Multi-Agent Systems (MASs) is a decentralized system that allows multiple agents to collect and transmit data to a central authority for decision making. Although these systems promote collaborative intelligence, privacy preservation is a serious concern. This work specifically addresses inference privacy, deduction of sensitive information from the shared data. Dimensionality reduction techniques, particularly those based on matrix multiplication, have emerged as effective sanitization methods. The process involves multiplying the observed data by a projection matrix to project the high-dimensional data into a lower-dimensional space. We propose a computationally efficient, learning-based dynamic projection method for data sanitization. The proposed method allows the projection matrix to be updated incrementally at each sanitization step using the observed data tuple of the previous step and its sanitized counterpart. The proposed approach captures the evolving structure of the data while avoiding the overhead of full matrix regeneration. Analytical and empirical evaluations show that the proposed method offers a trade-off between data utility and inference privacy.

Abstract A distinctive feature of software‐defined networking (SDN) is a logically centralized control plane realized using multiple physical controllers. The placement of the controllers, the so‐called controller placement problem (CPP), is a crucial design issue. It influences network performance parameters such as latency, flow setup time, network availability, load balance of the controllers, and energy consumption. In this article, we illustrate the formulation of these CPP objectives. We categorize the CPP design solutions as either static or adaptive. In adaptive CPP, the solutions proposed dynamically adapt to the number of controllers required and the switch to controller mapping to varying network traffic. We further differentiate adaptive CPP as wired or wireless. The optimization strategies adopted by the papers are analyzed and grouped into five categories: exact, heuristic, meta‐heuristic, clustering, and game theory. The merits and demerits of each approach are discussed. In conclusion, we outline the research challenges worth investigating.

The centralized control plane of Software Defined Network (SDN) introduces scalability concerns, which is addressed by physically distributing the control plane, although logically centralized. As the task of the control plane is delegated to multiple controllers, the layout of the controllers greatly influence the performance of the network. An important objective that researchers try to optimize while deciding placement of controllers is the flow setup time. This, in turn, depends on the number of flows generated. In this work, we decompose the network traffic into a time series model of flows. We use parametric and non-parametric learning techniques to predict the number of flows for the next epoch based on the current traffic dynamics. Two different real traffic traces have been used to develop the prediction models.

Crowdsourcing has lead to a paradigm shift in the manner commercial houses execute projects by lowering the cost-per-unit of production. A crucial aspect in crowdsourcing is selecting the best set of workers that can perform a task. The environment envisaged in this work is an independent pool of workers, each equipped with a pre-defined set of skills. We assume that these skills do not follow any priority order over each other. Given a task with a set of required skills, our aim is to perform a non-dominated sorting of the workers based on the requirement. From this set of ordered workers, we use domination count to select the best set of workers that can perform the task. Empirical results using real dataset is presented.

The tremendous growth of social media technologies has inspired research communities as well as industries to extend the horizon of organizations by recruiting workers available on freelancing sites. Most of the tasks usually require expertise of workers from diverse domains, thus the problem can be reduced to that of team formation. In this work, we address the problem of assigning workers to tasks, where each task requires a set of skills and thus may require more than one worker to successfully complete the task. Given a set of tasks, and a set of workers each with a cost, the objective is to find mutually exclusive set of workers for each task, who can accomplish the task in the most cost-effective manner. The problem being NP-hard, we propose an approximation algorithm that attempts to find the best fit workers based on their collective intelligence for a single task. This approach selects workers in a manner that their expertise complements each other, hence maintaining a balance among the required skills. Such balanced assignment sets require lesser number of workers and reduce the overall cost. The approach is then extended to a set of N tasks. We show that the solution is (2+ α) approximate. The proposed algorithm is evaluated against different assignment schemes. Experimental results using real data show that our approach performs well.

Latest variants of denial-of-service attack like low-rate denial-of-service attack require very few packets for launching an attack. As a result, reducing the number of packets required for IP traceback has gained considerable importance. In packet marking schemes, routers probabilistically mark the packets. Therefore, a large number of packets is required by the victim to reconstruct the complete attack path. In this paper, we introduce an efficient data structure known as wrap-around counting Bloom filter (WCBF) to minimize the required number of packets. WCBF maintains a set of cyclic counters to decide which particular mark needs to be sent to the victim for faster IP traceback. We prove the efficacy of our technique by performing detailed theoretical analysis and confirm it using extensive experimental results. In case of probabilistic packet marking, the proposed scheme reduces the number of packets by 5–10 times. Likewise, in case of deterministic packet marking, the number of packets required is reduced by 2–4 times. We also show that WCBF can be incorporated with different variants of probabilistic packet marking and deterministic packet marking to obtain effective results. Finally, we highlight the benefits of WCBF over the other traceback schemes like logging and hybrid traceback. Copyright © 2016 John Wiley & Sons, Ltd.

In recent years, CAPTCHA has been used as a panacea against HTTP-based Distributed Denial of Service (DDoS) attacks. However, they also cause a lot of inconvenience to legitimate users. In this paper, we present a framework to exploit the synchronized behaviour of bots to exhaust Web server resources. Clustering technique is used to form separate group of attackers and legitimate users. The clusters of attackers are identified by the high workload they generate on the server. They are challenged with CAPTCHAs to mitigate the attack while the legitimate users browse the website without any restriction. The proposed framework was tested using botnets and real web traffic. Results show our frame work has a high detection rate.

Abstract Network‐based attacks such as denial‐of‐service attacks are usually performed by spoofing the source IP address. Packet marking techniques are used to trace such attackers as close as possible to their source. A packet mark consists of some traceback information pertaining to a router being embedded in the IP packet header. In this work, we use the concept of star coloring to assign reusable colors (marks) to routers but at the same time limits false positives and false negatives. The proposed scheme minimizes the bit space required for marking in the IP header. We introduce the concept ofpath identifier, to identify an attack path. Thepath identifiersare used to provide an elegant solution to collect attack packets in the midst of a distributed denial‐of‐service attack and then traceback. Although identifying the attacker is crucial to institute protection measures against future attacks, it cannot mitigate the effects of an ongoing attack. We establish the use ofpath identifiers, to filter packets during an ongoing attack. We present a validation of the proposed techniques in an emulated environment using real attack traffic. Copyright © 2014 John Wiley & Sons, Ltd.

Firewall is an integral part of security management. Network speed may vary depending on the efficiency of the firewall. So firewall optimization plays a dominant role in network flow. In this paper, we propose a way to analyze network traffic and dynamically arrange the firewall rules according to the temporal nature of the traffic. The firewall works in two stages. In the first stage, the firewall uses early rejection technique to filter out known malicious traffic. In the second stage, the firewall uses segmentation based tree search to optimize the overhead of matching incoming packet. Further to make the firewall adapt to dynamic nature of Internet traffic, we define parameters to continuously measure traffic characteristic and rebuild the stages when a threshold is exceeded. The traffic-aware firewall is implemented using C language and validated using real traffic traces.

Distributed Denial-of-Service (DDoS) attacks are one of the major threats the Internet is facing today. The problem of tracing the attackers is particularly difficult since attackers spoof the source addresses. Researchers all over the world have proposed several packet marking based techniques for DDoS attack mitigation using IP Traceback, however even after a decade of active research no commercial product incorporates any of these packet marking techniques; either because they add overhead in network traffic or they break some of the existing internet features like IP fragmentation. In this paper, we propose a novel scheme which performs IP Traceback but adds no space overhead and yet is fragmentation compatible. We show that our scheme produces negligible false positive and causes almost no collision in ID field for fragmentation and reassembly. As this scheme is simple to implement and has very less processing and storage overhead at the victim and routers, it makes it a suitable candidate for widespread acceptance in the internet community and industry for DDoS attack prevention and mitigation.