and Security Informatics (ISI)}, year = {2020}, abstract = {

While Distributed Denial of Service (DDoS) attacks continue to plague the Internet, Software Defined Networks (SDNs) offer the promise of configuration elasticity for all devices in the plant to mitigate these attacks and stabilize the network in real-time. Since it is difficult to distinguish between legitimate and attack traffic, we propose a closed-loop feedback control mechanism using a multi-loop proportional, integral (PI) controller and a model predictive controller (MPC) that will regulate the system characteristics with disturbance rejection. Results from our setup implemented in the SDN platform show that our dynamic and predictive control models provide for a graceful degradation of real-time services in the SDN environment in real-time.

}, doi = {10.1109/ISI49825.2020.9280542}, author = {Vempati, Jagannadh and Dantu, Ram and Badruddoja, Syed and Thompson, Mark} } @conference {334, title = {Automatic Feedback Control for Graceful Degradation of Real-Time Services in the Face of an Attack}, booktitle = {2018 IEEE 4th International Conference on Collaboration and Internet Computing (CIC)}, year = {2018}, month = {Oct}, abstract = {

Distributed denial of service (DDoS) attacks continue to pose a serious threat to various businesses and consumers. With the growth in the number of devices connected to the internet, these attacks continue to grow in number. Despite the availability of security tools, the attacks continue to happen and are causing various businesses to sweat. These tools may take anywhere from a few hours to a few days to counter the attacks, which is unacceptable. In this paper, we put forth a novel feedback control mechanism to minimize the effect of volumetric attacks such as DDoS. During an attack, the feedback control model detects and reduces the impact of the attack by maintaining the service level agreements (SLA) of the network service. The controller makes intelligent decisions to ensure the quality of service (QoS) metrics are gracefully degraded by tuning the micro-firewall rules such as the committed information rate and burst size. A proportional Integral (PI) controller is used as a closed-loop feedback controller to maintain the stability of the network in spite of an attack. This proposed architecture is verified in a lab setup, and we observe that we are able to minimize the degradation of the real-time service so that the user{\textquoteright}s quality of experience (QoE) is preserved. We validate the proposed architecture with a model generated by using the system identification technique. Results from the setup show that the closed-loop feedback control model stabilizes the network in real-time.

}, keywords = {authorisation, automatic feedback control, closed loop systems, closed-loop feedback control model, Computer crime, computer network management, computer network security, DDoS, Distributed Denial of Service attacks, feedback control, Graceful Degradation, Internet, Mathematical model, network service, Packet loss, PI control, proportional Integral controller, QoE, QoS, quality of experience, quality of service, Real Time Services, real-time service, real-time systems, Resilient, service level agreements, service metrics, SLA, state space, Streaming media, System Identification, volumetric attacks}, doi = {10.1109/CIC.2018.00-37}, author = {Vempati, Jagannadh and Ram Dantu} } @conference {263, title = {Automating ECU Identification for Vehicle Security}, booktitle = {2016 15th IEEE International Conference on Machine Learning and Applications (ICMLA)}, year = {2016}, month = {Dec}, abstract = {

The field of vehicular cybersecurity has received considerable media and research attention in the past few years. Given the increasingly connected aspect of consumer automobiles, along with the inherent danger of these machines, there has been a call for experienced security researchers to contribute towards the vehicle security domain. The proprietary nature of Controller Area Network (CAN) bus messages, however, creates a barrier of entry for those unfamiliar, due to the need to identify what the messages on a given vehicle{\textquoteright}s bus are broadcasting. This work aims to automate the process of correlating CAN bus messages with specific Electronic Control Unit (ECU) functions in a new vehicle, by creating a machine learning classifier that has been trained on a dataset of multiple vehicles from different manufacturers. The results show that accurate classification is possible, and that some ECUs that broadcast similar vehicle dynamics broadcast similar CAN messages.

}, keywords = {Acceleration, automobiles, automotive electronics, automotive security, Brakes, broadcasting, CAN bus, CAN bus messages, classification, consumer automobiles, control engineering computing, controller area network, controller area networks, ECU identification automation, electronic control unit, electronic engineering computing, embedded systems, learning (artificial intelligence), machine learning, machine learning classifier, pattern classification, Protocols, Security, security of data, Training, vehicle bus, vehicular ad hoc networks, vehicular cybersecurity, Wheels}, doi = {10.1109/ICMLA.2016.0111}, author = {Jaynes, Michael and Ram Dantu and Varriale, Roland and Evans, Nathaniel} } @conference {67, title = {Another free app: Does it have the right intentions?}, booktitle = {Privacy, Security and Trust (PST), 2014 Twelfth Annual International Conference on}, year = {2014}, month = {July}, abstract = {

Security and privacy holds a great importance in mobile devices due to the escalated use of smart phone applications (app). This has made the user even more vulnerable to malicious attacks than ever before. We aim to address this problem by proposing a novel framework to identify potential Android malware apps by extracting the intention and their permission requests. First, we constructed a dataset consisting of 1,730 benign apps along with 273 malware samples. Then, both datasets were subjected to source code extraction. From there on, we followed a two phase approach to identify potential malware samples. In phase 1, we constructed a machine learning model to group benign apps into different clusters based on their operations known as the task-intention. Once we trained the model, it was used to identify the task-intention of an Android app. Further, in this phase, we only used the benign apps to construct the task-intentions and none of the malware signatures were involved. Therefore, our approach does not use machine learning models to identify malware apps. Then, for each task-intention group, we extracted the permission-requests of the apps and constructed the probability mass functions (PMF). We named the shape of this PMF as Intention-Shape or I-Shape. In phase 2, we used the permission-requests, task-intentions and I-Shapes to identify potential malware apps. We compared the permission-requests of an unknown app with its corresponding I-Shape to identify the potential malware apps. Using this approach, we obtained an accuracy of 89\% in detecting potential malware samples. The novelty of our work is to perform potential malware identification without training any models with malware signatures, and utilization of I-Shapes to identify such potential malware samples. Our approach can be utilized to identify the safety of an app before it is installed as it performs static code analysis. Further, it can be utilized in pre-screening or multi-layer security sys- ems. It is also highly useful in screening malware apps when launching in Android markets.

}, keywords = {Android app task-intention identification, Android malware apps, Androids, benign apps, clusters, Feature extraction, Humanoid robots, I-Shape, intention-shape, invasive software, learning (artificial intelligence), machine learning model, malicious attacks, Malware, Mathematical model, mobile computing, permission-requests, PMF, probability mass functions, Shape, smart phone applications, smart phones, source code (software), source code extraction, static code analysis, Unsupervised learning}, doi = {10.1109/PST.2014.6890950}, author = {Fazeen, Mohamed and Ram Dantu} } @conference {235, title = {Android Sensor Data Anonymization}, booktitle = {Research in Attacks, Intrusions, and Defenses: 16th International Symposium, RAID 2013, Rodney Bay, St. Lucia, October 23-25, 2013, Proceedings}, year = {2013}, publisher = {Springer}, organization = {Springer}, author = {Claiborne, Cynthia and Fazeen, Mohamed and Ram Dantu} } @conference {57, title = {Are You My Friend?}, booktitle = {Proceedings of the 7th IEEE Conference on Consumer Communications and Networking Conference}, year = {2010}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

With Twitters growing popularity, privacy has become a major concern for users wary of sensitive information falling in the wrong hands. A typical Twitter user carries hundreds of followers - people who have subscribed to users twitter feeds. Our goal is to target followers that a Twitter user deems safe. Therefore, selecting followers with a closer relationship could help decrease the risk of sensitive information being sent to unknown people. We propose a privacy management system that helps a Twitter user restrict information to only certain followers based on the strength of their social tie. This system would incorporate two tools: the Exclusivity meter and the Twitter Response Estimator. The Exclusivity Meter employs user{\textquoteright}s activity profile to guess similarities between users. Preliminary results have indicated that similarity in time and level of activity between user and follower does suggest a stronger social tie. The Twitter Response Estimator uses a measure of prestige to gauge the probability of response. When applied to a set of followers, the estimator separates real friends from recreational followers

}, keywords = {online social network, Privacy, Twitter}, isbn = {978-1-4244-5175-3}, url = {http://dl.acm.org/citation.cfm?id=1834217.1834342}, author = {Baatarjav, Enkh-Amgalan and Amin, Aliasgar and Ram Dantu and Gupta, Nikhil Kant} } @conference {64, title = {Achieving Peer-to-peer Telecommunication Services Through Social Hashing}, booktitle = {Proceedings of the 6th IEEE Conference on Consumer Communications and Networking Conference}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

Although peer-to-peer (P2P) Internet Telephony gains more and more market share, supporting traditional telephony related use cases is an indispensable requirement. However, communication services designed for this purpose are usually traditional circuit-based, and the centralized structure makes it nearly impossible for their deployments in a distributed, unsecure telecommunication environment. This paper proposes an approach for achieving various kinds of communication services on P2P voice over IP (VoIP) systems by building trust and executing supervision through social networks. We present a system architecture design for network topology maintenance and security assurance. Social protocols and social computing are used to study how P2P entities can be efficiently mapped to social networks, and how social functionalities can benefit communication services implementation. To demonstrate the approach feasibility, we exemplify this architecture in P2P VoIP emergency services by using gossiping and membership management techniques. We believe that our proposed approach will be able to support diverse services on P2P VoIP systems with the performance and security guaranteed to compete with centralized telecommunication systems.

}, isbn = {978-1-4244-2308-8}, url = {http://dl.acm.org/citation.cfm?id=1700527.1700582}, author = {Yang, Xiaohui and Ram Dantu and Wijesekera, Duminda} } @article {227, title = {An Architecture for IP-based Next Generation Radio Access Network}, journal = {Fourth-Generation Wireless Networks: Applications and Innovations: Applications and Innovations}, year = {2009}, pages = {61}, author = {Ram Dantu and Guturu, Parthasarathy} } @conference {35, title = {Are You a Safe Driver?}, booktitle = {2009 International Conference on Computational Science and Engineering}, year = {2009}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Washington, DC, USA}, abstract = {

As the world continues to enhance and strengthen its emergency services, mobile phones may be used to aid in safe driving practices and detection of emergencies. To our knowledge, no work has been reported in understanding vehicle motion using accelerometers/compass in cell phones. In this paper, we used the multiple sensors in a Google phone to classify safe versus unsafe driving. In particular, we used breaking distance, acceleration, and deceleration for detecting safe verses unsafe braking. Next, we calculated the displacement in the axis perpendicular to the trajectory of vehicle and used it to classify safe and unsafe lane changes. The direction of the phone with respect to the motion of the vehicle is important during calibration of the above measurements, so we used 2D and 3D rotation matrices for transforming device orientation. Future work includes calibration of braking distance, lane changes, and reliable transformation of phone orientation with respect to trajectory of the vehicle.

}, keywords = {Accelerometer, Android, driving, emergency, mobile phone, orientation, safe, unsafe}, isbn = {978-0-7695-3823-5}, doi = {10.1109/CSE.2009.331}, url = {http://dx.doi.org/10.1109/CSE.2009.331}, author = {Langle, Lonnie and Ram Dantu} } @conference {238, title = {Adequacy of data for characterizing caller behavior}, booktitle = {Proceedings of KDD Inter. Workshop on Social Network Mining and Analysis (SNAKDD}, year = {2008}, author = {Phithakkitnukoon, Santi and Ram Dantu} } @article {85, title = {An Architecture for Automatic and Adaptive Defense}, journal = {Journal of Information Privacy and Security}, volume = {3}, year = {2007}, pages = {37-58}, abstract = {

Network attacks have become so fast that human mitigation cannot cope with security requirements. In addition, attackers have become smarter by creating attacks which mutate themselves to prevent detection. Therefore, defense mechanisms must be automated to keep up with attack speed and adapted to seek out mutations. An architecture to support this trend in defense mechanisms is proposed here. The architecture is based upon three conceptual pillars. First is the use of a multi-feedback loop control to slow down an attack. Second, machine learning concepts are employed to properly distinguish between normal and abnormal e-attack traffic. And, third, trust and reputation levels are determined through social networks. A case study on the application of the proposed architecture to a worm propagation attack provides the initial evidence of the e-attack and applicability of the approach.

}, doi = {10.1080/15536548.2007.10855815}, url = {http://dx.doi.org/10.1080/15536548.2007.10855815}, author = {Ram Dantu and Cangussu, Jo{\~a}o} } @conference {58, title = {Automatic Calibration Using Receiver Operating Characteristics Curves}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Application-level filters, such as e-mail and VoIP spam filters, that analyze dynamic behavior changes are replacing static signature-recognition filters. These application-level filters learn behavior and use that knowledge to filter unwanted requests. Because behavior of a service request{\textquoteright}s participating entities changes rapidly, filters must adapt quickly by using end user{\textquoteright}s preferences about receiving that service request message. Many adaptive filters learn from the participating entities{\textquoteright} behavior; however, none configure themselves automatically to an end user{\textquoteright}s changing tolerance levels. Also, filter administrators cannot manually change the threshold for each service request in real time. Traditional adaptive filters fail when administrators must optimize multiple filter thresholds manually and often. Thus, to improve a filter{\textquoteright}s learning, we must automate its threshold-update process. We propose an automatic threshold-calibration mechanism using Receiver Operating Characteristics (ROC) curves that updates the threshold based on an end user{\textquoteright}s feedback. To demonstrate the mechanism{\textquoteright}s real-time applicability, we integrated it in a Voice over IP (VoIP) spam filter that analyzes incoming Spam over IP Telephony (SPIT) calls. Using this mechanism, we observed good improvement in the VoIP spam filter{\textquoteright}s accuracy. Further, computing and updating the optimum threshold in realtime does not impede the filter{\textquoteright}s temporal performance because we update thresholds after each call{\textquoteright}s completion. Because we reach an optimum threshold for any initial setting, this mechanism works efficiently when we cannot predict end-user behavior. Furthermore, automatic calibration proves efficient when using multiple threshold values.

}, keywords = {adaptive filters, application-level filter learning, automatic threshold-calibration mechanism, behavior, calibration, Computer science, Computer worms, Electronic mail, end user feedback, Filtering, information filtering, information filters, Internet telephony, learning (artificial intelligence), Protocols, receiver operating characteristics curves, sensitivity analysis, service request message, telecommunication traffic, Threshold, tolerance, Viruses (medical)}, doi = {10.1109/COMSWA.2007.382484}, author = {Kolan, Prakash and Vaithilingam, Ram and Ram Dantu} } @conference {73, title = {An Architecture for Network Security Using Feedback Control}, booktitle = {Proceedings of the 2005 IEEE International Conference on Intelligence and Security Informatics}, year = {2005}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Atlanta, GA}, isbn = {3-540-25999-6, 978-3-540-25999-2}, doi = {10.1007/11427995_84}, url = {http://dx.doi.org/10.1007/11427995_84}, author = {Ram Dantu and Cangussu, Jo{\~a}o} }