Botnet, a group of coordinated bots, is becoming the main platform of malicious Internet activities like DDOS, click fraud, web scraping, spam/rumor distribution, etc. This paper focuses on design and experiment of a new approach for botnet detection from streaming web server logs, motivated by its wide applicability, real-time protection capability, ease of use and better security of sensitive data. Our algorithm is inspired by a Principal Component Analysis (PCA) to capture correlation in data, and we are first to recognize and adapt Lanczos method to improve the time complexity of PCA-based botnet detection from cubic to sub-cubic, which enables us to more accurately and sensitively detect botnets with sliding time windows rather than fixed time windows. We contribute a generalized online correlation matrix update formula, and a new termination condition for Lanczos iteration for our purpose based on error bound and non-decreasing eigenvalues of symmetric matrices. On our dataset of an ecommerce website logs, experiments show the time cost of Lanczos method with different time windows are consistently only 20% to 25% of PCA.

This paper presents a non-trivial reconstruction of a previous joint topic-sentiment-preference review model TSPRA with stick-breaking representation under the framework of variational inference (VI) and stochastic variational inference (SVI). TSPRA is a Gibbs Sampling based model that solves topics, word sentiments and user preferences altogether and has been shown to achieve good performance, but for large dataset it can only learn from a relatively small sample. We develop the variational models vTSPRA and svTSPRA to improve the time use, and our new approach is capable of processing millions of reviews. We rebuild the generative process, improve the rating regression, solve and present the coordinate-ascent updates of variational parameters, and show the time complexity of each iteration is theoretically linear to the corpus size, and the experiments on Amazon datasets show it converges faster than TSPRA and attains better results given the same amount of time. In addition, we tune svTSPRA into an online algorithm ovTSPRA that can monitor oscillations of sentiment and preference overtime. Some interesting fluctuations are captured and possible explanations are provided. The results give strong visual evidence that user preference is better treated as an independent factor from sentiment.

Network alignment is becoming an active topic in network data analysis. Despite extensive research, we realize that efficient use of topological and attribute information for large attributed network alignment has not been sufficiently addressed in previous studies. In this paper, based on Stochastic Block Model (SBM) and Dirichlet-multinomial, we propose "divide-and-conquer" models CAlign that jointly consider network alignment, community discovery and community alignment in one framework for large networks with node attributes, in an effort to reduce both the computation time and memory usage while achieving better or competitive performance. It is provable that the algorithms derived from our model have sub-quadratic time complexity and linear space complexity on a network with small densification power, which is true for most real-world networks. Experiments show CAlign is superior to two recent state-of-art models in terms of accuracy, time and memory on large networks, and CAlign is capable of handling millions of nodes on a modern desktop machine.

Online Social Networks (OSNs) have attracted intensive attention for the reason that they provide users a convenient platform to share ideas, post events, and disseminate messages. Each OSN user commonly owns multiple social applications (Facebook, Google Plus and Twitter, etc.). They enjoy disseminating messages within one particular social application as well as forwarding interesting information to other social applications. In OSNs, some time-insensitive messages (disaster warnings, virus alerts, and search notices, etc.) are badly in need of being disseminated to specific users or applications as soon as possible. However, sudden message dissemination among users is bound to put a significant burden on network resources. Taking the dissemination cost into consideration, we propose a lightweight Message Dissemination strategy for Minimizing Delay in OSNs (MDMD), which first defines the user's activeness according to the switch habit, among different social applications. Furthermore, depending on the activeness, an optimal user within each social application is selected to assist in disseminating the message. Simulation results show that, compared with other dissemination strategies, MDMD achieves the lowest average delay, and lower average hopcounts.

The data delivery in Vehicular Ad Hoc Networks (VANETs) depends on the mobility of the vehicles (e.g. with carry-and-forward). However, the mobility of the vehicles is not only affected by the nodes themselves, but also by some external means such as the traffic lights. The red light stops the vehicles at the intersection, which will increase the delivery delay of the messages carried by the vehicle with waiting time. On the contrary, this may also increase the opportunities of vehicles moving behind to catch up in forwarding messages. In this paper, we investigate the negative and positive influences of the traffic lights on data delivery in VANETs. We develop an analysis model for evaluating the data delivery among the vehicles that move along a path with multiple traffic lights. Based on the model, vehicles can estimate the reachability of destinations and the data delivery delay. Thus, we propose a transmission control scheme by the given deadline of reachable destinations, in order to improve the data delivery. Our intensive simulations verify the proposed model, and evaluate the influence of the traffic lights on data delivery.

Social behavior plays a more and more important role in delay tolerant networks (DTNs). In this paper, we present an analytical model for a hypercube-based social feature multipath routing protocol in DTNs. In this routing protocol, we use the internal social features of each node (individual) in the network for routing guidance. This approach is motivated from several real social contact networks, which show that people contact each other more when they have more social features in common. This routing scheme converts a routing problem in a highly mobile and unstructured contact space (M-space) to a static and structured feature space (F-space). The multipath routing process is a hypercube-based feature matching process where the social feature differences are resolved step-by-step. A feature matching shortcut algorithm for fast searching is presented where more than one feature difference is resolved at one time. The multiple paths for the routing process are node-disjoint. We formally analyze the delivery rate and latency by using hypercube-based routing. The solutions for the expected values of latency and delivery rate are given under different path conditions: single-/multipath and feature difference resolutions with/without shortcuts. Extensive simulations on both real and synthetic traces are conducted in comparison to several existing state-of-the-art DTN routing protocols.

With the rapid growth of smartphone usage, mobile social networks (MSNs) are becoming increasingly popular. MSN can be considered as a type of delay tolerant network (DTN) which lacks continuous end-to-end connections between nodes, due to the node mobility and limited transmission range. Inspired by the homophily of social networks that friends are usually similar in characteristics, we present a novel concept - cloud, where the nodes in frequent contact with the destinations will form destination clouds. Neighbors in the destination cloud have a special status that can forward the message to the destination directly. We propose a cloud-based multicast scheme with feedback in MSNs with two phases: pre-cloud and inside-cloud. In the pre-cloud process, the message holder will forward the copy of the multicast message to the encountered node, based on a given forwarding metric. The forwarding metric can be iteratively refined from a feedback control mechanism. In the inside-cloud process, the message holder will wait until it meets with the destinations. We analytically formulate the multicast problem into a continuous Markov chain problem, and formally analyze the latency in this model. Extensive trace-driven simulations show that our scheme significantly improves the performance compared to existing schemes.