@article {300, title = {A novel heart-mobile interface for detection and classification of heart sounds}, journal = {Biomedical Signal Processing and Control}, volume = {45}, year = {2018}, pages = {313 - 324}, abstract = {

Abstract Diagnosis of heart disease requires that a medical practitioner investigate heart auscultations for irregular sounds, followed by echocardiography and electrocardiography tests. These expensive tests also require specialized technicians to operate. We present a low-cost, patient-centered device for the initial screening of the heart sounds that can be potentially used by the users on themselves. They can later share these readings with their healthcare providers. We have created an innovative mobile-health service platform for analyzing and classifying heart sounds. The presented system enables remote patient-monitoring by integrating advanced wireless communications with a customized low-cost stethoscope. This system also permits remote management of a patient{\textquoteright}s cardiac status while maximizing patient mobility. The smartphone application facilitates recording, processing, visualizing, listening to, and classification of heart sounds. We build our classification model using the Mel-Frequency Cepstral Coefficient and Hidden Markov Model. This application is tested in a hospital environment to collect live recordings from patients with positive results. The smartphone application correctly detected 92.68\% of abnormal heart conditions in clinical trials at \{UT\} Southwestern Hospital.

}, keywords = {Hidden Markov Model}, issn = {1746-8094}, doi = {https://doi.org/10.1016/j.bspc.2018.05.008}, url = {https://www.sciencedirect.com/science/article/pii/S1746809418301101}, author = {Thiyagaraja, Shanti and Ram Dantu and Shrestha, Pradhumna and Chitnis, Anurag and Thompson, Mark and Anumandla, Pruthvi and Sarma, Tom and Dantu, Siva} } @article {261, title = {Real-Time Mobile Device-Assisted Chest Compression During Cardiopulmonary Resuscitation}, journal = {American Journal of Cardiology}, volume = {120}, year = {2017}, pages = {196 - 200}, isbn = {0002-9149}, url = {http://dx.doi.org/10.1016/j.amjcard.2017.04.007}, author = {Sarma, Satyam and Bucuti, Hakiza and Chitnis, Anurag and Klacman, Alex and Ram Dantu} } @article {286, title = {911 services and vital sign measurement utilizing mobile phone sensors and applications}, year = {2016}, month = {11/2016}, publisher = {University of North Texas}, address = {US}, abstract = {

Improved methods for utilizing 911 services, for implementing 911 dispatch protocols, and for measuring vital signs of a human, all by accessing mobile phone sensors and applications, are disclosed. Vital signs such as heart rate, breathing rate, breathing distress, and blood pressure can be measured using mobile phone sensors and applications. A method for differential estimation of blood pressure involves the synchronization of time between two mobile phones, locating an appropriate position for one cell phone and recording heart sounds, and recording video data from the finger tip of the subject using the other mobile phone.

}, keywords = {data, patient, rate, Remote, video}, issn = {US9485345B2}, url = {https://patents.google.com/patent/US9485345/en}, author = {Ram Dantu and Chandrasekaran, Vikram and Gupta, Neeraj} } @conference {232, title = {Random anonymization of mobile sensor data: Modified Android framework}, booktitle = {Intelligence and Security Informatics (ISI), 2015 IEEE International Conference on}, year = {2015}, month = {May}, abstract = {

With the increasing ability to accurately classify activities of mobile users from what was once viewed as innocuous mobile sensor data, the risk of users compromising their privacy has risen exponentially. Currently, mobile owners cannot control how various applications handle the privacy of their sensor data, or even determine if a service provider is adversarial or trustworthy. To address these privacy concerns, third party applications have been designed to allow mobile users to have control over the data that is sent to service providers. However, these applications require users to set flags and parameters that place restrictions on the anonymized or real sensor data that is sent to the requestor. Therefore, in this paper, we introduce a new framework, RANDSOM, that moves the decision-making from the application level to the operating system level.

}, keywords = {Accelerometers, Android, anonymized, application level, Data models, data privacy, Hidden Markov models, Mobile communication, mobile computing, mobile sensor data, mobile users, modified Android framework, operating system level, pervasive, Privacy, privacy concerns, provider, random anonymization, RANDSOM, RANDSOM framework, sensor data privacy, service providers, smart phone, smart phones, telecommunication security, third party applications}, doi = {10.1109/ISI.2015.7165968}, author = {Claiborne, Cynthia and Ncube, Cathy and Ram Dantu} } @conference {235, title = {Android Sensor Data Anonymization}, booktitle = {Research in Attacks, Intrusions, and Defenses: 16th International Symposium, RAID 2013, Rodney Bay, St. Lucia, October 23-25, 2013, Proceedings}, year = {2013}, publisher = {Springer}, organization = {Springer}, author = {Claiborne, Cynthia and Fazeen, Mohamed and Ram Dantu} } @article {15, title = {Cuffless Differential Blood Pressure Estimation Using Smart Phones}, journal = {IEEE Transactions on Biomedical Engineering}, volume = {60}, year = {2013}, pages = {1080 - 1089}, abstract = {

Smart phones today have become increasingly popular with the general public for their diverse functionalities such as navigation, social networking, and multimedia facilities. These phones are equipped with high-end processors, high-resolution cameras, and built-in sensors such as accelerometer, orientation-sensor, and light-sensor. According to comScore survey, 26.2\% of U.S. adults use smart phones in their daily lives. Motivated by this statistic and the diverse capability of smart phones, we focus on utilizing them for biomedical applications. We present a new application of the smart phone with its built-in camera and microphone replacing the traditional stethoscope and cuff-based measurement technique, to quantify vital signs such as heart rate and blood pressure. We propose two differential blood pressure estimating techniques using the heartbeat and pulse data. The first method uses two smart phones whereas the second method replaces one of the phones with a customized external microphone. We estimate the systolic and diastolic pressure in the two techniques by computing the pulse pressure and the stroke volume from the data recorded. By comparing the estimated blood pressure values with those measured using a commercial blood pressure meter, we obtained encouraging results of 95{\textendash}100\% accuracy.

}, keywords = {Blood pressure, cuffless, Estimation, finger pulse, Heart, Microphones, mobile camera, Mobile communication, mobile phone, Synchronization, Valves, vascular transit time}, doi = {10.1109/TBME.2012.2211078}, author = {Chandrasekaran, Vikram and Ram Dantu and Jonnada, Srikanth and Thiyagaraja, Shanti and Subbu, Kalyan} } @article {82, title = {Socio-technical Aspects of Remote Media Control for a NG9-1-1 System}, journal = {Multimedia Tools Appl.}, volume = {62}, year = {2013}, pages = {733{\textendash}759}, abstract = {

9-1-1 emergency calls mostly involve distress situations that cause people to panic while trying to answer questions or follow instructions given by a dispatcher. To obtain precious information with the least user intervention and reduced stress on the user, there is a need for the dispatcher to have a better control and understanding of the condition or situation at the other end. The increasing growth of smartphones embedded with camera, speaker phone, GPS, microphone and various other sensors, extends their usage from merely making calls to life saving gadgets during critical situations. By integrating these sensor rich smartphones and the rapidly growing VoIP technology, we propose a VoIP based Next Generation 9-1-1 (NG9-1-1) system for remote media control. Specifically, we use Session Initiation Protocol (SIP) in the implementation of the system using a mobile and a PC client. The proposed system on the mobile client accounted for less than 25\% of CPU utilization even with video transmission. The average network utilization was about 10 and 72 kbps for audio and video, respectively. With these encouraging results, we believe the proposed remote media control system will facilitate information acquisition and decision making in emergency situations.

}, keywords = {Image transmission, Media control, NG9-1-1, PSAP, Remote, SIP, Voice quality, VoIP}, issn = {1380-7501}, doi = {10.1007/s11042-011-0875-1}, url = {http://dx.doi.org/10.1007/s11042-011-0875-1}, author = {Chandrasekaran, Vikram and Ram Dantu and Subbu, Kalyan} } @inbook {91, title = {Event Detection Based on Call Detail Records}, booktitle = {Behavior Computing: Modeling, Analysis, Mining and Decision}, year = {2012}, pages = {305{\textendash}316}, publisher = {Springer London}, organization = {Springer London}, address = {London}, isbn = {978-1-4471-2969-1}, doi = {10.1007/978-1-4471-2969-1_19}, url = {http://dx.doi.org/10.1007/978-1-4471-2969-1_19}, author = {Zhang, Huiqi and Ram Dantu}, editor = {Cao, Longbing and Yu, Philip} } @inbook {93, title = {Smart Phone: Predicting the Next Call}, booktitle = {Behavior Computing: Modeling, Analysis, Mining and Decision}, year = {2012}, pages = {317{\textendash}325}, publisher = {Springer London}, organization = {Springer London}, address = {London}, abstract = {

Prediction of incoming calls can be useful in many applications such as social networks, (personal, business) calendar and avoiding voice spam. Predicting incoming calls using just the context is a challenging task. We believe that this is a new area of research in context-aware ambient intelligence. In this paper, we propose a call prediction scheme and investigate prediction based on callers{\textquoteright} behavior and history. We present Holt-Winters method to predict calls from frequent and periodic callers. The Holt-Winters method shows high accuracy. Prediction and efficient scheduling of calls can improve the security, productivity and ultimately the quality of life.

}, isbn = {978-1-4471-2969-1}, doi = {10.1007/978-1-4471-2969-1_20}, url = {http://dx.doi.org/10.1007/978-1-4471-2969-1_20}, author = {Zhang, Huiqi and Ram Dantu}, editor = {Cao, Longbing and Yu, Philip} } @article {28, title = {Behavior-based Adaptive Call Predictor}, journal = {ACM Trans. Auton. Adapt. Syst.}, volume = {6}, year = {2011}, pages = {21:1{\textendash}21:28}, abstract = {

Predicting future calls can be the next advanced feature of the next-generation telecommunication networks as the service providers are looking to offer new services to their customers. Call prediction can be useful to many applications such as planning daily schedules, avoiding unwanted communications (e.g. voice spam), and resource planning in call centers. Predicting calls is a very challenging task. We believe that this is an emerging area of research in ambient intelligence where the electronic devices are sensitive and responsive to people{\textquoteright}s needs and behavior. In particular, we believe that the results of this research will lead to higher productivity and quality of life. In this article, we present a Call Predictor (CP) that offers two new advanced features for the next-generation phones namely {\textquotedblleft}Incoming Call Forecast{\textquotedblright} and {\textquotedblleft}Intelligent Address Book.{\textquotedblright} For the Incoming Call Forecast, the CP makes the next-24-hour incoming call prediction based on recent caller{\textquoteright}s behavior and reciprocity. For the Intelligent Address Book, the CP generates a list of most likely contacts/numbers to be dialed at any given time based on the user{\textquoteright}s behavior and reciprocity. The CP consists of two major components: Probability Estimator (PE) and Trend Detector (TD). The PE computes the probability of receiving/initiating a call based on the caller/user{\textquoteright}s calling behavior and reciprocity. We show that the recent trend of the caller/user{\textquoteright}s calling pattern has higher correlation to the future pattern than the pattern derived from the entire historical data. The TD detects the recent trend of the caller/user{\textquoteright}s calling pattern and computes the adequacy of historical data in terms of reversed time (time that runs towards the past) based on a trace distance. The recent behavior detection mechanism allows CP to adapt its computation in response to the new calling behaviors. Therefore, CP is adaptive to the recent behavior. For our analysis, we use the real-life call logs of 94 mobile phone users over nine months, which were collected by the Reality Mining Project group at MIT. The performance of the CP is validated for two months based on seven months of training data. The experimental results show that the CP performs reasonably well as an incoming call predictor (Incoming Call Forecast) with false positive rate of 8\%, false negative rate of 1\%, and error rate of 9\%, and as an outgoing call predictor (Intelligent Address Book) with the accuracy of 70\% when the list has five entries. The functionality of the CP can be useful in assisting its user in carrying out everyday life activities such as scheduling daily plans by using the Incoming Call Forecast, and saving time from searching for the phone number in a typically lengthy contact book by using the Intelligent Address Book. Furthermore, we describe other useful applications of CP besides its own aforementioned features including Call Firewall and Call Reminder.

}, keywords = {behavior, call logs, call matrix, convergence time, Prediction, trace distance}, issn = {1556-4665}, doi = {10.1145/2019583.2019588}, url = {http://doi.acm.org/10.1145/2019583.2019588}, author = {Phithakkitnukoon, Santi and Ram Dantu and Claxton, Rob and Eagle, Nathan} } @article {282, title = {Socioscope: Human Relationship and Behavior Analysis in Social Networks}, journal = {IEEE Transactions on Systems, Man, and Cybernetics - Part A: Systems and Humans}, volume = {41}, year = {2011}, month = {Nov}, pages = {1122-1143}, abstract = {

In this paper, we propose a socioscope model for social-network and human-behavior analysis based on mobile-phone call-detail records. Because of the diversity and complexity of human social behavior, no one technique will detect every attribute that arises when humans engage in social behaviors. We use multiple probability and statistical methods for quantifying social groups, relationships, and communication patterns and for detecting human-behavior changes. We propose a new index to measure the level of reciprocity between users and their communication partners. This reciprocity index has application in homeland security, detection of unwanted calls (e.g., spam), telecommunication presence, and product marketing. For the validation of our results, we used real-life call logs of 81 users which contain approximately 500 000 h of data on users{\textquoteright} location, communication, and device-usage behavior collected over eight months at the Massachusetts Institute of Technology (MIT) by the Reality Mining Project group. Also, call logs of 20 users collected over six months by the University of North Texas (UNT) Network Security team are used. The MIT and UNT data sets contain approximately 5000 callers. The experimental results show that our model is effective.

}, keywords = {behavioural sciences computing, Change points, communication pattern, Data models, human relationship analysis, human social behavior, human-behavior change detection, Humans, IEEE, Massachusetts Institute of Technology, Mobile handsets, probability, Reality Mining Project group, reciprocity index, Social factors, social group, social groups, social network analysis, Social network services, social networking (online), Social networks, social relationship, social relationships, social sciences computing, socioscope, Statistical analysis, statistical method, University of North Texas}, issn = {1083-4427}, doi = {10.1109/TSMCA.2011.2113335}, author = {Zhang, Huiqi and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {68, title = {Efficiency of Social Connection-based Routing in P2P VoIP Networks}, booktitle = {Proceedings of the 2Nd International Conference on COMmunication Systems and NETworks}, year = {2010}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, keywords = {P2P routing, P2P VoIP systems, Social networks, social-network based routing}, isbn = {978-1-4244-5487-7}, url = {http://dl.acm.org/citation.cfm?id=1831443.1831488}, author = {Chandrasekaran, Vikram and Ram Dantu and Gupta, Neeraj and Yang, Xiaohui and Wijesekera, Duminda} } @inbook {54, title = {Email Shape Analysis}, booktitle = {Distributed Computing and Networking: 11th International Conference, ICDCN 2010, Kolkata, India, January 3-6, 2010. Proceedings}, year = {2010}, pages = {18{\textendash}29}, publisher = {Springer Berlin Heidelberg}, organization = {Springer Berlin Heidelberg}, address = {Berlin, Heidelberg}, abstract = {

Email has become an integral part of everyday life. Without a second thought we receive bills, bank statements, and sales promotions all to our inbox. Each email has hidden features that can be extracted. In this paper, we present a new mechanism to characterize an email without using content or context called Email Shape Analysis. We explore the applications of the email shape by carrying out a case study; botnet detection and two possible applications: spam filtering, and social-context based finger printing. Our in-depth analysis of botnet detection leads to very high accuracy of tracing templates and spam campaigns. However, when it comes to spam filtering we do not propose new method but rather a complementing method to the already high accuracy Bayesian spam filter. We also look at its ability to classify individual senders in personal email inbox{\textquoteright}s.

}, isbn = {978-3-642-11322-2}, doi = {10.1007/978-3-642-11322-2_7}, url = {http://dx.doi.org/10.1007/978-3-642-11322-2_7}, author = {Sroufe, Paul and Phithakkitnukoon, Santi and Ram Dantu and Cangussu, Jo{\~a}o}, editor = {Kant, Krishna and Pemmaraju, Sriram V. and Sivalingam, Krishna M. and Wu, Jie} } @article {72, title = {Experiences During a Collegiate Cyber Defense Competition}, journal = {Journal of Applied Security Research}, volume = {5}, year = {2010}, pages = {382{\textendash}396}, abstract = {

The objective of this article is to encourage schools to participate in the Collegiate Cyber Defense Competition (CCDC) and to ease their entry by providing information about the event and describing the experiences of both the student participants and the educators. This article focuses mainly on the recent experience of a University of North Texas student team at the Southwest Regional CCDC 2008 hosted by Del Mar College in Corpus Christi, Texas. It describes the entire process of participating in the CCDC, including announcements, team formation, task assignments, preparations, and actual team experience during the competition and provides suggestions on strategies for future competitions

}, keywords = {Cyber defense competition, network configurations, operating systems, servers}, author = {Sroufe, Paul and Tate, Steve and Ram Dantu and Cankaya, Ebru} } @conference {237, title = {Socio-technical aspects of video phones}, booktitle = {2010 Second International Conference on COMmunication Systems and NETworks (COMSNETS 2010)}, year = {2010}, month = {Jan}, abstract = {

The widespread use of voice over Internet protocol has paved the way for video over Internet protocol. In the past, certain technical shortcomings have prevented the popularity of videophones in the market. With present-day technology, videophones have just about everything required for day-to-day functions. Under such circumstances, certain socio-technical aspects require attention so that videophones can become as widespread and as technically streamlined as a plain old telephone system (POTS) with its additional benefits. A frequently brushed-upon topic is optimum features in the video phone for day-to-day social interactions. We carried out several experiments on different kinds of codecs and video formats to address two issues: i) the size of a video screen and ii) perception of motion and distance. From the measurements, we observed that a small frame rate with low bandwidth is adequate and can result in satisfactory video quality. We also observed that H263 performs well for all the day-to-day social networking activities. Standing 4 feet from the camera can still give reasonably good video quality in the currently available codecs. We believe that socio-technical issues will emerge more clearly over the next several years and they are germane to deployment of PC-based soft phones as well as hard phones.

}, keywords = {Bandwidth, Cameras, Codecs, Computer science, Internet telephony, plain old telephone system, Protocols, social aspects of automation, Social factors, social interactions, social issues, Social network services, social networking activities, sociotechnical aspects, Streaming media, technical issues, video codecs, video coding, video phones, video quality, Videoconference, videophone quality, videophones, videotelephony, voice over Internet protocol}, doi = {10.1109/COMSNETS.2010.5431971}, author = {Chandrasekaran, Vikram and Dantu, Siva and Kadiyala, Priyanka and Ram Dantu and Phithakkitnukoon, Santi} } @article {228, title = {Spam Classification Based on E-Mail Path Analysis}, journal = {Pervasive Information Security and Privacy Developments: Trends and Advancements: Trends and Advancements}, year = {2010}, pages = {332}, author = {Palla, Srikanth and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {53, title = {BBN-based Privacy Management System for Facebook}, booktitle = {Proceedings of the 2009 IEEE International Conference on Intelligence and Security Informatics}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

Online social networking sites (SNSs) has changed our lifestyle and become a main medium of communication among young adults to stay in touch with their friends, to organize events, to make friends, to promote themselves, to date, etc. To create content rich environment, SNSs make their platform available for third-party developers. The developers can build their applications based on users{\textquoteright} social graph containing their personal and social information. Unfortunately, any information users posted on their profile can be harvested and used for unethical purposes due to Facebook{\textquoteright}s lack of application privacy configuration. In this paper we propose a privacy-management system for Facebook applications. The system can take advantage of the correlation between some profile features and network privacy settings, in this way it can automatically configure a users privacy settings. Our preliminary result show promising result.

}, isbn = {978-1-4244-4171-6}, url = {http://dl.acm.org/citation.cfm?id=1706428.1706467}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu and Tang, Yan and Cangussu, Jo{\~a}o} } @conference {59, title = {Change Point Detection Based on Call Detail Records}, booktitle = {Proceedings of the 2009 IEEE International Conference on Intelligence and Security Informatics}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

In this paper we propose a method for combining wavelet denoising and sequential approach for detecting change points on mobile phone based on detailed call records. The Minmax method is used to estimate the thresholds of frequency and call duration for denoising. This work is useful to enhance homeland security, detecting unwanted calls (e.g., spam) and commercial purposes. For validation of our results, we randomly choose actual call logs of 20 users from 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. Simulation data is also used to validate the results. The experimental results show that our model achieves good performance with high accuracy.

}, isbn = {978-1-4244-4171-6}, url = {http://dl.acm.org/citation.cfm?id=1706428.1706438}, author = {Zhang, Huiqi and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {29, title = {Email Shape Analysis for Spam Botnet Detection}, booktitle = {Proceedings of the 6th IEEE Conference on Consumer Communications and Networking Conference}, year = {2009}, publisher = {IEEE Press}, organization = {IEEE Press}, address = {Piscataway, NJ, USA}, abstract = {

Botnets have become the major sources of spamming, which generates massive unwanted traffic on networks. An effective detection mechanism can greatly mitigate the problem. In this paper, we present a novel botnet detection mechanism based on the email "shape" analysis that relies on neither content nor reputation analysis. Shape is our new way of characterizing an email by mimicking human visual inspection. A set of email shapes are derived and then used to generate a botnet signature. Our preliminary results show greater than 80\% classification accuracy (without considering email content or reputation analysis). This work investigates the discriminatory power of email shape, for which we believe will be a significant complement to other existing techniques such as a network behavior analysis.

}, isbn = {978-1-4244-2308-8}, url = {http://dl.acm.org/citation.cfm?id=1700527.1700792}, author = {Sroufe, Paul and Phithakkitnukoon, Santi and Ram Dantu and Cangussu, Jo{\~a}o} } @article {16, title = {Issues and challenges in securing VoIP}, journal = {Computers \& Security}, volume = {28}, year = {2009}, pages = {743-753}, abstract = {

Voice over the Internet protocol (VoIP) is being rapidly deployed, and the convergence of the voice and data worlds is introducing exciting opportunities. Lower cost and greater flexibility are the key factors luring enterprises to transition to VoIP. Some security problems may surface with the widespread deployment of VoIP. In this article, we discuss these security problems and propose a high-level security architecture that captures required features at each boundary-network-element in the VoIP infrastructure. We describe mechanisms to efficiently integrate information between distributed security components in the architecture.

}, keywords = {Feedback, Security solutions, Threats, VoIP attacks, VoIP security}, doi = {10.1016/j.cose.2009.05.003}, author = {Ram Dantu and Fahmy, Sonia and Schulzrinne, Henning and Cangussu, Jo{\~a}o} } @article {285, title = {Method and system for providing wireless-specific services for a wireless access network}, year = {2009}, month = {12/2009}, publisher = {Cisco Technology Inc}, chapter = {US7639647B2}, address = {US}, abstract = {

A method and system for providing wireless-specific services for a wireless access network includes receiving at a call agent of a wireless access network a call origination for a mobile device. Whether the device is registered on the wireless access network is determined. If the mobile device is not registered, whether the mobile device is active is determined at a mobility control function (MCF). If the mobile device is active, the call is connected to the mobile device with a call agent based on a temporary line directory number (TLDN) assigned by the MCF and passed to the call agent in an extended session initiation protocol (SIP) message.

}, keywords = {agent, call, mcf, mobile, network}, url = {https://patents.google.com/patent/US7639647/en}, author = {Ram Dantu and Chiang, Shihlung and Yin, Haochih and Kachhla, Rasik} } @article {20, title = {Network risk management using attacker profiling}, journal = {Security and Communication Networks}, volume = {2}, year = {2009}, pages = {83{\textendash}96}, abstract = {

Risk management refers to the process of making decisions that minimize the effects of vulnerabilities on the network hosts. This can be a difficult task in the context of high-exploit probability and the difficult to identify new exploits and vulnerabilities. For many years, security engineers have performed risk analysis using economic models for the design and operation of risk-prone, technological systems using attack profiles. Based on the type of attacker identified, security administrators can formulate effective risk management policies for a network. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs representing all the possible attack paths to all the critical resources. The risk level is computed based on these graphs and are used as a measure of the vulnerability of the resource and forming an effective basis for a system administrator to perform suitable changes to network configuration. Copyright {\textcopyright} 2008 John Wiley \& Sons, Ltd.

}, keywords = {attack graphs, behavior, risk management}, issn = {1939-0122}, doi = {10.1002/sec.58}, url = {http://dx.doi.org/10.1002/sec.58}, author = {Ram Dantu and Kolan, Prakash and Cangussu, Jo{\~a}o} } @conference {78, title = {Penetration Testing for Spam Filters}, booktitle = {Proceedings of the 2009 33rd Annual IEEE International Computer Software and Applications Conference - Volume 02}, year = {2009}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Seattle, WA}, abstract = {

Despite all the advances on techniques to block spam e-mail messages we still receive them on a frequent basis. This is due mainly to the ability of the spammers to modify the message and pass the filters. Therefore a testing technique that could resemble the behavior of spammers would improve the number of scenarios tested and allow filters to be developed based on the potential changes made by the spammers. An approach based on Natural Language Processing (NLP) for the penetration of spam filters is proposed here. Preliminary results using SpamAssassin are provided indicating the feasibility of the proposed approach.

}, keywords = {mutation testing, penetration testing, spam filter}, isbn = {978-0-7695-3726-9}, doi = {10.1109/COMPSAC.2009.168}, url = {http://dx.doi.org/10.1109/COMPSAC.2009.168}, author = {Madhavan, Yugesh and Cangussu, Jo{\~a}o and Ram Dantu} } @conference {41, title = {Quantifying Reciprocity in Social Networks}, booktitle = {2009 International Conference on Computational Science and Engineering}, year = {2009}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Washington, DC, USA}, abstract = {

In this paper we propose a new reciprocity index for quantifying social relationships based on mobile phone call detail records and Twitter blogs. We use this reciprocity index to measure the level of reciprocity between users. This work is useful for detecting unwanted calls (e.g., spam) and product marketing. For validation of our results, we used actual call logs of 100 users collected at MIT by the Reality Mining Project group for a period of 8 months and Twitter blogs of 460 users collected by the Network Security team at UNT for a period of 12 months. The experimental results show that our model achieves results with high accuracy.

}, isbn = {978-0-7695-3823-5}, doi = {10.1109/CSE.2009.399}, url = {http://dx.doi.org/10.1109/CSE.2009.399}, author = {Zhang, Huiqi and Ram Dantu and Cangussu, Jo{\~a}o} } @article {65, title = {A Virtual Environment for Network Testing}, journal = {J. Netw. Comput. Appl.}, volume = {32}, year = {2009}, pages = {184{\textendash}214}, abstract = {

The testing of network-based solutions demands a series of tedious tasks such as the deployment of the solution at different nodes and the configuration of different topologies. The manual execution of these tasks is very time consuming and a configurable environment to facilitate these tasks and consequently improve testing performance is desired. In this paper a virtual network environment that can be easily re-configured is presented to address this problem. The environment has been evaluated by a series of case studies: one dealing with the deployment and containment of a worm propagation attack and one dealing with detecting a denial of service attack. Three smaller case studies have also been developed. The results are a clear indication of the flexibility and usefulness of the virtual network environment.

}, keywords = {Re-configuration, Software testing, Virtual network}, issn = {1084-8045}, doi = {10.1016/j.jnca.2008.03.008}, url = {http://dx.doi.org/10.1016/j.jnca.2008.03.008}, author = {Fagen, Wade and Cangussu, Jo{\~a}o and Ram Dantu} } @article {71, title = {Classification of phishers}, journal = {Journal of Homeland Security and Emergency Management}, volume = {5}, year = {2008}, abstract = {

Phishing attackers masquerade as genuine senders and try to steal consumers{\textquoteright} personal identity data and financial account credentials. In spite of aggressive efforts, technology companies have had limited success in restricting phishing attacks. Unfortunately the nature of phishing attacks changed over time from passive, such as password guessing and eavesdropping to active attacks, such as employing Trojans to intercept traffic and adopting social engineering techniques. No matter how many authentication techniques we develop, phishers always adapt. However, phishers cannot become part of the recipient{\textquoteright}s social network without consent. Though they can forge certain fields in an email header, phishers do not have access to the complete header. In this paper, we describe techniques for detecting phishers based on their traffic paths, traffic patterns, and on the receivers{\textquoteright} social network. Considering such issues, we based our solution on the trustworthiness of the relays participating in routing the emails. We examine the email{\textquoteright}s header rather than the content. We designed our classifier to perform the following analyses in four steps: i) DNS-header analysis, ii) Social network analysis, iii) Wantedness analysis, and iv) Proactive classification. We classify phishers into: i) Serial phishers, ii) Recent phishers, iii) Prospective phishers, and iv) Suspects. Finally, our classifier appends an alert level or label to the email{\textquoteright}s "subject" before adding the email to the inbox.

}, keywords = {application security, network security, phishing, spam}, author = {Ram Dantu and Palla, Srikanth and Cangussu, Jo{\~a}o} } @article {31, title = {Estimation of Defects Based on Defect Decay Model: ED^\{3\}M}, journal = {IEEE Transactions on Software Engineering}, volume = {34}, year = {2008}, pages = {336 - 356}, abstract = {

An accurate prediction of the number of defects in a software product during system testing contributes not only to the management of the system testing process but also to the estimation of the product{\textquoteright}s required maintenance. Here, a new approach called ED3M is presented that computes an estimate of the total number of defects in an ongoing testing process. ED3M is based on estimation theory. Unlike many existing approaches the technique presented here does not depend on historical data from previous projects or any assumptions about the requirements and/or testers{\textquoteright} productivity. It is a completely automated approach that relies only on the data collected during an ongoing testing process. This is a key advantage of the ED3M approach, as it makes it widely applicable in different testing environments. Here, the ED3M approach has been evaluated using five data sets from large industrial projects and two data sets from the literature. In addition, a performance analysis has been conducted using simulated data sets to explore its behavior using different models for the input data. The results are very promising; they indicate the ED3M approach provides accurate estimates with as fast or better convergence time in comparison to well-known alternative techniques, while only using defect data as the input.

}, keywords = {Costs, defect decay model, defect estimation, Defect prediction, estimation theory, Inspection, Metrics/Measurement, Phase estimation, Productivity, program testing, Programming, Software maintenance, software metrics, software product, Software systems, Software testing, Statistical methods, System testing, system testing process, Testing and Debugging}, doi = {10.1109/TSE.2008.23}, author = {Haider, Syed and Cangussu, Jo{\~a}o and Cooper, Kendra and Ram Dantu} } @article {291, title = {Method and system for providing supplementary services for a wireless access network}, year = {2008}, month = {10/2008}, publisher = {Cisco Technology Inc}, chapter = {US7444151B2}, address = {US}, abstract = {

A method and system for providing supplementary services for a wireless access network includes downloading supplementary service triggers from a call agent to a mobility control function (MCF) for a wireless access network. Wireless-specific signaling of the wireless access network is communicated to the MCF. The MCF detects events associated with a trigger based on the wireless-specific signaling. The call agent is informed of the events by the MCF through session initiating protocol (SIP) extensions.

}, keywords = {agent, call, mcf, network, wireless}, url = {https://patents.google.com/patent/US7444151/en}, author = {Ram Dantu and Chiang, Shihlung and Yin, Haochih and Kachhla, Rasik} } @article {289, title = {Method and system of control signaling for a wireless access network}, year = {2008}, month = {12/2008}, publisher = {Cisco Technology Inc}, address = {US}, abstract = {

A method and system of control signaling for a wireless access network includes receiving from a wireless access network a signaling message for a mobile device. The signaling message is in a wireless-specific format. The signaling message is converted to a native format of a call agent to generate a call agent message. The call agent message comprises wireless-specific information of the signaling message.

}, keywords = {agent, call, mcf, message, network}, issn = {US7471674B2}, url = {https://patents.google.com/patent/US7471674/en}, author = {Ram Dantu and Chiang, Shihlung and Yin, Haochih and Kachhla, Rasik} } @article {37, title = {Nuisance Level of a Voice Call}, journal = {ACM Trans. Multimedia Comput. Commun. Appl.}, volume = {5}, year = {2008}, pages = {6:1{\textendash}6:22}, abstract = {

In our everyday life, we communicate with many people such as family, friends, neighbors, and colleagues. We communicate with them using different communication media such as email, telephone calls, and face-to-face interactions. While email is not real-time and face-to-face communications require geographic proximity, voice and video communications are preferred over other modes of communication. However, real-time voice/video calls may create nuisance to the receiver. In this article, we describe a mathematical model for computing nuisance level of incoming voice/video calls. We computed the closeness and nuisance level using the calling patterns between the caller and the callee. To validate the nuisance model, we collected cell phone call records of real-life people at our university and computed the nuisance value for all voice calls. We validated the nuisance levels using the feedback from those real-life people. Such a nuisance model is useful for predicting unwanted voice and video sessions in an IP communication network.

}, keywords = {behavior, Multimedia communications, nuisance, presence, Security, tolerance, unwantedness}, issn = {1551-6857}, doi = {10.1145/1404880.1404886}, url = {http://doi.acm.org/10.1145/1404880.1404886}, author = {Kolan, Prakash and Ram Dantu and Cangussu, Jo{\~a}o} } @article {274, title = {Spam Classification Based on E-Mail Path Analysis}, journal = {International Journal of Information Security and Privacy (IJISP)}, volume = {2}, year = {2008}, month = {April}, pages = {46-69}, abstract = {

Email spam is the most effective form of online advertising. Unlike telephone marketing, email spamming does not require huge human or financial resources investment. Most existing spam filtering techniques concentrate on the emails{\^a}{\texteuro}{\texttrademark} content. However, most spammers obfuscate their emails{\^a}{\texteuro}{\texttrademark} content to circumvent content-based spam filters. An integrated solution for restricting spam emails is needed as content analyses alone might not provide a solution for filtering unsolicited emails. Here we present a new method for isolating unsolicited emails. Though spammers obfuscate their emails{\^a}{\texteuro}{\texttrademark} content, they do not have access to all the fields in the email header. Our classification method is based on the path an email traverses instead of content. Overall, our classifier produced fewer false positives when compared to current filters such as SpamAssassin. We achieved a precision of 98.65\% which compares well with the precisions achieved by SPF, DNSRBL blacklists.

}, doi = {doi:10.4018/jisp.2008040104}, url = {https://ideas.repec.org/a/igg/jisp00/v2y2008i2p46-69.html}, author = {Palla, Srikanth and Ram Dantu and Cangussu, Jo{\~a}o} } @article {85, title = {An Architecture for Automatic and Adaptive Defense}, journal = {Journal of Information Privacy and Security}, volume = {3}, year = {2007}, pages = {37-58}, abstract = {

Network attacks have become so fast that human mitigation cannot cope with security requirements. In addition, attackers have become smarter by creating attacks which mutate themselves to prevent detection. Therefore, defense mechanisms must be automated to keep up with attack speed and adapted to seek out mutations. An architecture to support this trend in defense mechanisms is proposed here. The architecture is based upon three conceptual pillars. First is the use of a multi-feedback loop control to slow down an attack. Second, machine learning concepts are employed to properly distinguish between normal and abnormal e-attack traffic. And, third, trust and reputation levels are determined through social networks. A case study on the application of the proposed architecture to a worm propagation attack provides the initial evidence of the e-attack and applicability of the approach.

}, doi = {10.1080/15536548.2007.10855815}, url = {http://dx.doi.org/10.1080/15536548.2007.10855815}, author = {Ram Dantu and Cangussu, Jo{\~a}o} } @article {14, title = {EAP Methods for Wireless Networks}, journal = {Comput. Stand. Interfaces}, volume = {29}, year = {2007}, pages = {289{\textendash}301}, keywords = {802.11, 802.16, EAP, Extensible authentication protocol, RFID, Security, WiMAX, Wireless LAN}, issn = {0920-5489}, doi = {10.1016/j.csi.2006.04.001}, url = {http://dx.doi.org/10.1016/j.csi.2006.04.001}, author = {Ram Dantu and Clothier, Gabriel and Atri, Anuj} } @article {18, title = {Fast Worm Containment Using Feedback Control}, journal = {IEEE Transactions on Dependable and Secure Computing}, volume = {4}, year = {2007}, pages = {119 - 136}, abstract = {

In a computer network, network security is accomplished using elements such as firewalls, hosts, servers, routers, intrusion detection systems, and honey pots. These network elements need to know the nature or anomaly of the worm a priori to detect the attack. Modern viruses such as Code Red, Sapphire, and Nimda spread quickly. Therefore, it is impractical if not impossible for human mediated responses to these fast-spreading viruses. Several epidemic studies show that automatic tracking of resource usage and control provides an effective method to contain the damage. In this paper, we propose a novel security architecture based on the control system theory. In particular, we describe a state-space feedback control model that detects and control the spread of these viruses or worms by measuring the velocity of the number of new connections an infected host makes. The mechanism{\textquoteright}s objective is to slow down a worm{\textquoteright}s spreading velocity by controlling (delaying) the number of new connections made by an infected host. A proportional and integral (PI) controller is used for a continuous control of the feedback loop. The approach proposed here has been verified in a laboratory setup, and we were able to contain the infection so that it affected less than 5 percent of the hosts. We have also implemented a protocol for exchanging control-specific information between the network elements. The results from the simulation and experimental setup combined with the sensitivity analysis demonstrate the applicability and accuracy of the approach.

}, keywords = {communication/networking and information technology, computer networks, Computer systems organization, control engineering computing, general, invasive software, network security, network-level security and protection, PI control, process control systems., proportional-integral controller, special-purpose and application-based systems, state feedback, state-space feedback control, state-space methods, telecommunication security, worm containment}, doi = {10.1109/TDSC.2007.1002}, author = {Ram Dantu and Cangussu, Jo{\~a}o and Patwardhan, Sudeep} } @conference {62, title = {Goliath: A Configurable Approach for Network Testing}, booktitle = {Testbeds and Research Infrastructure for the Development of Networks and Communities, 2007. TridentCom 2007. 3rd International Conference on}, year = {2007}, month = {May}, abstract = {

When testing a network environment and/or application many aspects need to be taken into consideration. For example, different software needs to be deployed at different nodes and different topologies may also need to be tested. The manual execution of these tasks are very time consuming and a configurable environment to facilitate these tasks and consequently improve testing performance is desired. In this paper a virtual network environment that can be easily reconfigured is presented to address this problem. Also presented is a case study with the results of deployment and containing a worm propagation attack.

}, keywords = {automated network testing, Computational modeling, computer networks, Computer science, Computer worms, Distributed computing, Goliath, Intrusion detection, network topologies, Network topology, Protocols, security of data, Software testing, System testing, telecommunication computing, telecommunication network topology, telecommunication security, virtual network environment, virtual private networks, worm propagation attack}, doi = {10.1109/TRIDENTCOM.2007.4444667}, author = {Fagen, Wade and Cangussu, Jo{\~a}o and Ram Dantu} } @article {287, title = {Method and system for configuring wireless routers and networks}, year = {2006}, month = {04/2006}, publisher = {Cisco Technology Inc}, address = {US}, abstract = {

A method and system for configuring a wireless router and a wireless communications network includes establishing connectivity between a wireless router and at least one wireline router. Connectivity between the wireless router and a plurality of neighboring wireless routers is established through the wireline router. The wireless router is configured based on information exchanged with the neighboring wireless routers through the wireline router.

}, keywords = {parameters, router, state, step, wireless}, issn = {US7031266B1}, url = {https://patents.google.com/patent/US7031266/en}, author = {Patel, Pulin and Choksi, Ojas and Davidson, Kenneth and Ram Dantu} } @article {296, title = {Wireless router and method for processing traffic in a wireless communications network}, year = {2006}, month = {06/2006}, publisher = {Cisco Technology Inc}, address = {US}, abstract = {

A wireless communications network includes a wireless-specific router topology layer that connects cellular sites to a wireline topology. The wireless-specific router topology provides a distributed architecture in which call processing including call setup, resource preservation, air bandwidth allocation, switching, soft handoff, and micromobility is performed at the cell level. The wireless routers are technology independent to support various cellular technologies. The wireless router may include a first interface operable to communicate wireless packets for a call with a remote device and a second interface operable to communicate wireline packets for the call with the wireline network. A traffic controller is coupled to the first and second interfaces and operable to convert traffic between the wireless and wireline packets and to route packets to a destination mobile or wireline device. A selection and distribution unit is operable to select and distribute traffic to support soft handoff for calls in the wireless communications network.

}, keywords = {network, router, routers, traffic, wireless}, issn = {US7068624B1}, url = {https://patents.google.com/patent/US7068624B1/en}, author = {Ram Dantu and Patel, Pulin and Choksi, Ojas and Patel, Achal and Ali, Mohammad and Miernik, Jerzy and Holur, Balajl} } @conference {73, title = {An Architecture for Network Security Using Feedback Control}, booktitle = {Proceedings of the 2005 IEEE International Conference on Intelligence and Security Informatics}, year = {2005}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Atlanta, GA}, isbn = {3-540-25999-6, 978-3-540-25999-2}, doi = {10.1007/11427995_84}, url = {http://dx.doi.org/10.1007/11427995_84}, author = {Ram Dantu and Cangussu, Jo{\~a}o} } @conference {81, title = {Sensitivity Analysis of an Attack Containment Model}, booktitle = {Proceedings of the 2005 IEEE International Conference on Intelligence and Security Informatics}, year = {2005}, publisher = {Springer-Verlag}, organization = {Springer-Verlag}, address = {Atlanta, GA}, abstract = {

A feedback control model has been previously proposed to regulate the number of connections at different levels of a network. This regulation is applied in the presence of a worm attack resulting in a slow down of the spreading worm allowing time to human reaction to properly eliminate the worm in the infected hosts. The feedback model constitutes of two queues, one for safe connections and another for suspected connections. The behavior of the proposed model is based on three input parameters to the model. These parameters are: (i) the portion of new connection requests to be sent to the suspect queue, (ii) the number of requests to be transferred from the suspect to the safe queue, and (iii) the time out value of the requests waiting in the suspect queue. The more we understand the effects of these parameters on the model, the better we can calibrate the model. Based on this necessity, a sensitivity analysis of the model is presented here. The analysis allows for the computation of the effects of changing parameters in the output of the model. In addition, the use of a sensitivity matrix permits the computations of not only changes in one parameter but also combined changes of these parameters. From the sensitivity analysis we have verified our assumption that the changes in the input parameters have no effect on the overall system stability. However, there will be a short period of instability before reaching a stable state.

}, isbn = {3-540-25999-6, 978-3-540-25999-2}, doi = {10.1007/11427995_11}, url = {http://dx.doi.org/10.1007/11427995_11}, author = {Ram Dantu and Cangussu, Jo{\~a}o and Turi, Janos} } @conference {19, title = {Dynamic Control of Worm Propagation}, booktitle = {Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC{\textquoteright}04) Volume 2 - Volume 2}, year = {2004}, publisher = {IEEE Computer Society}, organization = {IEEE Computer Society}, address = {Washington, DC, USA}, isbn = {0-7695-2108-8}, url = {http://dl.acm.org/citation.cfm?id=977403.978411}, author = {Ram Dantu and Cangussu, Jo{\~a}o and Yelimeli, Arun} } @article {279, title = {Constraint-Based Label Switched Path Setup using Label Distribution Protocol}, year = {2002}, url = {https://tools.ietf.org/html/rfc3212}, author = {Andersson, Loa and Callon, Ross and Ram Dantu and Doolan, Paul and Feldman, Nancy and Fredette, Andre and Gray, Eric and Heinanen, Juha and Jamoussi, Bilel and Kilty, Timothy and Malis, Andrew and Girish, Muckai and Worster, Tom and Wu, Liwen} }