@article {28, title = {Behavior-based Adaptive Call Predictor}, journal = {ACM Trans. Auton. Adapt. Syst.}, volume = {6}, year = {2011}, pages = {21:1{\textendash}21:28}, abstract = {

Predicting future calls can be the next advanced feature of the next-generation telecommunication networks as the service providers are looking to offer new services to their customers. Call prediction can be useful to many applications such as planning daily schedules, avoiding unwanted communications (e.g. voice spam), and resource planning in call centers. Predicting calls is a very challenging task. We believe that this is an emerging area of research in ambient intelligence where the electronic devices are sensitive and responsive to people{\textquoteright}s needs and behavior. In particular, we believe that the results of this research will lead to higher productivity and quality of life. In this article, we present a Call Predictor (CP) that offers two new advanced features for the next-generation phones namely {\textquotedblleft}Incoming Call Forecast{\textquotedblright} and {\textquotedblleft}Intelligent Address Book.{\textquotedblright} For the Incoming Call Forecast, the CP makes the next-24-hour incoming call prediction based on recent caller{\textquoteright}s behavior and reciprocity. For the Intelligent Address Book, the CP generates a list of most likely contacts/numbers to be dialed at any given time based on the user{\textquoteright}s behavior and reciprocity. The CP consists of two major components: Probability Estimator (PE) and Trend Detector (TD). The PE computes the probability of receiving/initiating a call based on the caller/user{\textquoteright}s calling behavior and reciprocity. We show that the recent trend of the caller/user{\textquoteright}s calling pattern has higher correlation to the future pattern than the pattern derived from the entire historical data. The TD detects the recent trend of the caller/user{\textquoteright}s calling pattern and computes the adequacy of historical data in terms of reversed time (time that runs towards the past) based on a trace distance. The recent behavior detection mechanism allows CP to adapt its computation in response to the new calling behaviors. Therefore, CP is adaptive to the recent behavior. For our analysis, we use the real-life call logs of 94 mobile phone users over nine months, which were collected by the Reality Mining Project group at MIT. The performance of the CP is validated for two months based on seven months of training data. The experimental results show that the CP performs reasonably well as an incoming call predictor (Incoming Call Forecast) with false positive rate of 8\%, false negative rate of 1\%, and error rate of 9\%, and as an outgoing call predictor (Intelligent Address Book) with the accuracy of 70\% when the list has five entries. The functionality of the CP can be useful in assisting its user in carrying out everyday life activities such as scheduling daily plans by using the Incoming Call Forecast, and saving time from searching for the phone number in a typically lengthy contact book by using the Intelligent Address Book. Furthermore, we describe other useful applications of CP besides its own aforementioned features including Call Firewall and Call Reminder.

}, keywords = {behavior, call logs, call matrix, convergence time, Prediction, trace distance}, issn = {1556-4665}, doi = {10.1145/2019583.2019588}, url = {http://doi.acm.org/10.1145/2019583.2019588}, author = {Phithakkitnukoon, Santi and Ram Dantu and Claxton, Rob and Eagle, Nathan} } @article {20, title = {Network risk management using attacker profiling}, journal = {Security and Communication Networks}, volume = {2}, year = {2009}, pages = {83{\textendash}96}, abstract = {

Risk management refers to the process of making decisions that minimize the effects of vulnerabilities on the network hosts. This can be a difficult task in the context of high-exploit probability and the difficult to identify new exploits and vulnerabilities. For many years, security engineers have performed risk analysis using economic models for the design and operation of risk-prone, technological systems using attack profiles. Based on the type of attacker identified, security administrators can formulate effective risk management policies for a network. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs representing all the possible attack paths to all the critical resources. The risk level is computed based on these graphs and are used as a measure of the vulnerability of the resource and forming an effective basis for a system administrator to perform suitable changes to network configuration. Copyright {\textcopyright} 2008 John Wiley \& Sons, Ltd.

}, keywords = {attack graphs, behavior, risk management}, issn = {1939-0122}, doi = {10.1002/sec.58}, url = {http://dx.doi.org/10.1002/sec.58}, author = {Ram Dantu and Kolan, Prakash and Cangussu, Jo{\~a}o} } @article {37, title = {Nuisance Level of a Voice Call}, journal = {ACM Trans. Multimedia Comput. Commun. Appl.}, volume = {5}, year = {2008}, pages = {6:1{\textendash}6:22}, abstract = {

In our everyday life, we communicate with many people such as family, friends, neighbors, and colleagues. We communicate with them using different communication media such as email, telephone calls, and face-to-face interactions. While email is not real-time and face-to-face communications require geographic proximity, voice and video communications are preferred over other modes of communication. However, real-time voice/video calls may create nuisance to the receiver. In this article, we describe a mathematical model for computing nuisance level of incoming voice/video calls. We computed the closeness and nuisance level using the calling patterns between the caller and the callee. To validate the nuisance model, we collected cell phone call records of real-life people at our university and computed the nuisance value for all voice calls. We validated the nuisance levels using the feedback from those real-life people. Such a nuisance model is useful for predicting unwanted voice and video sessions in an IP communication network.

}, keywords = {behavior, Multimedia communications, nuisance, presence, Security, tolerance, unwantedness}, issn = {1551-6857}, doi = {10.1145/1404880.1404886}, url = {http://doi.acm.org/10.1145/1404880.1404886}, author = {Kolan, Prakash and Ram Dantu and Cangussu, Jo{\~a}o} } @conference {58, title = {Automatic Calibration Using Receiver Operating Characteristics Curves}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Application-level filters, such as e-mail and VoIP spam filters, that analyze dynamic behavior changes are replacing static signature-recognition filters. These application-level filters learn behavior and use that knowledge to filter unwanted requests. Because behavior of a service request{\textquoteright}s participating entities changes rapidly, filters must adapt quickly by using end user{\textquoteright}s preferences about receiving that service request message. Many adaptive filters learn from the participating entities{\textquoteright} behavior; however, none configure themselves automatically to an end user{\textquoteright}s changing tolerance levels. Also, filter administrators cannot manually change the threshold for each service request in real time. Traditional adaptive filters fail when administrators must optimize multiple filter thresholds manually and often. Thus, to improve a filter{\textquoteright}s learning, we must automate its threshold-update process. We propose an automatic threshold-calibration mechanism using Receiver Operating Characteristics (ROC) curves that updates the threshold based on an end user{\textquoteright}s feedback. To demonstrate the mechanism{\textquoteright}s real-time applicability, we integrated it in a Voice over IP (VoIP) spam filter that analyzes incoming Spam over IP Telephony (SPIT) calls. Using this mechanism, we observed good improvement in the VoIP spam filter{\textquoteright}s accuracy. Further, computing and updating the optimum threshold in realtime does not impede the filter{\textquoteright}s temporal performance because we update thresholds after each call{\textquoteright}s completion. Because we reach an optimum threshold for any initial setting, this mechanism works efficiently when we cannot predict end-user behavior. Furthermore, automatic calibration proves efficient when using multiple threshold values.

}, keywords = {adaptive filters, application-level filter learning, automatic threshold-calibration mechanism, behavior, calibration, Computer science, Computer worms, Electronic mail, end user feedback, Filtering, information filtering, information filters, Internet telephony, learning (artificial intelligence), Protocols, receiver operating characteristics curves, sensitivity analysis, service request message, telecommunication traffic, Threshold, tolerance, Viruses (medical)}, doi = {10.1109/COMSWA.2007.382484}, author = {Kolan, Prakash and Vaithilingam, Ram and Ram Dantu} } @conference {34, title = {Classification of Attributes and Behavior in Risk Management Using Bayesian Networks}, booktitle = {2007 IEEE International Conference on Intelligence and Security Informatics (ISI) }, year = {2007}, month = {05/2007}, address = {New Brunswick, NJ}, abstract = {

Security administration is an uphill task to implement in an enterprise network providing secured corporate services. With the slew of patches being released by network component vendors, system administrators require a barrage of tools for analyzing the risk due to vulnerabilities in those components. In addition, criticalities in patching some end hosts raises serious security issues about the network to which the end hosts are connected. In this context, it would be imperative to know the risk level of all critical resources keeping in view the everyday emerging new vulnerabilities. We hypothesize that sequence of network actions by attackers depends on their social and attack profile (behavioral resources such as skill level, time, and attitude). To estimate the types of attack behavior, we surveyed individuals for their ability and attack intent. Using the individuals{\textquoteright} responses, we determined their behavioral resources and classified them as having opportunist, hacker, or explorer behavior. The profile behavioral resources can be used for determining risk by an attacker having that profile. Thus, suitable vulnerability analysis and risk management strategies can be formulated to efficiently curtail the risk from different types of attackers.

}, keywords = {attack behaviour, attack graphs, attack intent, Bayesian network, behavior, belief networks, explorer behavior, hacker behavior, opportunist behavior, profile behavioral resource classification, risk management, Security, security administration, vulnerability analysis}, doi = {10.1109/ISI.2007.379536}, author = {Ram Dantu and Kolan, Prakash and Akl, Robert and Loper, Kall} } @conference {45, title = {Predicting Calls: New Service for an Intelligent Phone}, booktitle = {10th IFIP/IEEE International Conference on Management of Multimedia and Mobile Networks and Services, MMNS 2007}, year = {2007}, month = {11/2007}, address = { San Jos{\'e}, USA}, abstract = {

Predicting future calls can be the next advanced feature of the intelligent phone as the phone service providers are looking to offer new services to their customers. Call prediction can be useful to many applications such as planning daily schedule and attending unwanted communications (e.g. voice spam). Predicting calls is a very challenging task. We believe that this is a new area of research. In this paper, we propose a Call Predictor (CP) that computes the probability of receiving calls and makes call prediction based on caller{\textquoteright}s behavior and reciprocity. The proposed call predictor is tested with the actual call logs. The experimental results show that the call predictor performs reasonably well with false positive rate of 2.4416\%, false negative rate of 2.9191\%, and error rate of 5.3606\%.

}, keywords = {Arrival time, behavior, call matrix, Callee, Caller, Communications, Incoming calls, Inter-arrival time, Inter-arrival/departure time, Kernel density estimation, Outgoing calls, Probability density function (pdf), Receiving call probability, Reciprocity}, doi = {10.1007/978-3-540-75869-3\_3}, author = {Phithakkitnukoon, Santi and Ram Dantu} } @article {10, title = {Socio-technical Defense Against Voice Spamming}, journal = {ACM Trans. Auton. Adapt. Syst.}, volume = {2}, year = {2007}, abstract = {

Voice over IP (VoIP) is a key enabling technology for migration of circuit-switched PSTN (Public Switched Telephone Network) architectures to packet-based networks. One problem of the present VoIP networks is filtering spam calls referred to as SPIT (Spam over Internet Telephony). Unlike spam in e-mail systems, VoIP spam calls have to be identified in real time. Many of the techniques devised for e-mail spam detection rely upon content analysis, and in the case of VoIP, it is too late to analyze the content (voice) as the user would have already attended the call. Therefore, the real challenge is to block a spam call before the telephone rings. In addition, we believe it is imperative that spam filters integrate human behavioral aspects to gauge the legitimacy of voice calls. We know that, when it comes to receiving or rejecting a voice call, people use the social meaning of trust, reputation, friendship of the calling party and their own mood. In this article, we describe a multi-stage, adaptive spam filter based on presence (location, mood, time), trust, and reputation to detect spam in voice calls. In particular, we describe a closed-loop feedback control between different stages to decide whether an incoming call is spam. We further propose formalism for voice-specific trust and reputation analysis. We base this formal model on a human intuitive behavior for detecting spam based on the called party{\textquoteright}s direct and indirect relationships with the calling party. No VoIP corpus is available for testing the detection mechanism. Therefore, for verifying the detection accuracy, we used a laboratory setup of several soft-phones, real IP phones and a commercial-grade proxy server that receives and processes incoming calls. We experimentally validated the proposed filtering mechanisms by simulating spam calls and measured the filter{\textquoteright}s accuracy by applying the trust and reputation formalism. We observed that, while the filter blocks a second spam call from a spammer calling from the same end IP host and domain, the filter needs only a maximum of three calls{\textemdash}even in the case when spammer moves to a new host and domain. Finally, we present a detailed sensitivity analysis for examining the influence of parameters such as spam volume and network size on the filter{\textquoteright}s accuracy

}, keywords = {behavior, reputation, SIP (Session Initiation Protocol), SPIT (Spam over IP Telephony), tolerance, Trust}, issn = {1556-4665}, doi = {10.1145/1216895.1216897}, url = {http://doi.acm.org/10.1145/1216895.1216897}, author = {Kolan, Prakash and Ram Dantu} }