@conference {271, title = {PhD Forum: A System Identification Approach to Monitoring Network Traffic Security}, booktitle = {2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing}, year = {2015}, month = {Nov}, abstract = {

Network security is a growing area of interest for cyber systems, especially given the increasing number of attacks on companies each year. Though there are a vast amount of tools already available, System Identification (SI) complements intrusion detection systems to help manage network traffic stability. SI is the science of building mathematical models of dynamic systems. This paper introduces the use of SI for modeling network traffic and utilizes a linear time invariant model to analyze performance of real connections and attack instances. We generated several ARX models where each represented a different threat state in the network. We utilized the KDD CUP 1999{\textquoteright}s DARPA dataset to analyze the performance when dealing with different attacks. Results show that the average model fit was 84.14\% when determining if the system was experiencing normal traffic. This value is promising because it shows how well the system is able to determine a network state in a given time when fed input.

}, keywords = {ARX, ARX model, autoregressive processes, Computational modeling, computer network security, Computer security, cyber system, dynamic system, Electronic mail, intrusion detection system, linear time invariant model, Mathematical model, Models, network traffic security, network traffic stability, Predictive models, Security, Silicon, System Identification, system identification approach, telecommunication traffic}, doi = {10.1109/CSCloud.2015.85}, author = {Mayo, Quentin and Bryce, Renee and Ram Dantu} } @conference {76, title = {A society-integrated testbed architecture for peer-to-peer telecommunications}, booktitle = {Testbeds and Research Infrastructures for the Development of Networks Communities and Workshops, 2009. TridentCom 2009. 5th International Conference on}, year = {2009}, month = {April}, abstract = {

Exploiting and deploying telecommunication services on Internet Telephony are imperative for a large market share. However, the distributed nature of peer-to-peer (P2P) network makes services implementation very difficult. In order to meet the research goals of achieving P2P telecommunication services through the union of social and computer networks, we present a society-integrated testbed architecture for P2P voice over IP (VoIP). By introducing an architecture that exploits and entailing social structure based connection establishment, the testbed presents an organic integration of social functionalities with good portability. The testbed also serves as a flexible tool suite that can be used to run experiments and obtain timely feedback based on the performance measurements.

}, keywords = {Computer architecture, computer network, computer networks, Computer science, Feedback, file organisation, Internet telephony, network traffic, P2P voice-over-IP, Peer to peer computing, peer-to-peer computing, peer-to-peer telecommunication service, portable social DHT function, Routing protocols, Social network services, society-integrated testbed architecture, software architecture, Telecommunication services, telecommunication traffic, Testing}, doi = {10.1109/TRIDENTCOM.2009.4976215}, author = {Yang, Xiaohui and Ram Dantu and Wijesekera, Duminda} } @conference {56, title = {Quantifying the Presence of Phone Users}, booktitle = {2008 5th IEEE Consumer Communications and Networking Conference}, year = {2008}, month = {Jan}, abstract = {

Presence-enabled telephony services can reduce telephone tag and improve customer satisfaction. In this paper we proposed the Bayesian inference model to calculate the willingness level of the callee to accept calls. Before making a call, the caller may use the willingness calculator to find out whether the callee is available. Based on this level the user can make a decision whether to make a call. For validation of our results, we used actual call logs of 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. We used time of the day, day of the week, talk-time and location for calculating the willingness level Our results show a good agreement between computed willingness level and the number of missed/rejected calls. This service can be included as part of the presence server. When deployed, this service can increase productivity, avoid unwanted calls and reduce the call traffic congestion. This service is beneficial to both subscribers and phone service providers. However, in order to make this service a reality, we need to take into account other factors such social closeness, proximity, multiplexity and reputation of the caller.

}, keywords = {Bayes methods, Bayesian inference model, Bayesian methods, call traffic congestion, Computer science, Context, customer satisfaction, Multimedia communication, Multimedia systems, Network servers, phone service provider, presence-enabled telephony service, Productivity, Roads, telecommunication congestion control, telecommunication traffic, telephony, willingness calculator}, doi = {10.1109/ccnc08.2007.206}, author = {Zhang, Huiqi and Ram Dantu} } @conference {32, title = {Traffic Shaping of Spam Botnets}, booktitle = {2008 5th IEEE Consumer Communications and Networking Conference}, year = {2008}, month = {01/2008}, address = {Las Vegas, NV}, abstract = {

Compromised computers, known as bots, are the major source of spamming. Detecting them can help greatly improve control of unwanted traffic. In this paper, we develop a traffic control mechanism to detect and delay the traffic of suspicious senders and bots. By delaying spammer{\textquoteright}s traffic, it has been reported that 90\% of spam emails can be eliminated. In our proposed mechanism, we group spammers based on their behavior and transmission patterns. These patterns of spammers show high correlation between group members irrespective of geographic location, network ID, content, and kind of receivers. After identification of these botnet groups we applied traffic shaping techniques a pre-filtering analysis to avoid use of automated machines(bots) to spam a particular domain. Thus the source for majority of spam is blocked before reaching email servers. We also identify how randomly the botnets behave and how easy it is to capture a botnet behavior, based on Information theory. To our knowledge, there is no work reported on detecting and mitigating botnets based on their behavior and in particular transmission patterns.

}, keywords = {automated machine, compromised computer, E-mail server, Internet, prefiltering analysis, spam botnets, spammer traffic, spamming, suspicious senders, telecommunication network management, telecommunication traffic, traffic control mechanism, traffic shaping, unsolicited e-mail}, doi = {10.1109/ccnc08.2007.181}, author = {Husna, Husain and Phithakkitnukoon, Santi and Ram Dantu} } @conference {58, title = {Automatic Calibration Using Receiver Operating Characteristics Curves}, booktitle = {2007 2nd International Conference on Communication Systems Software and Middleware}, year = {2007}, month = {Jan}, abstract = {

Application-level filters, such as e-mail and VoIP spam filters, that analyze dynamic behavior changes are replacing static signature-recognition filters. These application-level filters learn behavior and use that knowledge to filter unwanted requests. Because behavior of a service request{\textquoteright}s participating entities changes rapidly, filters must adapt quickly by using end user{\textquoteright}s preferences about receiving that service request message. Many adaptive filters learn from the participating entities{\textquoteright} behavior; however, none configure themselves automatically to an end user{\textquoteright}s changing tolerance levels. Also, filter administrators cannot manually change the threshold for each service request in real time. Traditional adaptive filters fail when administrators must optimize multiple filter thresholds manually and often. Thus, to improve a filter{\textquoteright}s learning, we must automate its threshold-update process. We propose an automatic threshold-calibration mechanism using Receiver Operating Characteristics (ROC) curves that updates the threshold based on an end user{\textquoteright}s feedback. To demonstrate the mechanism{\textquoteright}s real-time applicability, we integrated it in a Voice over IP (VoIP) spam filter that analyzes incoming Spam over IP Telephony (SPIT) calls. Using this mechanism, we observed good improvement in the VoIP spam filter{\textquoteright}s accuracy. Further, computing and updating the optimum threshold in realtime does not impede the filter{\textquoteright}s temporal performance because we update thresholds after each call{\textquoteright}s completion. Because we reach an optimum threshold for any initial setting, this mechanism works efficiently when we cannot predict end-user behavior. Furthermore, automatic calibration proves efficient when using multiple threshold values.

}, keywords = {adaptive filters, application-level filter learning, automatic threshold-calibration mechanism, behavior, calibration, Computer science, Computer worms, Electronic mail, end user feedback, Filtering, information filtering, information filters, Internet telephony, learning (artificial intelligence), Protocols, receiver operating characteristics curves, sensitivity analysis, service request message, telecommunication traffic, Threshold, tolerance, Viruses (medical)}, doi = {10.1109/COMSWA.2007.382484}, author = {Kolan, Prakash and Vaithilingam, Ram and Ram Dantu} }