@conference {570, title = {Making Blockchain Validators Honest}, booktitle = {2022 Fourth International Conference on Blockchain Computing and Applications (BCCA)}, year = {2022}, abstract = {

The importance of honesty among blockchain validators can not be overemphasized, especially as blockchain is used by many as an underlying technology for the development of various Industry 4.0 solutions. In the blockchain consensus process, validators validate the correctness of transactions and propose new blocks for addition to the blockchain. They are rewarded for this task with the blockchain native token (e.g., ETH on the Ethereum blockchain). This reward is often distributed among validators with respect to their staked amount. An increasing number of validators joining the network leads to a decreasing chance of a validator being chosen for the validation task and thus a reduction in the validation reward. This situation results in some form of competition among the validators, leading them to carry out various malicious actions to influence the blockchain validator selection protocol in order to be chosen. In this paper, we examine the competitive interactions between validators in a blockchain consensus process and propose a model using an infinitely repeated game model that ensures that the validators are deterred from behaving maliciously while also encouraging a self-policing notion due to the extra incentive mechanism of an improved reputation score when a validator can verifiably report malicious activities by others. Further, we discuss the factors that can incentivize or disincentivize a validator to either continue to behave honestly or switch to dishonest behavior.

}, doi = {10.1109/BCCA55292.2022.9921952}, url = {https://ieeexplore.ieee.org/abstract/document/9921952}, author = {Salau, Abiola and Dantu, Ram and Morozov, Kirill and Badruddoja, Syed and Upadhyay, Kritagya} } @conference {575, title = {Making Smart Contracts Predict and Scale}, booktitle = {2022 Fourth International Conference on Blockchain Computing and Applications (BCCA)}, year = {2022}, abstract = {

The machine learning algorithms can predict the events based on the trained models and datasets. However, a reliable prediction requires the model to be trusted and tamper-resistant. Blockchain technology provides trusted output with consensus-based transactions and an immutable distributed ledger. The machine learning algorithms can be trained on blockchain smart contracts to produce trusted models for reliable prediction. But most smart contracts in the blockchain do not support floating-point data type, limiting computations for classification, which can affect the prediction accuracy. In this work, we propose a novel method to produce floating-point equivalent probability estimation to classify labels on-chain with a Naive Bayes algorithm. We derive a mathematical model with Taylor series expansion to compute the ratio of the posterior probability of classes to classify labels using integers. Moreover, we implemented our solution in Ethereum blockchain smart-contract with the Solidity programming language, where we achieved a prediction accuracy comparable to the scikit-learn library in Python. Our derived method is platform-agnostic and can be supported in any blockchain network. Furthermore, machine learning and deep-learning algorithms can borrow the derived method.

}, doi = {10.1109/BCCA55292.2022.9922480}, author = {Badruddoja, Syed and Dantu, Ram and He, Yanyan and Thompson, Mark and Salau, Abiola and Upadhyay, Kritagya} } @conference {572, title = {Smarter Contracts to Predict using Deep-Learning Algorithms}, booktitle = {2022 Fourth International Conference on Blockchain Computing and Applications (BCCA)}, year = {2022}, abstract = {

Deep learning techniques can predict cognitive intelligence from large datasets involving complex computations with activation functions. However, the prediction output needs verification for trust and reliability. Moreover, these algorithms suffer from the model{\textquoteright}s provenance to keep track of model updates and developments. Blockchain smart contracts provide a trustable ledger with consensus-based decisions that assure integrity and verifiability. In addition, the immutability feature of blockchain also supports the provenance of data that can help deep learning algorithms. Nevertheless, smart contract languages cannot predict due to the absence of floating-point operations required by activation functions of neural networks. In this paper, we derive a novel method using the Taylor series expansion to compute the floating-point equivalent output for activation functions. We train the deep learning model off-chain using a standard Python programming language. Moreover, we store models and predict on-chain with blockchain smart contracts to produce a trusted forecast. Our experiment and analysis achieved an accuracy (99\%) similar to popular Keras Python library models for the MNIST dataset. Furthermore, any blockchain platform can reproduce the activation function using our derived method. Last but not least, other deep learning algorithms can reuse the mathematical model to predict on-chain.

}, doi = {10.1109/BCCA55292.2022.9922240}, author = {Badruddoja, Syed and Dantu, Ram and He, Yanyan and Thompson, Mark and Salau, Abiola and Upadhyay, Kritagya} } @conference {503, title = {Towards a Threat Model and Security Analysis for Data Cooperatives}, booktitle = {19th International Conference on Security and Cryptography (SECRYPT 2022)}, year = {2022}, abstract = {

Data cooperative (called {\textquotedblleft}data coop{\textquotedblright} for short) is an emerging approach in the area of secure data management. It promises its users a better protection and control of their data, as compared to the traditional way of their handling by the data collectors (such as governments, big data companies, and others). However, for the success of data coops, existing challenges with respect to data management systems need to be adequately addressed. Especially, they concern terms of security and privacy, as well as the power imbalance between providers/owners and collectors of data. Designing a security and privacy model for a data coop requires a systematic threat modeling approach that identifies the security landscape, attack vectors, threats, and vulnerabilities, as well as the respective mitigation strategies. In this paper, we analyze the security of data cooperatives, identify potential security risks and threats, and suggest adequate countermeasures. We also discuss existing challenges that hinder the widespread adoption of data coops.\ 

}, keywords = {Cybersecurity, Data Cooperatives, Secure Data Management, Security and Privacy., Threat Model}, doi = {10.5220/0011328700003283}, author = {Salau, Abiola and Dantu, Ram and Morozov, Kirill and Upadhyay, Kritagya and Badruddoja, Syed} } @conference {565, title = {Trusted AI with Blockchain to Empower Metaverse}, booktitle = {2022 Fourth International Conference on Blockchain Computing and Applications (BCCA)}, year = {2022}, abstract = {

The digital experience emerging in the virtual world is a reality with the advent of the metaverse. Augmented reality(AR), virtual reality(VR), extended reality(XR), and artificial intelligence(AI) algorithms would pave the way for an immersive experience for the users in the virtual space. However, the explosion of these technologies broaches new challenges to threaten the success of metaverse due to security risks. The blockchain technology augmented with AI promises to deliver a trusted metaverse for everyone. Nevertheless, smart contracts fail to produce a cognitive prediction, dissuading users from confiding in the metaverse. We arm smart contracts with intelligence to predict using AI algorithms. Moreover, we deploy the smart contracts on the Ethereum blockchain platform and produce a prediction accuracy of 95\% compared to Python scikit-learn-based predictions. Our results show that the prediction delay can obstruct the growth of metaverse applications to accept blockchain technologies. Furthermore, the limitation of blockchain technology can make integration unreasonable. Therefore, we discuss possible scalability solutions that can be part of our future work to help more metaverse applications adopt blockchain solutions.

}, doi = {10.1109/BCCA55292.2022.9922027}, author = {Badruddoja, Syed and Dantu, Ram and He, Yanyan and Thompson, Mark and Salau, Abiola and Upadhyay, Kritagya} } @conference {522, title = {Can{\textquoteright}t Understand SLAs? Use the Smart Contract}, booktitle = {2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA)}, year = {2021}, publisher = {IEEE}, organization = {IEEE}, address = {Atlanta, GA, USA}, abstract = {

A Service Level Agreement (SLA) is a special kind of legal contract that binds a vendor to its customers where the vendor commits to provide certain services in exchange for certain payment from the customers. On the other hand, a Smart Contract is a contract that is a computer program that also binds multiple parties into given agreements but is a set of a precise rules and is self-enforceable and self-executable. Since almost all legal contracts are ambiguous by nature and are complex to read and understand, we perform a novel study on how we can replace the traditional vague legal contract with the smart contact and the effect of the ambiguity on the smart contract by performing a thorough analysis on SLAs by measuring their ambiguities in various aspects. We take several samples of real SLAs from six different popular broadband vendors. We use four random SLAs to train the machine learning model to classify and then detect ambiguous words in two unseen SLAs which were the SLAs of Ziply Fiber and Century Link. As different people form different interpretations while reading the ambiguous legal contracts, we generate various human interpretations from the machine detected ambiguous words and convert all those generated interpretations into Smart Contracts to perform testing in Ethereum-based Blockchain to identify the most ambiguous as well as accurate interpretation of the SLA. From our analysis and observation, we were able to find out the most ambiguous interpretation of SLAs and we concluded that the SLA of Ziply Fiber was more ambiguous in general compared to the SLA of Century Link. Moreover, our proposed approach to detect ambiguous terms and to translate an ambiguous legal contract to a smart legal contract using a formal language to measure the degree of ambiguity can be extrapolated and replicated to legal contracts from other types of industries as well.

}, keywords = {ambiguity, ambiguity index, blockchain, clauses, complexity, Ethereum, interpretations, machine learning, service level agreement, SLA, smart contract, smart legal contract}, isbn = {978-1-6654-1623-8}, doi = {10.1109/TPSISA52974.2021.00015}, url = {https://ieeexplore.ieee.org/abstract/document/9750250}, author = {Upadhyay, Kritagya and Dantu, Ram and He, Yanyan and Badruddoja, Syed and Salau, Abiola} } @conference {513, title = {Make Consumers Happy by Defuzzifying the Service Level Agreements}, booktitle = {2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA)}, year = {2021}, publisher = {IEEE}, organization = {IEEE}, address = {Atlanta, GA, USA}, abstract = {

A Service Level Agreement (SLA) is a special kind of legal contract that binds a vendor to its customers where the vendor commits to provide certain services in exchange for certain payments from the customers. However, when customers do not get the services that they have subscribed for, it becomes a laborious job for customers to contact or visit the company and claim the correct amount of compensation or service credits. On the other hand, a Smart Contract is a contract that is a computer program that also binds multiple parties into given agreements but is a set of precise rules and is self-enforceable and self-executable. In this paper, we have introduced a novel work where we use fuzzy logic inside the Ethereum-based smart contract for two significant objectives. The first objective is to make the claim of the compensation easier and faster for customers by translating the SLA into a smart contract. The second objective is to make the smart contract even smarter and intelligent by implementing fuzzy logic so that customers who have a hard time understanding the legal jargon and ambiguities of the legal contract and SLA to find out if the compensation amount they are getting when the service is poor is good enough. Since fuzzy logic models semantics of linguistic expressions by capturing vagueness in the fuzzy sets, it becomes easier to solve the problem of contractual ambiguities and expedite the process of claiming compensation when implemented in a Blockchain-based smart contract.

}, keywords = {ambiguity, blockchain, clauses, complexity, Ethereum, Fuzzy logic, interpretations, service level agreement, SLA, smart contract, smart legal contract}, isbn = {978-1-6654-1623-8}, doi = {10.1109/TPSISA52974.2021.00011}, url = {https://ieeexplore.ieee.org/abstract/document/9750258}, author = {Upadhyay, Kritagya and Dantu, Ram and He, Yanyan and Salau, Abiola and Badruddoja, Syed} } @conference {533, title = {Making Smart Contracts Smarter}, booktitle = {2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)}, year = {2021}, publisher = {IEEE}, organization = {IEEE}, address = {Sydney, Australia}, abstract = {

Blockchain technology develops static smart contracts for decentralized business transactions, lacks dynamic decision-making capabilities that limit the possibilities of ever-increasing demands of modern business applications. Artificial intelligence, a computational prediction platform provides intelligent predictions, actions, and recognition that lacks the ability to hold on to the integrity of the prediction result and requires the help of external authorities to secure the system. Blockchain-based AI prediction can cover the gaps of individual technologies and can mutually benefit from one another to develop a decentralized machine learning architecture that promises to yield better security, automation, and dynamism of the application. This paper proposes a Naive Bayes prediction algorithm to perform prediction with inside blockchain smart contracts that promises to open up more opportunities in the field of Blockchain-AI decentralized applications.

}, keywords = {artificial intelligence, blockchain, DApp, machine learning, Naive Bayes, smart contract}, isbn = {978-1-6654-3578-9}, doi = {10.1109/ICBC51069.2021.9461148}, url = {https://ieeexplore.ieee.org/abstract/document/9461148}, author = {Badruddoja, Syed and Dantu, Ram and He, Yanyan and Upadhayay, Kritagya and Thompson, Mark} } @conference {518, title = {Paradigm Shift from Paper Contracts to Smart Contracts}, booktitle = {2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA)}, year = {2021}, publisher = {IEEE}, organization = {IEEE}, address = {Atlanta, GA, USA}, abstract = {

The ambiguity and complexity of the traditional legal contracts have motivated the study and exploration of a better and advanced contract known as blockchain-based smart contracts. A smart contract is a self-executable contract where the terms of the agreement between the involved parties are directly written into the lines of code that resides in the distributed ledger technology known as the blockchain. Obtaining a better understanding of smart contracts to overcome the fundamental issues of traditional legal contracts is vital for the successful and faster dispute settlement process without the intervention of any third-party mediators like courts, banks, lawyers, etc. In this paper, we present a comprehensive overview of the key features of the paradigm shift from traditional paper contracts to smart contracts. In addition, we also discuss why smart contracts are necessary to be legally enforced and the crucial conditions that are required for them to be legally enforceable. Furthermore, we outline recent trends and emerging technologies such as Natural Language Processing, Machine Learning, and the Internet of Things that have been combined together with smart contracts.

}, keywords = {ambiguity, artificial intelligence, blockchain, electronic contract, enforceability, Ethereum, interpretations, smart contract, traditional legal contract}, isbn = {978-1-6654-1623-8}, doi = {10.1109/TPSISA52974.2021.00029}, url = {https://ieeexplore.ieee.org/abstract/document/9750226}, author = {Upadhyay, Kritagya and Dantu, Ram and He, Yanyan and Salau, Abiola and Badruddoja, Syed} } @conference {576, title = {Adaptive and Predictive SDN Control During DDoS Attacks}, booktitle = {2020 IEEE International Conference on Intelligence and Security Informatics (ISI)}, year = {2020}, abstract = {

While Distributed Denial of Service (DDoS) attacks continue to plague the Internet, Software Defined Networks (SDNs) offer the promise of configuration elasticity for all devices in the plant to mitigate these attacks and stabilize the network in real-time. Since it is difficult to distinguish between legitimate and attack traffic, we propose a closed-loop feedback control mechanism using a multi-loop proportional, integral (PI) controller and a model predictive controller (MPC) that will regulate the system characteristics with disturbance rejection. Results from our setup implemented in the SDN platform show that our dynamic and predictive control models provide for a graceful degradation of real-time services in the SDN environment in real-time.

}, doi = {10.1109/ISI49825.2020.9280542}, author = {Vempati, Jagannadh and Dantu, Ram and Badruddoja, Syed and Thompson, Mark} } @conference {538, title = {Integrating DOTS With Blockchain Can Secure Massive IoT Sensors}, booktitle = {2020 IEEE International Parallel and Distributed Processing Symposium Workshops (IPDPSW)}, year = {2020}, publisher = {IEEE}, organization = {IEEE}, address = {New Orleans, LA, USA}, abstract = {

This paper presents a novel approach to securing IoT devices by leveraging DDoS Open Threat Signaling (DOTS) architecture on a Blockchain framework. Like many areas of the information technology domain, IoT sensors are also prone to attacks but on a larger scale. There are millions of devices being connected to a central domain to provide different types of services. Since these low-powered IoT devices have constrained technical requirements with less computational capabilities, they lack the capacity to judge their behavior as benign or malignant. IoT relies heavily on the higher level of intelligent nodes to decide on their status. An IoT Controller/Edge server handles the registration and the limited management of devices. Since traditional security is unable to protect the IoT environment sufficiently, we present a Blockchain-based DDoS detection approach to secure and mitigate such attacks in the IoT environment. Our test setup includes dataset from four sensors over two months. These values were tested using a threshold calculation against the variation of temperature, humidity, pressure, and wind direction on that day to find out whether an IoT sensor is under a DDoS attack. Our results show how DOTS can help in detection of attack when mapped on IoT edge computing.

}, keywords = {blockchain, Cybersecurity, DDOS Protection, distributed ledger, Edge Computing, IoT, Smart Contracts}, isbn = {978-1-7281-7445-7}, doi = {10.1109/IPDPSW50202.2020.00156}, url = {https://ieeexplore.ieee.org/abstract/document/9150345}, author = {Badruddoja, Syed and Dantu, Ram and Widick, Logan and Zaccagni, Zachary and Upadhyay, Kritagya} } @conference {547, title = {Is your legal contract ambiguous? Convert to a smart legal contract}, booktitle = {2020 IEEE International Conference on Blockchain (Blockchain)}, year = {2020}, publisher = {IEEE}, organization = {IEEE}, abstract = {

A legal contract is something that is in spoken or in written form, which binds a party or multiple parties into given terms and conditions. On the other hand, a smart contract is also a contract which is a computer program that binds parties into given terms and conditions but unlike a legal contract, it is self-executable, efficient, and unambiguous. Almost all legal contracts are complex while reading because of its ambiguous nature. In this paper, we take a real-world ambiguous legal contact as a test contract, and generate various interpretations from it, convert all those interpretations into the smart legal contracts and identify the most ambiguous and accurate smart legal contract by performing various measurements such as transaction fees and ambiguity index for each interpretation. We came to the conclusion that the most ambiguous legal contract would be the contract with general interpretation as it was more complex when written in the smart contract and had many possible interpretations due to ambiguity than the rest of the interpretations.

}, author = {Upadhyay, Kritagya and Dantu, Ram and Zaccagni, Zachary and Badruddoja, Syed} } @conference {397, title = {CMCAP: Ephemeral Sandboxes for Adaptive Access Control}, booktitle = {Proceedings of the 24th ACM Symposium on Access Control Models and Technologies}, year = {2019}, publisher = {ACM}, organization = {ACM}, address = {New York, NY, USA}, keywords = {adaptive access control, ephemeral sandboxes, information flow control, intrusion prevention, runtime containment}, isbn = {978-1-4503-6753-0}, doi = {10.1145/3322431.3325414}, url = {http://doi.acm.org/10.1145/3322431.3325414}, author = {Bucuti, Theogene and Dantu, Ram and Morozov, Kirill} } @article {415, title = {Detecting driver distraction using stimuli-response EEG analysis}, journal = {CoRR}, volume = {abs/1904.09100}, year = {2019}, url = {http://arxiv.org/abs/1904.09100}, author = {Bajwa, Garima and Fazeen, Mohamed and Dantu, Ram} } @article {261, title = {Real-Time Mobile Device-Assisted Chest Compression During Cardiopulmonary Resuscitation}, journal = {American Journal of Cardiology}, volume = {120}, year = {2017}, pages = {196 - 200}, isbn = {0002-9149}, url = {http://dx.doi.org/10.1016/j.amjcard.2017.04.007}, author = {Sarma, Satyam and Bucuti, Hakiza and Chitnis, Anurag and Klacman, Alex and Ram Dantu} } @article {94, title = {Neurokey: towards a new paradigm of cancelable biometrics-based key generation using electroencephalograms}, journal = {Computers \& Security}, year = {2016}, pages = {-}, abstract = {

\ Brain waves (Electroencephalograms, EEG) can provide conscious, continuous human authentication for the proposed system. The advantage of brainwave biometry is that it is nearly impossible to forge or duplicate as the neuronal activity of each person is unique even when they think about the same thing.

We propose exploiting the brain as a biometric physical unclonable function (PUF). A user{\textquoteright}s \{EEG\} signals can be used to generate a unique and repeatable key that is resistant to cryptanalysis and eavesdropping, even against an adversary who obtains all the information regarding the system. Another objective is to implement a simplistic approach of cancelable biometrics by altering one{\textquoteright}s thoughts.

Features for the first step, Subject Authentication, are obtained from each task using the energy bands obtained from Discrete Fourier Transform and Discrete Wavelet Transform. The second step constituting the Neurokey generation involves feature selection using normalized thresholds and segmentation window protocol.

We applied our methods to two datasets, the first based on five mental activities by seven subjects (325 samples) and the second based on three visually evoked tasks by 120 subjects (10,861 samples). These datasets were used to analyze the key generation process because they varied in the nature of data acquisition, environment, and activities. We determined the feasibility of our system using a smaller dataset first. We obtained a mean subject classification of 98.46\% and 91.05\% for Dataset I and Dataset {\.I}I\} respectively. After an appropriate choice of features, the mean half total error rate for generating Neurokeys was 3.05\% for Dataset I and 4.53\% for Dataset II, averaged over the subjects, tasks, and electrodes. A unique key was established for each subject and task, and the error rates were analyzed for the Neurokey generation protocol. \{NIST\} statistical suite of randomness tests were applied on all the sequences obtained from the Neurokey generation process.

A consistent, unique key for each subject can be obtained using \{EEG\} signals by collecting data from distinguishable cognitive activities. Moreover, the Neurokey can be changed easily by performing a different cognitive task, providing a means to change the biometrics in case of a compromise (cancelable).

}, keywords = {Authentication, biometrics, cryptographic keys, cryptography, electroencephalograms, key generation, Security}, issn = {0167-4048}, doi = {http://dx.doi.org/10.1016/j.cose.2016.06.001}, url = {http://www.sciencedirect.com/science/article/pii/S0167404816300669}, author = {Bajwa, Garima and Ram Dantu} } @conference {88, title = {A framework for secured collaboration in mHealth}, booktitle = {Collaboration Technologies and Systems (CTS), 2015 International Conference on}, year = {2015}, month = {06/2015}, abstract = {

We have designed a novel framework of services, protocols and technologies to ensure the secure collaboration in M2M networks, specifically in mobile health. The promise of mobile health to reform preventive self-care opens new doors for remote monitoring to improve health care communication. With cardiopulmonary resuscitation (CPR) as an example, we classify our M2M elements into services, roles, human-computer protocols and technologies through which we require trust, anonymity, scalability, and active detachment. We simulate a scenario in which a patient needs CPR and through the use of widely available technologies (such as a smartphone and secure web sockets) we demonstrate a technological collaboration that facilitates secure emergency mobile health services.

}, keywords = {cardiology, cardiopulmonary resuscitation, Cardiopulmonary resuscitation(CPR), Collaboration, Computers, CPR, health care, health care communication, human computer interaction, human-computer protocol, M2M network, machine to machine(M2M), Medical services, mHealth, Mobile communication, mobile computing, mobile health, Protocols, remote monitoring, Scalability, secure collaboration, secure emergency mobile health services, secured collaboration, security of data, servers, smart phones, smartphone}, doi = {10.1109/CTS.2015.7210450}, author = {Widick, Logan and Talkington, Josh and Bajwa, Garima and Ram Dantu} } @conference {107, title = {An opportunistic encryption extension for the DNS protocol}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

Confidentiality for DNS transactions has been a low-priority concern in DNS security for a long time due to performance requirements for the functionality of DNS and the fact that data in the DNS is considered public. However, the information carried in DNS transactions, if collected and analyzed, can pose real threats to personal privacy. This makes DNS a good target for passive eavesdropping to collect data for many purposes some of which may be malicious. The protocol described in this document is intended to facilitate an opportunistic negotiation of encryption in the DNS to provide confidentiality for the last mile of DNS resolution. It defines procedures to discover encryption-aware servers and how to establish a relationship with them with minimum overhead.

}, keywords = {computer network security, cryptographic protocols, DNS protocol, DNS security, DNS transactions, encryption, Internet, opportunistic encryption extension, passive eavesdropping, performance requirements, personal privacy, pose real threats, Privacy, Protocols, Public key, servers}, doi = {10.1109/ISI.2015.7165976}, author = {Bucuti, Theogene and Ram Dantu} } @conference {233, title = {Pass-pic: A mobile user authentication}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

Conventional authentication methods utilizing alphanumeric username and passwords, PIN numbers, or any combination thereof have many weaknesses. On modern smart phones there are multiple ways users can authenticate. The traditional username password combination is used often as well as PIN passwords and pattern based passwords. The problem with these methods is that they are still vulnerable. A short password or to a much greater extent a PIN, or a pattern password can be defeated by various techniques such as smudge attacks, key loggers and so on. Our aim with Pass-Pic is to implement a picture based authentication system that is both more secure and easier for the user to both input and remember.

}, keywords = {alphanumeric username, Authentication, key loggers, Keyboards, message authentication, mobile authentication, Mobile communication, mobile user authentication, pass-pic, passwords, pattern based passwords, picture based authentication system, PIN numbers, Random access memory, Security, smart phones, smudge attacks, Vibrations}, doi = {10.1109/ISI.2015.7165977}, author = {Bajwa, Garima and Ram Dantu and Aldridge, Ryan} } @conference {271, title = {PhD Forum: A System Identification Approach to Monitoring Network Traffic Security}, booktitle = {2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing}, year = {2015}, month = {Nov}, abstract = {

Network security is a growing area of interest for cyber systems, especially given the increasing number of attacks on companies each year. Though there are a vast amount of tools already available, System Identification (SI) complements intrusion detection systems to help manage network traffic stability. SI is the science of building mathematical models of dynamic systems. This paper introduces the use of SI for modeling network traffic and utilizes a linear time invariant model to analyze performance of real connections and attack instances. We generated several ARX models where each represented a different threat state in the network. We utilized the KDD CUP 1999{\textquoteright}s DARPA dataset to analyze the performance when dealing with different attacks. Results show that the average model fit was 84.14\% when determining if the system was experiencing normal traffic. This value is promising because it shows how well the system is able to determine a network state in a given time when fed input.

}, keywords = {ARX, ARX model, autoregressive processes, Computational modeling, computer network security, Computer security, cyber system, dynamic system, Electronic mail, intrusion detection system, linear time invariant model, Mathematical model, Models, network traffic security, network traffic stability, Predictive models, Security, Silicon, System Identification, system identification approach, telecommunication traffic}, doi = {10.1109/CSCloud.2015.85}, author = {Mayo, Quentin and Bryce, Renee and Ram Dantu} } @article {231, title = {Quantifying Dynamic Cerebral Autoregulation using Electroencephalograms}, volume = {96}, year = {2015}, pages = {e69}, doi = {10.1016/j.apmr.2015.08.231}, author = {Bajwa, Garima and Ram Dantu and Nana, Arvind} } @conference {100, title = {Unintentional bugs to vulnerability mapping in Android applications}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

The intention of an Android application, determined by the source code analysis is used to identify potential maliciousness in that application (app). Similarly, it is possible to analyze the unintentional behaviors of an app to identify and reduce the window of vulnerabilities. Unintentional behaviors of an app can be any developmental loopholes such as software bugs overlooked by a developer or introduced by an adversary intentionally. FindBugsTM and Android Lint are a couple of tools that can detect such bugs easily. A software bug can cause many security vulnerabilities (known or unknown) and vice-versa, thus, creating a many-to-many mapping. In our approach, we construct a matrix of mapping between the bugs and the potential vulnerabilities. A software bug detection tool is used to identify a list of bugs and create an empirical list of the vulnerabilities in an app. The many-to-many mapping matrix is obtained by two approaches - severity mapping and probability mapping. These mappings can be used as tools to measure the unknown vulnerabilities and their strength. We believe our study is the first of its kind and it can enhance the security of Android apps in their development phase itself. Also, the reverse mapping matrix (vulnerabilities to bugs) could be used to improve the accuracy of malware detection in Android apps.

}, keywords = {Android (operating system), Android applications, Android Lint, Androids, bugs, Computer bugs, Conferences, development phase, developmental loopholes, FindBugsTM, Humanoid robots, Indexes, invasive software, malware detection, many-to-many mapping matrix, mapping, matrix algebra, probability, probability mapping, program debugging, reverse mapping matrix, Security, security vulnerabilities, severity mapping, Software, software bug detection tool, software bugs, software tools, source code (software), source code analysis, unintentional behavior analysis, unintentional bugs, vulnerability, vulnerability mapping}, doi = {10.1109/ISI.2015.7165966}, author = {Bajwa, Garima and Fazeen, Mohamed and Ram Dantu and Tanpure, Sonal} } @conference {74, title = {Context-aware Multimedia Encryption in Mobile Platforms}, booktitle = {Proceedings of the 9th Annual Cyber and Information Security Research Conference}, year = {2014}, publisher = {ACM}, organization = {ACM}, address = {New York, NY, USA}, abstract = {

Voice over IP (VoIP) is a part of multimedia content and this communication is growing rapidly in portable devices due to its attractive features. Secure communication is critical as most of such communications are routed through public channels. Establishing secure VoIP communication is computationally expensive. Modern high strength encryption algorithms such as AES, RSA, Serpent, etc. need high computational power for encryption. On the mobile platform this is a significant factor due to its constrained power resources. In this work we are presenting a novel idea of encrypting VoIP speech data while conserving resources without compromising the security of the VoIP communication. First, the algorithm detects the content of the speech data and identifies its context. Then sensitive sections of the conversation are separated. In the last step, these sections are encrypted with a high strength cryptographic algorithm while other parts are encrypted with a less strength algorithm for better performance. In this way unnecessary encryption power is spared. This will conserve computational power while ensuring the security of sensitive information. Also, we discuss some of the crucial potential attack vectors and their defense mechanisms. Finally, we implemented a prototype to test our concept and we observed an average of 39\% reduction in computational time.

}, keywords = {Android, context-aware, encryption, speech recognition, VoIP}, isbn = {978-1-4503-2812-8}, doi = {10.1145/2602087.2602115}, url = {http://doi.acm.org/10.1145/2602087.2602115}, author = {Fazeen, Mohamed and Bajwa, Garima and Ram Dantu} } @conference {87, title = {Cerebral Autoregulation Assessment Using Electroencephalograms}, booktitle = {Proceedings of the 8th International Conference on Body Area Networks}, year = {2013}, publisher = {ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering)}, organization = {ICST (Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering)}, address = {ICST, Brussels, Belgium, Belgium}, abstract = {

This paper presents the possibility of using Electroencephalograms (EEG) signals of an individual for quantitative interpretation of Cerebral Autoregulation (CA). EEG data was recorded during arm cuff inflation to induce dynamic changes in arterial blood pressure and then, Cerebral Blood Flow (CBF) was estimated from EEG using canonical hemodynamic response function (HRF). The assessment of CA was carried out by using power of the various frequency bands of EEG signal.

}, keywords = {Blood pressure, cerebral autoregulation, cerebral blood flow, electroencephalograms}, isbn = {978-1-936968-89-3}, doi = {10.4108/icst.bodynets.2013.253703}, url = {http://dx.doi.org/10.4108/icst.bodynets.2013.253703}, author = {Bajwa, Garima and Ram Dantu} } @conference {217, title = {NFC Based Two-Pass Mobile Authentication}, booktitle = {Research in Attacks, Intrusions, and Defenses: 16th International Symposium, RAID 2013, Rodney Bay, St. Lucia, October 23-25, 2013, Proceedings}, year = {2013}, publisher = {Springer}, organization = {Springer}, author = {Vempati, Jagannadh and Bajwa, Garima and Ram Dantu} } @booklet {234, title = {Self-Tracking via Brain-Mobile-Cloud Interface}, year = {2013}, abstract = {

Abnormalities in the brain are one of the leading causes of disability amongst people. There is a significant delay between monitoring the onset of these disorders and their treatments. This paper presents a brain-mobile-cloud interface (BMCI) to integrate the mobile platform, cloud computing technology and existing brain monitoring systems to remotely monitor the brain signals of an individual using their electroencephalograms (EEGs) in unconventional environments. Further, we discuss the potential of our proposed framework in applications like tracking mental activities, identifying distracted driving behavior and their corresponding changes in cerebral blood flow (CBF).

}, keywords = {Cerebral Blood Flow (CBF), Electroencephalography (EEG), Mobile cloud Interface, smart phone}, url = {http://www.aaai.org/ocs/index.php/SSS/SSS13/paper/view/5803}, author = {Bajwa, Garima and Ram Dantu and Fazeen, Mohamed and Joseph, Rajiv} } @article {8, title = {Safe Driving Using Mobile Phones}, journal = {Trans. Intell. Transport. Sys.}, year = {2012}, abstract = {

As vehicle manufacturers continue to increase their emphasis on safety with advanced driver-assistance systems (ADASs), we propose a device that is not only already in abundance but portable enough as well to be one of the most effective multipurpose devices that are able to analyze and advise on safety conditions. Mobile smartphones today are equipped with numerous sensors that can help to aid in safety enhancements for drivers on the road. In this paper, we use the three-axis accelerometer of an Android-based smartphone to record and analyze various driver behaviors and external road conditions that could potentially be hazardous to the health of the driver, the neighboring public, and the automobile. Effective use of these data can educate a potentially dangerous driver on how to safely and efficiently operate a vehicle. With real-time analysis and auditory alerts of these factors, we can increase a driver{\textquoteright}s overall awareness to maximize safety.

}, keywords = {Accelerometer, mobile phone, road conditions, sensors, vehicle safety}, doi = {10.1109/TITS.2012.2187640}, url = {http://dx.doi.org/10.1109/TITS.2012.2187640}, author = {Fazeen, Mohamed and Gozick, Brandon and Ram Dantu and Bhukhiya, Moiz and Gonz{\'a}lez, Marta C.} } @conference {101, title = {Current and Future Trends in Social Media}, booktitle = {2011 IEEE Third Int{\textquoteright}l Conference on Privacy, Security, Risk and Trust and 2011 IEEE Third Int{\textquoteright}l Conference on Social Computing}, year = {2011}, abstract = {

Social networking has been the biggest cultural shift since the industrial revolution, attracting millions of people, creating an ever-expanding social web, and revolutionizing the way we communicate. Although many changes have occurred since the fledgling steps of social networking and what it has evolved into today, improvement is a never-ending cycle. Thus, in this paper, additional methods will be explored to advance social networking overall.

}, keywords = {Buildings, Electronic mail, Facebook, Media, Online Social Networks, Privacy, Social Media, Social Network Trends, Twitter}, doi = {10.1109/PASSAT/SocialCom.2011.125}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu} } @conference {21, title = {Evaluation of gyroscope-embedded mobile phones}, booktitle = {Systems, Man, and Cybernetics (SMC), 2011 IEEE International Conference on}, year = {2011}, address = {Anchorage, AK}, abstract = {

Many mobile phone applications such as pedometers and navigation systems rely on orientation sensors that most smartphones are now equipped with. Unfortunately, these sensors rely on measured accelerometer and magnetic field data to determine the orientation. Thus, accelerations upon the phone which arise from everyday use alter orientation information. Similarly, external magnetic interferences from indoor/urban settings affect the heading calculation, resulting in inaccurate directional information. The inability to determine the orientation during everyday use inhibits many potential mobile applications development. In this work, we exploit the newly built-in gyroscope in the Nexus S smartphone to address the interference problems associated with the orientation sensor. We first perform drift error analysis and apply this to gyroscope calculations. We test simple as well as complex rotations seen in walking applications. We lastly test the gyroscope{\textquoteright}s resistance to described interferences. Experiments show angular calculations with percent error no larger than 6\% from actual rotated values. Further, we are able to determine the phone{\textquoteright}s orientation at any time, in magnetically-interfered areas, with the phone accelerating. With this accurate information we can virtually orient the phone to better use mobile-acquired data. This shows that the presence of a gyroscope in smartphones will certainly aid in numerous applications.

}, keywords = {Acceleration, Accelerometer, Accelerometers, Angular rotation, Gyroscope, Gyroscopes, Magnetic sensors, Mobile communication, Mobile handsets, mobile phone, Orientation sensor}, isbn = {978-1-4577-0652-3}, doi = {10.1109/ICSMC.2011.6083905}, author = {Barthold, Christopher and Subbu, Kalyan and Ram Dantu} } @conference {75, title = {Unveiling Hidden Patterns to Find Social Relevance}, booktitle = {Privacy, Security, Risk and Trust (PASSAT) and 2011 IEEE Third Inernational Conference on Social Computing (SocialCom), 2011 IEEE Third International Conference on}, year = {2011}, month = {Oct}, abstract = {

Twitter is both a useful social networking device and an incredible marketing tool. However, it is also a venue for dangerous stalkers and a sub-world of internet users that most people would intuitively avoid if seeing them in real life. It would improve Twitter{\textquoteright}s safety to have filters available which would allow users to select an audience for their status updates without being forced into changing their profiles to a private setting. The hypothetical filter, or model, studied in this paper was based on two particular attributes: activity correlations and vocabulary similarities between users and followers. If implemented, this model would restrict the availability of status updates to an automatically generated group of socially relevant followers. The result of this study shows that both of the attributes can be used to define social relevance, however, it was found that activity patterns have better predictive capabilities than correlating vocabulary usage between users and followers.

}, keywords = {activity correlations, Correlation, dangerous stalkers, data privacy, Facebook, hidden patterns, Internet, Internet users, marketing tool, Online Social Networks, Polynomials, Privacy, social networking (online), social networking device, social relevance, Twitter, Twitter safety, Vocabulary, vocabulary similarities}, doi = {10.1109/PASSAT/SocialCom.2011.103}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu} } @conference {57, title = {Are You My Friend?}, booktitle = {Proceedings of the 7th IEEE Conference on Consumer Communications and Networking Conference}, year = {2010}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

With Twitters growing popularity, privacy has become a major concern for users wary of sensitive information falling in the wrong hands. A typical Twitter user carries hundreds of followers - people who have subscribed to users twitter feeds. Our goal is to target followers that a Twitter user deems safe. Therefore, selecting followers with a closer relationship could help decrease the risk of sensitive information being sent to unknown people. We propose a privacy management system that helps a Twitter user restrict information to only certain followers based on the strength of their social tie. This system would incorporate two tools: the Exclusivity meter and the Twitter Response Estimator. The Exclusivity Meter employs user{\textquoteright}s activity profile to guess similarities between users. Preliminary results have indicated that similarity in time and level of activity between user and follower does suggest a stronger social tie. The Twitter Response Estimator uses a measure of prestige to gauge the probability of response. When applied to a set of followers, the estimator separates real friends from recreational followers

}, keywords = {online social network, Privacy, Twitter}, isbn = {978-1-4244-5175-3}, url = {http://dl.acm.org/citation.cfm?id=1834217.1834342}, author = {Baatarjav, Enkh-Amgalan and Amin, Aliasgar and Ram Dantu and Gupta, Nikhil Kant} } @conference {53, title = {BBN-based Privacy Management System for Facebook}, booktitle = {Proceedings of the 2009 IEEE International Conference on Intelligence and Security Informatics}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

Online social networking sites (SNSs) has changed our lifestyle and become a main medium of communication among young adults to stay in touch with their friends, to organize events, to make friends, to promote themselves, to date, etc. To create content rich environment, SNSs make their platform available for third-party developers. The developers can build their applications based on users{\textquoteright} social graph containing their personal and social information. Unfortunately, any information users posted on their profile can be harvested and used for unethical purposes due to Facebook{\textquoteright}s lack of application privacy configuration. In this paper we propose a privacy-management system for Facebook applications. The system can take advantage of the correlation between some profile features and network privacy settings, in this way it can automatically configure a users privacy settings. Our preliminary result show promising result.

}, isbn = {978-1-4244-4171-6}, url = {http://dl.acm.org/citation.cfm?id=1706428.1706467}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu and Tang, Yan and Cangussu, Jo{\~a}o} } @inbook {12, title = {Group Recommendation System for Facebook}, booktitle = {On the Move to Meaningful Internet Systems: OTM 2008 Workshops, Monterrey, Mexico, November 9-14, 2008. Proceedings}, year = {2008}, pages = {211{\textendash}219}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Berlin, Heidelberg}, abstract = {

Online social networking has become a part of our everyday lives, and one of the popular online social network (SN) sites on the Internet is Facebook, where users communicate with their friends, join to groups, create groups, play games, and make friends around the world. Also, the vast number of groups are created for different causes and beliefs. However, overwhelming number of groups in one category causes difficulties for users to select a right group to join. To solve this problem, we introduce group recommendation system (GRS) using combination of hierarchical clustering technique and decision tree. We believe that Facebook SN groups can be identified based on their members{\textquoteright} profiles. Number of experiment results showed that GRS can make 73\% accurate recommendation.

}, keywords = {decision tree, recommendation system, Social network}, isbn = {978-3-540-88875-8}, doi = {10.1007/978-3-540-88875-8_41}, url = {http://dx.doi.org/10.1007/978-3-540-88875-8_41}, author = {Baatarjav, Enkh-Amgalan and Phithakkitnukoon, Santi and Ram Dantu}, editor = {Meersman, Robert and Tari, Zahir and Herrero, Pilar} } @conference {30, title = {Privacy Management for Facebook}, booktitle = {4th International Conference on Information Systems Security (ICISS 2008)}, year = {2008}, month = {12/2008}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Hyderabad, India}, abstract = {

As more people adopt the Internet as a medium of communication, the Internet has developed into a virtual world and this has resulted in many online social networks (SN). MySpace and Facebook, two leading online SN sites, have a combined user base of 170 million as of 2008. SN sites started to offer developers open platforms that provide users{\textquoteright} profile information to the developers. Unfortunately, the applications can also be used to invade privacy and to harvest the users{\textquoteright} profile information without their acknowledgement. To address this vulnerability, we propose a privacy-management system that protects the accessibility of users{\textquoteright} profile. The system uses probabilistic approach based on information revelation of users. Our experimental result shows that the system can achieve high accuracy rate of 75\%.

}, keywords = {Facebook, Privacy, Privacy management, Social network}, doi = {10.1007/978-3-540-89862-7\_23}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu and Phithakkitnukoon, Santi} } @conference {60, title = {Quantifying presence using calling patterns}, booktitle = {Communication Systems Software and Middleware and Workshops, 2008. COMSWARE 2008. 3rd International Conference on}, year = {2008}, month = {Jan}, abstract = {

Presence technology is going to be an integral part of the next generation of communication technology. It can eliminate telephone tag between two parties (caller and callee), which will increase productivity of the parties and reduce unnecessary bandwidth usage of unwanted calls. In this paper, we propose a Willingness Estimator that computes willingness level of a callee for receiving calls from a specified caller. By knowing the willingness value of the callee the caller can decide on proceeding with the call or not. The proposed Willingness Estimator is tested with real mobile user data, and these results are highly accurate. We measure willingness based on calling patterns (arrival time, location, day) of a caller to a callee and this could serve as one of the future presence based services. The results can be used in telecommunication networks such as PSTN, Cellular networks, and Voice over IP networks.

}, keywords = {cellular networks, Communications technology, Computer science, Computer security, Intrusion detection, Laboratories, Mobile handsets, mobile user data, Network servers, next generation communication, Next generation networking, presence technology, Productivity, PSTN, telecommunication networks, telephony, user calling pattern, voice over IP networks, willingness estimator}, doi = {10.1109/COMSWA.2008.4554403}, author = {Husna, Husain and Phithakkitnukoon, Santi and Baatarjav, Enkh-Amgalan and Ram Dantu} } @article {43, title = {VoIP Security: Attacks and Solutions}, journal = {Information Security Journal: A Global Perspective}, volume = {17}, year = {2008}, pages = {114{\textendash}123}, abstract = {

Voice over IP (VoIP) technology is being extensively and rapidly deployed. Flexibility and cost efficiency are the key factors luring enterprises to transition to VoIP. Some security problems may surface with the widespread deployment of VoIP. This article presents an overview of VoIP systems and its security issues. First, we briefly describe basic VoIP architecture and its fundamental differences compared to PSTN. Next, basic VoIP protocols used for signaling and media transport, as well as defense mechanisms are described. Finally, current and potential VoIP attacks along with the approaches that have been adopted to counter the attacks are discussed.

}, keywords = {attack, defense mechanism, PSTN, Security, VoIP}, issn = {1939-3555}, doi = {10.1080/19393550802308618}, url = {http://dx.doi.org/10.1080/19393550802308618}, author = {Phithakkitnukoon, Santi and Ram Dantu and Baatarjav, Enkh-Amgalan} } @article {194, title = {Signaling System 7 (SS7) Message Transfer Part 2 (MTP2) - User Peer-to-Peer Adaptation Layer (M2PA)}, year = {2005}, author = {George, Tom and Bidulock, Brian and Ram Dantu and Schwarzbauer, Hanns and Morneault, Ken} } @article {229, title = {Requirements for Separation of IP Control and Forwarding}, year = {2003}, month = {11/2003}, publisher = {RFC Editor}, abstract = {

This document introduces the Forwarding and Control Element\ Separation (ForCES) architecture and defines a set of associated\ terminology.\  This document also defines a set of architectural,\ modeling, and protocol\ requirements to logically separate the control\ and data forwarding planes of an IP (IPv4, IPv6, etc.) networking\ device.

}, author = {Anderson, Todd and Bowen, Ed and Ram Dantu and Doria, Avri and Gopal, Ram and Salim, Jamal and Khosravi, Hormuzd and Minhazuddin, Muneyb and Wasserman, Margaret} } @article {280, title = {Signaling System 7 (SS7) Message Transfer Part 2 (MTP2) - User Adaptation Layer}, year = {2002}, url = {https://tools.ietf.org/html/rfc3331}, author = {Morneault, Ken and Ram Dantu and Sidebottom, Greg and Bidulock, Brian and Heitz, Jacob} }