@conference {340, title = {Uninterrupted Video Surveillance in the Face of an Attack}, booktitle = {2018 17th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)}, year = {2018}, month = {Aug}, abstract = {

Distributed denial of service (DDoS) attacks continue to plague businesses and consumers alike, and due to an ever-growing digital landscape, these attacks are expected to grow in size and complexity. Current mitigation techniques ranging from hours to days are completely unacceptable given the cost and inconvenience these attacks place in our society. This paper puts forth three feedback control mechanisms to minimize the effects of DDoS attacks on real-time traffic. The first, called differentiated services code point (DSCP) Markdown, is a passive approach that uses micro firewall rules to lower the priority of out-of-profile packets while a second mechanism actively drops the out-of-profile packets based on rate and burst size parameters. The third technique uses parallel links when feedback is applied to stabilize the network after an attack has been detected. Results from all three techniques have shown to have a positive effect on real-time traffic. The first two approaches were able to stabilize network traffic in real-time, while the parallel links technique resulted in a slight delay. We validate the feedback mechanisms with our model that was generated using the system identification technique. Results show that the feedback architecture provides a fit accuracy with positive results.

}, keywords = {attack mitigation techniques, authorisation, autoregressive processes, burst size parameters, Computer crime, computer network security, DDoS, DDoS attacks, differentiated services code point markdown, DiffServ networks, distributed denial of service attack, DSCP, DSCP Markdown approach, feedback control, feedback mechanisms, Internet, IP networks, Jitter, Mathematical model, micro-firewall, out-of-profile packets, parallel links technique, QoS, quality of service, real-time services, real-time systems, Resilient, Streaming media, system identification technique, uninterrupted video surveillance, video surveillance}, doi = {10.1109/TrustCom/BigDataSE.2018.00121}, author = {Vempati, Jagannadh and Ram Dantu and Thompson, Mark} } @conference {100, title = {Unintentional bugs to vulnerability mapping in Android applications}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

The intention of an Android application, determined by the source code analysis is used to identify potential maliciousness in that application (app). Similarly, it is possible to analyze the unintentional behaviors of an app to identify and reduce the window of vulnerabilities. Unintentional behaviors of an app can be any developmental loopholes such as software bugs overlooked by a developer or introduced by an adversary intentionally. FindBugsTM and Android Lint are a couple of tools that can detect such bugs easily. A software bug can cause many security vulnerabilities (known or unknown) and vice-versa, thus, creating a many-to-many mapping. In our approach, we construct a matrix of mapping between the bugs and the potential vulnerabilities. A software bug detection tool is used to identify a list of bugs and create an empirical list of the vulnerabilities in an app. The many-to-many mapping matrix is obtained by two approaches - severity mapping and probability mapping. These mappings can be used as tools to measure the unknown vulnerabilities and their strength. We believe our study is the first of its kind and it can enhance the security of Android apps in their development phase itself. Also, the reverse mapping matrix (vulnerabilities to bugs) could be used to improve the accuracy of malware detection in Android apps.

}, keywords = {Android (operating system), Android applications, Android Lint, Androids, bugs, Computer bugs, Conferences, development phase, developmental loopholes, FindBugsTM, Humanoid robots, Indexes, invasive software, malware detection, many-to-many mapping matrix, mapping, matrix algebra, probability, probability mapping, program debugging, reverse mapping matrix, Security, security vulnerabilities, severity mapping, Software, software bug detection tool, software bugs, software tools, source code (software), source code analysis, unintentional behavior analysis, unintentional bugs, vulnerability, vulnerability mapping}, doi = {10.1109/ISI.2015.7165966}, author = {Bajwa, Garima and Fazeen, Mohamed and Ram Dantu and Tanpure, Sonal} } @conference {75, title = {Unveiling Hidden Patterns to Find Social Relevance}, booktitle = {Privacy, Security, Risk and Trust (PASSAT) and 2011 IEEE Third Inernational Conference on Social Computing (SocialCom), 2011 IEEE Third International Conference on}, year = {2011}, month = {Oct}, abstract = {

Twitter is both a useful social networking device and an incredible marketing tool. However, it is also a venue for dangerous stalkers and a sub-world of internet users that most people would intuitively avoid if seeing them in real life. It would improve Twitter{\textquoteright}s safety to have filters available which would allow users to select an audience for their status updates without being forced into changing their profiles to a private setting. The hypothetical filter, or model, studied in this paper was based on two particular attributes: activity correlations and vocabulary similarities between users and followers. If implemented, this model would restrict the availability of status updates to an automatically generated group of socially relevant followers. The result of this study shows that both of the attributes can be used to define social relevance, however, it was found that activity patterns have better predictive capabilities than correlating vocabulary usage between users and followers.

}, keywords = {activity correlations, Correlation, dangerous stalkers, data privacy, Facebook, hidden patterns, Internet, Internet users, marketing tool, Online Social Networks, Polynomials, Privacy, social networking (online), social networking device, social relevance, Twitter, Twitter safety, Vocabulary, vocabulary similarities}, doi = {10.1109/PASSAT/SocialCom.2011.103}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu} } @conference {86, title = {Unwanted SMTP Paths and Relays}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Based on the social interactions of an email user, incoming email traffic can be divided into different categories such as, telemarketing, Opt-in family members and friends. Due to a lack of knowledge in the different categories, most of the existing spam filters are prone to high false positives and false negatives. Moreover, a majority of the spammers obfuscate their email content inorder to circumvent the content-based spam filters. However, they do not have access to all the fields in the email header. Our classification method is based on the path traversed by email (instead of content analysis) since we believe that spammers cannot forge all the fields in the email header. We based our classification on three kinds of analyses on the header: i) EndToEnd path analysis, which tries to establish the legitimacy of the path taken by an email and classifies them as either spam or non-spam; ii) Relay analysis, which verifies the trustworthiness of the relays participating in the relaying of emails; iii) Emails wantedness analysis, which measure the recipients wantedness of the senders emails. We use the IMAP message status flags such as, message has been read, deleted, answered, flagged, and draft as an implicit feed back from the user in Emails wantedness analysis. Finally we classify the incoming emails as i) socially close (such as, legitimate emails from family, and friends), ii) socially distinct emails from strangers, iii) spam emails (for example, emails from telemarketers, and spammers) and iv) opt-in emails. Based on the relation between spamminess of the path taken by spam emails and the unwantedness values of the spammers, we classify spammers as i) prospective spammers, ii) suspects, iii) recent spammers and iv) serial spammers. Overall, our method resulted in far less false positives compared to current filters like SpamAssassin. We achieved a precision of 98.65\% which is better than the precisions achieved by SPF and DNSBL blacklists.

}, keywords = {Computer science, content-based spam filters, Counterfeiting, Credit cards, email spam filters, emails wantedness analysis, end-to-end path analysis, Filters, IMAP message status flags, information filtering, information filters, Information security, Legislation, Multimedia communication, relay analysis, Relays, SMTP paths analysis, unsolicited e-mail, Unsolicited electronic mail, Web page design}, doi = {10.1109/COMSWA.2007.382440}, author = {Palla, Srikanth and Ram Dantu} }