01794nas a2200193 4500008004100000022001400041245005300055210005300108300001200161490000600173520127900179653001801458653001301476653002001489100001501509700001901524700002001543856003701563 2009 eng d a1939-012200aNetwork risk management using attacker profiling0 aNetwork risk management using attacker profiling a83–960 v23 a

Risk management refers to the process of making decisions that minimize the effects of vulnerabilities on the network hosts. This can be a difficult task in the context of high-exploit probability and the difficult to identify new exploits and vulnerabilities. For many years, security engineers have performed risk analysis using economic models for the design and operation of risk-prone, technological systems using attack profiles. Based on the type of attacker identified, security administrators can formulate effective risk management policies for a network. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs representing all the possible attack paths to all the critical resources. The risk level is computed based on these graphs and are used as a measure of the vulnerability of the resource and forming an effective basis for a system administrator to perform suitable changes to network configuration. Copyright © 2008 John Wiley & Sons, Ltd.

10aattack graphs10abehavior10arisk management1 aDantu, Ram1 aKolan, Prakash1 aCangussu, João uhttp://dx.doi.org/10.1002/sec.5801936nas a2200349 4500008004100000245001700041210001700058260000800075520105100083653001201134653001701146653002701163653002601190653002101216653002101237653001401258653001101272653002301283653001601306653002501322653001901347653000901366653002701375653003301402653001701435653002801452653001801480653001701498100001901515700001501534856003701549 2008 eng d00aCall Algebra0 aCall Algebra cJan3 a

In every day life, people communicate through a voice(e.g., VoIP) network with different social groups that range from known people such as family members, friends, and distant relatives to unknown people such as spammers, telemarketers, and phishers. We believe that there exists a human/social dynamics between individuals by the way calls are generated, handled and received. In this paper we present how this dynamics can be used for detecting and filtering unwanted calls. In this paper, we first enumerate the communication patterns between the called party (callee) and the calling parties (callers). Next, we discuss operations on caller-callee matrices constructed based on their communication patterns, and derive call-constructs that can be used for determining the legitimacy of the calls and the callers. Finally, we discuss how these communication patterns and operations can be grouped for solutions to few of the existing IP telephony problems. These solutions can complement the existing no-call-lists in voice networks.

10aAlgebra10acall algebra10acaller-callee matrices10acommunication pattern10aComputer science10aContext modeling10aFiltering10aHumans10aInternet telephony10aIP networks10aIP telephony problem10amatrix algebra10aMood10aPeer to peer computing10asocial aspects of automation10asocial group10aSocial network services10avoice-over-IP10aVoIP network1 aKolan, Prakash1 aDantu, Ram uhttps://nsl.cse.unt.edu/node/25101661nas a2200241 4500008004100000022001400041245003500055210003500090300001500125490000600140520105900146653001301205653003001218653001301248653001301261653001301274653001401287653001701301100001901318700001501337700002001352856004701372 2008 eng d a1551-685700aNuisance Level of a Voice Call0 aNuisance Level of a Voice Call a6:1–6:220 v53 a

In our everyday life, we communicate with many people such as family, friends, neighbors, and colleagues. We communicate with them using different communication media such as email, telephone calls, and face-to-face interactions. While email is not real-time and face-to-face communications require geographic proximity, voice and video communications are preferred over other modes of communication. However, real-time voice/video calls may create nuisance to the receiver. In this article, we describe a mathematical model for computing nuisance level of incoming voice/video calls. We computed the closeness and nuisance level using the calling patterns between the caller and the callee. To validate the nuisance model, we collected cell phone call records of real-life people at our university and computed the nuisance value for all voice calls. We validated the nuisance levels using the feedback from those real-life people. Such a nuisance model is useful for predicting unwanted voice and video sessions in an IP communication network.

10abehavior10aMultimedia communications10anuisance10apresence10aSecurity10atolerance10aunwantedness1 aKolan, Prakash1 aDantu, Ram1 aCangussu, João uhttp://doi.acm.org/10.1145/1404880.140488602969nas a2200397 4500008004100000245007400041210006900115260000800184520175100192653002101943653003801964653004602002653001302048653001602061653002102077653001902098653002002117653002202137653001402159653002602173653002402199653002302223653003902246653001402285653004602299653002502345653002802370653003002398653001402428653001402442653002202456100001902478700002202497700001502519856003702534 2007 eng d00aAutomatic Calibration Using Receiver Operating Characteristics Curves0 aAutomatic Calibration Using Receiver Operating Characteristics C cJan3 a

Application-level filters, such as e-mail and VoIP spam filters, that analyze dynamic behavior changes are replacing static signature-recognition filters. These application-level filters learn behavior and use that knowledge to filter unwanted requests. Because behavior of a service request's participating entities changes rapidly, filters must adapt quickly by using end user's preferences about receiving that service request message. Many adaptive filters learn from the participating entities' behavior; however, none configure themselves automatically to an end user's changing tolerance levels. Also, filter administrators cannot manually change the threshold for each service request in real time. Traditional adaptive filters fail when administrators must optimize multiple filter thresholds manually and often. Thus, to improve a filter's learning, we must automate its threshold-update process. We propose an automatic threshold-calibration mechanism using Receiver Operating Characteristics (ROC) curves that updates the threshold based on an end user's feedback. To demonstrate the mechanism's real-time applicability, we integrated it in a Voice over IP (VoIP) spam filter that analyzes incoming Spam over IP Telephony (SPIT) calls. Using this mechanism, we observed good improvement in the VoIP spam filter's accuracy. Further, computing and updating the optimum threshold in realtime does not impede the filter's temporal performance because we update thresholds after each call's completion. Because we reach an optimum threshold for any initial setting, this mechanism works efficiently when we cannot predict end-user behavior. Furthermore, automatic calibration proves efficient when using multiple threshold values.

10aadaptive filters10aapplication-level filter learning10aautomatic threshold-calibration mechanism10abehavior10acalibration10aComputer science10aComputer worms10aElectronic mail10aend user feedback10aFiltering10ainformation filtering10ainformation filters10aInternet telephony10alearning (artificial intelligence)10aProtocols10areceiver operating characteristics curves10asensitivity analysis10aservice request message10atelecommunication traffic10aThreshold10atolerance10aViruses (medical)1 aKolan, Prakash1 aVaithilingam, Ram1 aDantu, Ram uhttps://nsl.cse.unt.edu/node/22902241nas a2200313 4500008004100000245008900041210006900130260003100199520128100230653002101511653001801532653001801550653002101568653001301589653002001602653002201622653002001644653002501664653004701689653002001736653001301756653002801769653002701797100001501824700001901839700001601858700001601874856003701890 2007 eng d00aClassification of Attributes and Behavior in Risk Management Using Bayesian Networks0 aClassification of Attributes and Behavior in Risk Management Usi aNew Brunswick, NJc05/20073 a

Security administration is an uphill task to implement in an enterprise network providing secured corporate services. With the slew of patches being released by network component vendors, system administrators require a barrage of tools for analyzing the risk due to vulnerabilities in those components. In addition, criticalities in patching some end hosts raises serious security issues about the network to which the end hosts are connected. In this context, it would be imperative to know the risk level of all critical resources keeping in view the everyday emerging new vulnerabilities. We hypothesize that sequence of network actions by attackers depends on their social and attack profile (behavioral resources such as skill level, time, and attitude). To estimate the types of attack behavior, we surveyed individuals for their ability and attack intent. Using the individuals' responses, we determined their behavioral resources and classified them as having opportunist, hacker, or explorer behavior. The profile behavioral resources can be used for determining risk by an attacker having that profile. Thus, suitable vulnerability analysis and risk management strategies can be formulated to efficiently curtail the risk from different types of attackers.

10aattack behaviour10aattack graphs10aattack intent10aBayesian network10abehavior10abelief networks10aexplorer behavior10ahacker behavior10aopportunist behavior10aprofile behavioral resource classification10arisk management10aSecurity10asecurity administration10avulnerability analysis1 aDantu, Ram1 aKolan, Prakash1 aAkl, Robert1 aLoper, Kall uhttps://nsl.cse.unt.edu/node/22201111nas a2200169 4500008004100000022001400041245003700055210003600092300001200128490000900140520066500149100001500814700002300829700001900852700001800871856005200889 2007 eng d a1353-485800aHIPAA: Securing Medical Networks0 aHIPAA Securing Medical Networks a13–160 v20073 a

The Health Information Portability and Accountability Act of 1996 (HIPAA) imposes strict regulations on healthcare institutions and commercial vendors to indemnify clinical data against unscrupulous users. Security vulnerabilities concerning hospital information systems not only negatively impact patient healthcare, but may also represent a potential federal violation. For a comprehensive understanding of the security of a radiology communication network, a detailed survey of the Picture Archiving and Communication Systems (PACS) was compiled. In this paper, we present survey results and a set of recommendations for implementing PACS security.

1 aDantu, Ram1 aOosterwijk, Herman1 aKolan, Prakash1 aHusna, Husain uhttp://dx.doi.org/10.1016/S1353-4858(07)70055-702897nas a2200205 4500008004100000022001400041245005100055210005000106490000600156520232400162653001302486653001502499653003802514653003402552653001402586653001002600100001902610700001502629856004702644 2007 eng d a1556-466500aSocio-technical Defense Against Voice Spamming0 aSociotechnical Defense Against Voice Spamming0 v23 a

Voice over IP (VoIP) is a key enabling technology for migration of circuit-switched PSTN (Public Switched Telephone Network) architectures to packet-based networks. One problem of the present VoIP networks is filtering spam calls referred to as SPIT (Spam over Internet Telephony). Unlike spam in e-mail systems, VoIP spam calls have to be identified in real time. Many of the techniques devised for e-mail spam detection rely upon content analysis, and in the case of VoIP, it is too late to analyze the content (voice) as the user would have already attended the call. Therefore, the real challenge is to block a spam call before the telephone rings. In addition, we believe it is imperative that spam filters integrate human behavioral aspects to gauge the legitimacy of voice calls. We know that, when it comes to receiving or rejecting a voice call, people use the social meaning of trust, reputation, friendship of the calling party and their own mood. In this article, we describe a multi-stage, adaptive spam filter based on presence (location, mood, time), trust, and reputation to detect spam in voice calls. In particular, we describe a closed-loop feedback control between different stages to decide whether an incoming call is spam. We further propose formalism for voice-specific trust and reputation analysis. We base this formal model on a human intuitive behavior for detecting spam based on the called party’s direct and indirect relationships with the calling party. No VoIP corpus is available for testing the detection mechanism. Therefore, for verifying the detection accuracy, we used a laboratory setup of several soft-phones, real IP phones and a commercial-grade proxy server that receives and processes incoming calls. We experimentally validated the proposed filtering mechanisms by simulating spam calls and measured the filter’s accuracy by applying the trust and reputation formalism. We observed that, while the filter blocks a second spam call from a spammer calling from the same end IP host and domain, the filter needs only a maximum of three calls—even in the case when spammer moves to a new host and domain. Finally, we present a detailed sensitivity analysis for examining the influence of parameters such as spam volume and network size on the filter’s accuracy

10abehavior10areputation10aSIP (Session Initiation Protocol)10aSPIT (Spam over IP Telephony)10atolerance10aTrust1 aKolan, Prakash1 aDantu, Ram uhttp://doi.acm.org/10.1145/1216895.121689701769nas a2200121 4500008004100000245003600041210003600077260004200113520140400155100001501559700001901574856005401593 2005 eng d00aDetecting Spam in VoIP Networks0 aDetecting Spam in VoIP Networks aBerkeley, CA, USAbUSENIX Association3 a

Voice over IP (VoIP) is a key enabling technology for the migration of circuit-switched PSTN architectures to packetbased networks. The problem of spam in VoIP networks has to be solved in real time compared to e-mail systems. Many of the techniques devised for e-mail spam detection rely upon content analysis and in the case of VoIP it is too late to analyze the media after picking up the receiver. So we need to stop the spam calls before the telephone rings. From our observation, when it comes to receiving or rejecting a voice call people use social meaning of trust and reputation of the calling party. In this paper, we describe a multi-stage spam filter based on trust, and reputation for detecting the spam. In particular we used closed loop feedback between different stages in deciding if the incoming call is a spam or not. For verifying the concepts, we used a laboratory setup of several thousand soft-phones and a commercial grade proxy server. We verified our filtering mechanisms by simulating the spam calls and measured the accuracy of the filter. Results show that multistage feedback loop fares better than any single stage. Also, the larger the network size, the harder to detect a spam call. Further work includes understanding the behavior of different controlling parameters in trust and reputation calculations and deriving meaningful relationships between them.

1 aDantu, Ram1 aKolan, Prakash uhttp://dl.acm.org/citation.cfm?id=1251282.125128702129nas a2200133 4500008004100000020003700041245005900078210005900137260003300196520169000229100001501919700001901934856004201953 2005 eng d a3-540-25999-6, 978-3-540-25999-200aRisk Management Using Behavior Based Bayesian Networks0 aRisk Management Using Behavior Based Bayesian Networks aAtlanta, GAbSpringer-Verlag3 a

Security administration is an uphill task to implement in an enterprise network providing secured corporate services. With the slew of patches being released by Microsoft, HP and other vendors, system administrators require a barrage of tools for analyzing the risk due to these vulnerabilities. In addition to this, criticalities in patching some end hosts (eg., in hospitals) raises serious security issues about the network to which the end hosts are connected. In this context, it would be imperative to know the risk level of all critical resources (e.g., Oracle Server in HR department) keeping in view the everyday emerging new vulnerabilities. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs. These graphs represent all the possible attack paths to all the critical resources. Based on these graphs, we calculate the risk level of a critical resource using Bayesian methodology and periodically update the subjective beliefs about the occurrence of an attack. Such a calculated risk level would be a measure of the vulnerability of the resource and it forms an effective basis for a system administrator to perform suitable changes to network configuration. Thus suitable vulnerability analysis and risk management strategies can be formulated to efficiently curtail the risk from different types of attackers (script kiddies, hackers, criminals and insiders).

1 aDantu, Ram1 aKolan, Prakash uhttp://dx.doi.org/10.1007/11427995_1002256nas a2200145 4500008004100000020001800041245005500059210005500114260004700169520179200216100001502008700001602023700001902039856005202058 2004 eng d a0-7695-2108-800aRisk Management Using Behavior Based Attack Graphs0 aRisk Management Using Behavior Based Attack Graphs aWashington, DC, USAbIEEE Computer Society3 a

Security administration is an uphill task to implement inan enterprise network providing secured corporateservices. With the slew of patches being released byMicrosoft, HP and other vendors, system administratorsrequire a barrage of tools for analyzing the risk due tothese vulnerabilities. In addition to this, criticalities inpatching some end hosts (eg., in hospitals) raises serioussecurity issues about the network to which the end hostsare connected. In this context, it would be imperative toknow the risk level of all critical resources (e.g., OracleServer in HR department) keeping in view the everydayemerging new vulnerabilities. We hypothesize thatsequence of network actions by an attacker depends onthe social behavior (e.g., skill level, tenacity, financialability). By verifying our hypothesis on hacker emailcommunications, we extended this methodology andcalculated risk level for a small network. Towards thisgoal, we formulated a mechanism to estimate the risklevel of critical resources that may be compromisedbased on attacker behavior. This estimation isaccomplished using behavior based attack graphs. Thesegraphs represent all the possible attack paths to all thecritical resources. Based on these graphs, we calculatethe risk level of a critical resource using Bayesianmethodology and periodically update the subjectivebeliefs about the occurrence of an attack Such acalculated risk level would be a measure of thevulnerability of the resource and it forms an effectivebasis for a system administrator to perform suitablechanges to network configuration. Thus suitablevulnerability analysis and risk management strategiescan be formulated to efficiently curtail the risk fromdifferent types of attacker (script kiddies, hackers,criminals and insiders).

1 aDantu, Ram1 aLoper, Kall1 aKolan, Prakash uhttp://dl.acm.org/citation.cfm?id=977403.978389