@conference {271, title = {PhD Forum: A System Identification Approach to Monitoring Network Traffic Security}, booktitle = {2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing}, year = {2015}, month = {Nov}, abstract = {

Network security is a growing area of interest for cyber systems, especially given the increasing number of attacks on companies each year. Though there are a vast amount of tools already available, System Identification (SI) complements intrusion detection systems to help manage network traffic stability. SI is the science of building mathematical models of dynamic systems. This paper introduces the use of SI for modeling network traffic and utilizes a linear time invariant model to analyze performance of real connections and attack instances. We generated several ARX models where each represented a different threat state in the network. We utilized the KDD CUP 1999{\textquoteright}s DARPA dataset to analyze the performance when dealing with different attacks. Results show that the average model fit was 84.14\% when determining if the system was experiencing normal traffic. This value is promising because it shows how well the system is able to determine a network state in a given time when fed input.

}, keywords = {ARX, ARX model, autoregressive processes, Computational modeling, computer network security, Computer security, cyber system, dynamic system, Electronic mail, intrusion detection system, linear time invariant model, Mathematical model, Models, network traffic security, network traffic stability, Predictive models, Security, Silicon, System Identification, system identification approach, telecommunication traffic}, doi = {10.1109/CSCloud.2015.85}, author = {Mayo, Quentin and Bryce, Renee and Ram Dantu} } @conference {101, title = {Current and Future Trends in Social Media}, booktitle = {2011 IEEE Third Int{\textquoteright}l Conference on Privacy, Security, Risk and Trust and 2011 IEEE Third Int{\textquoteright}l Conference on Social Computing}, year = {2011}, abstract = {

Social networking has been the biggest cultural shift since the industrial revolution, attracting millions of people, creating an ever-expanding social web, and revolutionizing the way we communicate. Although many changes have occurred since the fledgling steps of social networking and what it has evolved into today, improvement is a never-ending cycle. Thus, in this paper, additional methods will be explored to advance social networking overall.

}, keywords = {Buildings, Electronic mail, Facebook, Media, Online Social Networks, Privacy, Social Media, Social Network Trends, Twitter}, doi = {10.1109/PASSAT/SocialCom.2011.125}, author = {Baatarjav, Enkh-Amgalan and Ram Dantu} } @conference {17, title = {Behavior analysis of spam botnets}, booktitle = {2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE {\textquoteright}08)}, year = {2008}, abstract = {

Compromised computers, known as bots, are the major source of spamming and their detection helps greatly improve control of unwanted traffic. In this work we investigate the behavior patterns of spammers based on their underlying similarities in spamming. To our knowledge, no work has been reported on identifying spam botnets based on spammerspsila temporal characteristics. Our study shows that the relationship among spammers demonstrates highly clustering structures based on features such as content length, time of arrival, frequency of email, active time, inter-arrival time, and content type. Although the dimensions of the collected feature set is low, we perform principal component analysis (PCA) on feature set to identify the features which account for the maximum variance in the spamming patterns. Further, we calculate the proximity between different spammers and classify them into various groups. Each group represents similar proximity. Spammers in the same group inherit similar patterns of spamming a domain. For classification into Botnet groups, we use clustering algorithms such as Hierarchical and K-means.We identify Botnet spammers into a particular group with a precision of 90\%.

}, keywords = {behavior pattern analysis, Botnets, Classification algorithms, clustering algorithm, Clustering algorithms, Correlation, Electronic mail, feature set, Filtering, information filtering, invasive software, maximum variance, pattern classification, pattern clustering, PCA, principal component analysis, spam filtering, Time frequency analysis, unsolicited e-mail, unwanted traffic control}, doi = {10.1109/COMSWA.2008.4554418}, author = {Husna, Husain and Phithakkitnukoon, Santi and Palla, Srikanth and Ram Dantu} } @conference {58, title = {Automatic Calibration Using Receiver Operating Characteristics Curves}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Application-level filters, such as e-mail and VoIP spam filters, that analyze dynamic behavior changes are replacing static signature-recognition filters. These application-level filters learn behavior and use that knowledge to filter unwanted requests. Because behavior of a service request{\textquoteright}s participating entities changes rapidly, filters must adapt quickly by using end user{\textquoteright}s preferences about receiving that service request message. Many adaptive filters learn from the participating entities{\textquoteright} behavior; however, none configure themselves automatically to an end user{\textquoteright}s changing tolerance levels. Also, filter administrators cannot manually change the threshold for each service request in real time. Traditional adaptive filters fail when administrators must optimize multiple filter thresholds manually and often. Thus, to improve a filter{\textquoteright}s learning, we must automate its threshold-update process. We propose an automatic threshold-calibration mechanism using Receiver Operating Characteristics (ROC) curves that updates the threshold based on an end user{\textquoteright}s feedback. To demonstrate the mechanism{\textquoteright}s real-time applicability, we integrated it in a Voice over IP (VoIP) spam filter that analyzes incoming Spam over IP Telephony (SPIT) calls. Using this mechanism, we observed good improvement in the VoIP spam filter{\textquoteright}s accuracy. Further, computing and updating the optimum threshold in realtime does not impede the filter{\textquoteright}s temporal performance because we update thresholds after each call{\textquoteright}s completion. Because we reach an optimum threshold for any initial setting, this mechanism works efficiently when we cannot predict end-user behavior. Furthermore, automatic calibration proves efficient when using multiple threshold values.

}, keywords = {adaptive filters, application-level filter learning, automatic threshold-calibration mechanism, behavior, calibration, Computer science, Computer worms, Electronic mail, end user feedback, Filtering, information filtering, information filters, Internet telephony, learning (artificial intelligence), Protocols, receiver operating characteristics curves, sensitivity analysis, service request message, telecommunication traffic, Threshold, tolerance, Viruses (medical)}, doi = {10.1109/COMSWA.2007.382484}, author = {Kolan, Prakash and Vaithilingam, Ram and Ram Dantu} }