Owing to the critical role of the domain name system (DNS), its query log data are utilized for various network monitoring purposes. With the diversification of network services, these data have become increasingly complex, making mining useful information challenging. DNS query log data can be considered as the superposition of two types of communication patterns: groups of domains accessed simultaneously (e.g., ad servers and content delivery network (CDN) servers) and time-series access patterns based on user behavior characteristics (e.g., access trends during the night). However, previous studies have not focused on extracting both access patterns hidden in the data. This study proposes a method that extracts both patterns of accessed domains and temporal access patterns as user communication behaviors from DNS query log data and predicts future accesses based on these patterns. The proposed method first aggregates similar fully qualified domain names (FQDNs) associated with the same service. We then present temporal regularized nonnegative tensor factorization (TR-NTF) that extracts both access patterns from a third-order tensor expressing DNS query log data and enables prediction. We evaluate the proposed method using synthetic and actual data and demonstrate that it successfully extracts hidden communication patterns and achieves sufficient prediction accuracy.

Location-based service (LBS) is a typical application for mobile ad hoc networks (MANETs). In an LBS, it is effective for nodes to acquire data using convex hull queries, which retrieve the information necessary for calculating the convex hull of all nodes composing a given network. In a naive approach, the query-issuing node can determine the convex hull of the network by flooding a query throughout the entire network and receiving location information on all the nodes, but this involves excessive traffic. In addition, since the network topology changes dynamically, due to the movement of nodes, the set of vertices of the convex hull changes. Therefore, the query-issuing node must determine the convex hull in a short period of time. In this paper, we propose convex hull query processing methods for reducing traffic and response time while maintaining high accuracy of the query result in MANETs. In these methods, nodes reply with information on nodes which are convex hull vertices. In the Local Convex Hull (LCH) method, nodes reply with information on nodes which are vertices of the local convex hull, which is the convex hull composed of nodes whose information has already been received. In the Local Wrapping (LW) method, the query is transmitted only to nodes on the outer boundary. Experimental results show that our proposed methods reduce traffic and achieve short response time and high accuracy of the query result, in comparison with a naive method.

In this paper, we propose a signature-based top-k query processing method against data replacement attacks in mobile ad hoc networks (MANETs). In order to rapidly identify a greater number of malicious nodes, nodes share information about identified malicious nodes with other nodes. If nodes share only this information, however, malicious nodes may successfully transmit false information identifying normal nodes as malicious. Therefore, in the proposed method, when nodes send reply messages during query processing, they attach encrypted information about the sent data items (i.e., digital signatures), providing the query-issuing node with critical information about the data items sent by nodes in the network, and thereby enabling it to identify malicious nodes, using the received signatures. After identifying the malicious nodes, it floods the network with a notification message including the signatures in which the identified malicious nodes have replaced higher-score data items to their own lower-score items.

In mobile ad hoc networks (MANETs), it is effective for mobile nodes to retrieve data items using top-k queries, in which data items are ordered according to a particular attribute score, and the query-issuing node acquires the data items with the k highest scores. However, accurate results may not be acquired in environments where malicious nodes are present. In top-k queries, it is important to neutralize attacks in which malicious nodes attempt to replace necessary data items with unnecessary ones (we call these, data replacement attacks). In this paper, we propose methods for top-k query processing and malicious node identification against data replacement attack in MANETs. In the top-k query processing method, in order to maintain accuracy of the query result, nodes reply with data items with the k highest scores, along multiple routes. Moreover, to enable detection of data replacement attacks, reply messages include information on the route along which reply messages are forwarded, and thus the query-issuing node can know the data items that properly belong to the message. In the malicious node identification method, the query-issuing node first narrows down the malicious node candidates, using the received message information, and then requests information on the data items sent by these candidates. In this way, the query-issuing node can identify the malicious node. Finally, we verify, through simulation experiments, that the proposed top-k query processing method achieves high accuracy of the query result, and that the malicious node identification method effectively identifies a malicious node.

In mobile ad hoc networks (MANETs), locationbased service (LBS) is a typical application. In a LBS, it is valuable for each node to grasp the convex hull of nodes which compose a network by using a convex hull query. However, if the query-issuing node acquires the information on all the nodes, the information on nodes which are not the vertexes of the convex hull is replied, which is unnecessary for a convex hull detection. In this paper, we propose a convex hull query processing method, which reduces traffic and also maintains high accuracy of the query result in MANETs. An experimental result shows that our proposed method reduces traffic and achieves high accuracy of the query result compared with a naive method.

In this paper, we propose two beacon-less kNN query processing methods for reducing traffic and maintaining high accuracy of the query result in mobile ad hoc networks (MANETs). In these methods, the query-issuing node first forwards a kNN query using geo-routing to the nearest node from the point specified by the query (query point). Then, the nearest node from the query point forwards the query to other nodes close to the query point, and each node receiving the query replies with the information on itself. In this process, we adopt two different approaches: the Explosion (EXP) method and the Spiral (SPI) method. In the EXP method, the nearest node from the query point floods the query to nodes within a specific circular region, and each node receiving the query replies with information on itself. In the SPI method, the nearest node from the query point forwards the query to other nodes in a spiral manner, and the node that collects a satisfactory kNN result transmits the result to the query-issuing node. Experimental results show that our proposed methods reduce traffic and achieve high accuracy of the query result, in comparison with existing methods.

In a kNN query processing method, it is important to appropriately estimate the range that includes kNNs. While the range could be estimated based on the node density in the entire network, it is not always appropriate because the density of nodes in the network is not uniform. In this paper, we propose two kNN query processing methods in MANETs where the density of nodes is ununiform; the One-Hop (OH) method and the Query Log (QL) method. In the OH method, the nearest node from the point specified by the query acquires its neighbors' location and then determines the size of a circle region (the estimated kNN circle) which includes kNNs with high probability. In the QL method, a node which relays a reply of a kNN query stores the information on the query result for future queries.

In mobile ad hoc networks (MANETs), location based service (LBS) is a typical application. In a LBS, it is effective for each node to acquire data using a k Nearest Neighbor (kNN) query, which retrieves the information on the nearest k nodes from the location specified by the query. However, existing methods for kNN query processing in wired networks and wireless sensor networks cannot be applied in MANETs dueto the movement of mobile nodes. In this paper, we propose the Explosion (EXP) method, which is a kNN query processing method for reducing traffic and also keeping high accuracy of the query result in MANETs. An experimental result shows that our proposed method reduces traffic and achieves high accuracy of the query result compared with a naive method.