Microservices architecture (MSA) has become increasingly popular in modern application development. Like other distributed systems, it amplifies trust and security challenges. The current trend of distributed databases combined with numerous points of entry in MSA emphasizes the importance of robust authentication and data trustworthiness verification. Existing mutual authentication mechanisms typically stop at connection-level security and often lack support for data origin verification upon arrival. Meanwhile, data lineage solutions are retrospective and heavily dependent on metadata. Our bidirectional authentication with provable on-demand data lineage ensures mutual authentication while providing proactive and provable verification of data origin and traversal paths. It is distinctive for its ZKP segmentation, which utilizes the Dirichlet Distribution to provide inherited randomness and provable path traversal during proof reconstruction. We experimentally validated the correctness and practicality of our platform using OpenTelemetry Demo. Load testing on this microservices-based system with 500 concurrent users demonstrated $\mathbf{1 0 0 \%}$ accuracy in blocking unauthorized path deviation, ZKP circuit mismatches, and segment mismatches. Furthermore, both security and threat analyses confirm the robustness of security and the guarantee of provable data origin.

The growing integration of microservices exacerbates the mounting concern over privacy and trust caused by frequent data leaks and breaches. These systems are inherently decentralized, making them harder to manage, increasing the attack surface, and complicating trust between independently deployed services. Despite these persistent challenges, trust and authentication are often handled using centralized and stateful methods that require storing extensive state information. Existing so-called stateless authentication methods typically shift state storage from the server to the client side rather than detaching from state dependency. To address this challenge, we propose a lightweight, scalable, and truly stateless authentication approach that is non-idempotent and utilizes self-resetting nested Zero-Knowledge Proofs (ZKPs) to eliminate reliance on past actions. This platform anticipates user intentions and rigorously monitors them, ensuring bidirectional operational integrity while preserving privacy. Specifically, the self-resetting ZKP mechanism leverages the dynamic nature of microservices and incorporates random proof segmentation as a random generator to ensure each request is unique. Our tests using the OpenTelemetry Demo confirm its functionality and the independence between requests. Furthermore, security analysis demonstrates comprehensive security through non-idempotent authentication and the uniqueness of proof segmentation for each request.

Generation of random binary numbers for cryptographic use is often addressed using pseudorandom number generating functions in compilers and specialized cryptographic packages. Using the IBM's Qiskit reset functionality, we were able to implement a straight-forward in-line Python function that returns a list of quantum-generated random numbers, by creating and executing a circuit on IBM quantum systems.

There are a number of issues facing us today regarding data privacy and data access. While most individuals and organizations would like to use their data in ways that benefit themselves and others, current solutions leave much to be desired from a privacy and security standpoint. Alex Pentland, et al. proposed using data as a form of capital and designed data cooperatives as a means to share and extract value from data. Their work on data cooperatives is akin to designing a data model, in that it was abstract, high-level, and focused on the capabilities it brings to bear (in-line with their research focus). This work proposes a more concrete way of building a data cooperative and addresses some of the real-world pain points of implementing a data cooperative using homomorphic encryption (HE) to secure data. This work was conducted focusing on pooling data between untrusting partners for cooperative cyber-defense. First, there is a design for different internal components for building a data cooperative. Next, this work implements a federated graph storage technique for a graph database that works symbiotically with the novel HE query watchdog. This watchdog enforces k-anonymity (via rules derived from the privacy policy) on top of HE and ensures no query that violated k-anonymity along any step will ever have its result delivered. This work then demonstrates numerous commonly used graph algorithms with modified implementations to work over HE. Finally, given the burden of HE, this work explores methods to reduce the burden of HE on the data cooperative, while still ensuring k-anonymity for all participants and security concerns are addressed.

Article proposing the use of anonymization techniques coupled with graph algorithms over homomorphically encrypted (HE) graphs as a basis of analysis for this accumulated data. This approach ensures individuals’ privacy and anonymity while preserving the usefulness of the plaintext data. This article was originally presented at the 18th International Conference on Security and Cryptography - SECRYPT.

The size, number, and complexity of networks continue to increase at an extraordinary rate. Ensuring that these networks' security measures, such as Intrusion Detection Systems (IDS) and firewalls, are properly configured is more important than ever given the number of attacks that are occurring on a daily basis. This paper takes a more holistic view to address four key areas of network security, arguing that security is everyone's responsibility. With this in mind, we look at how information about the security of a network can be collected and translated into effective and reliable security policies and then validate that this information was translated correctly to accomplish the desired outcomes. We then propose a solution through the development, testing, and verification of a new network security instrument that allows natural language to be used to create IDS and firewall rules. With the use of this solution, novices who know little about network security can create effective policies and be satisfied that their networks are secure. This solution was implemented within OpenStack's cloud environment and supports a web interface that allows users to input rules using drop-down lists or open text areas. Using this network security instrument, 1000 input policies were collected from users of varying experience levels. Analysis of the collected data has shown its accuracy to be approximately 90.7% with room for further improvement still possible through further development.

The growing popularity of streaming audio/video is enhancing the popularity of real-time media applications and services. People use real-time media applications for voice/video calls as well. Real-time Transport Protocol is a well-known protocol solely used for real-time data transmission, which uses the Voice over IP technology. Nevertheless, like other Internet applications, the security aspect has become a significant issue for real-time media applications. To protect users' privacy, real-time data such as streaming video or audio/video calls can be encrypted during the conversation. Some real-time applications use symmetric key encryption to protect the media data. However, this cannot ensure the security of real-time media. An asymmetric key encryption technique can be a better choice in this context. Among other asymmetric key encryption schemes, Elliptic Curve Cryptography (ECC) performs better due to its comparatively smaller key size and lesser computation time. We must choose the elliptic curves judiciously to encrypt the voice call, because audio encryption may increase end-to-end delay, which worsens the quality of the call. The appropriate elliptic curves can be chosen from a set of elliptic curves by analyzing their performance on real-time audio encryption. In this work, we have implemented an ECC based encryption technique in a softphone to encrypt real-time voice calls. We have used 15 elliptic curves to measure the performance of audio calls, and based on the result, have proposed some suitable elliptic curves for real-time audio encryption.

While Distributed Denial of Service (DDoS) attacks continue to plague the Internet, Software Defined Networks (SDNs) offer the promise of configuration elasticity for all devices in the plant to mitigate these attacks and stabilize the network in real-time. Since it is difficult to distinguish between legitimate and attack traffic, we propose a closed-loop feedback control mechanism using a multi-loop proportional, integral (PI) controller and a model predictive controller (MPC) that will regulate the system characteristics with disturbance rejection. Results from our setup implemented in the SDN platform show that our dynamic and predictive control models provide for a graceful degradation of real-time services in the SDN environment in real-time.

We present CMCAP (context-mapped capabilities), a decentralized mechanism for specifying and enforcing adaptive access control policies for resource-centric security. Policies in CMCAP express runtime constraints defined as containment domains with context-mapped capabilities, and ephemeral sandboxes for dynamically enforcing desired information flow properties while preserving functional correctness for the sandboxed programs. CMCAP is designed to remediate DAC's weakness and address the inflexibility that makes current MAC frameworks impractical to the common user. We use a Linux-based implementation of CMCAP to demonstrate how a program's dynamic profile is used for access control and intrusion prevention.

Verifying protocol implementations via application analysis can be cumbersome. Rapid development cycles of both the protocol and applications that use it can hinder up-to-date analysis. A better approach is to use formal models to characterize the applications platform and then verify the protocol through analysis of the network traffic tied to the models. To test this method, the popular protocol OAuth is considered. Currently, formal models of OAuth do not take into consideration the mobile environment, and implementation verification is largely based on code analysis. Our preliminary results are two fold; we sketch an extension to a formal model that incorporates the specifics of the Android platform and classify OAuth device types using machine learning on encrypted VPN traffic.

Due to the advantages of blockchain technologies, including decentralization, immutability, transparency and security, people try to replace existing problematic architectures /frameworks with blockchain based ones. In this paper we propose a novel authentication and authorization framework based on blockchain technologies to control access to the resources of an IoT device. In this paper, we focus on devices such as the Cyber Handyman used in remote collaboration applications to develop our framework. We tested our smart contracts on the Ropsten test network. Our results showed that it can handle 25 service requests simultaneously.

The field of vehicular cybersecurity has received considerable media and research attention in the past few years. Given the increasingly connected aspect of consumer automobiles, along with the inherent danger of these machines, there has been a call for experienced security researchers to contribute towards the vehicle security domain. The proprietary nature of Controller Area Network (CAN) bus messages, however, creates a barrier of entry for those unfamiliar, due to the need to identify what the messages on a given vehicle's bus are broadcasting. This work aims to automate the process of correlating CAN bus messages with specific Electronic Control Unit (ECU) functions in a new vehicle, by creating a machine learning classifier that has been trained on a dataset of multiple vehicles from different manufacturers. The results show that accurate classification is possible, and that some ECUs that broadcast similar vehicle dynamics broadcast similar CAN messages.

Network security is a growing area of interest for cyber systems, especially given the increasing number of attacks on companies each year. Though there are a vast amount of tools already available, System Identification (SI) complements intrusion detection systems to help manage network traffic stability. SI is the science of building mathematical models of dynamic systems. This paper introduces the use of SI for modeling network traffic and utilizes a linear time invariant model to analyze performance of real connections and attack instances. We generated several ARX models where each represented a different threat state in the network. We utilized the KDD CUP 1999's DARPA dataset to analyze the performance when dealing with different attacks. Results show that the average model fit was 84.14% when determining if the system was experiencing normal traffic. This value is promising because it shows how well the system is able to determine a network state in a given time when fed input.

Conventional authentication methods utilizing alphanumeric username and passwords, PIN numbers, or any combination thereof have many weaknesses. On modern smart phones there are multiple ways users can authenticate. The traditional username password combination is used often as well as PIN passwords and pattern based passwords. The problem with these methods is that they are still vulnerable. A short password or to a much greater extent a PIN, or a pattern password can be defeated by various techniques such as smudge attacks, key loggers and so on. Our aim with Pass-Pic is to implement a picture based authentication system that is both more secure and easier for the user to both input and remember.

The intention of an Android application, determined by the source code analysis is used to identify potential maliciousness in that application (app). Similarly, it is possible to analyze the unintentional behaviors of an app to identify and reduce the window of vulnerabilities. Unintentional behaviors of an app can be any developmental loopholes such as software bugs overlooked by a developer or introduced by an adversary intentionally. FindBugsTMand Android Lint are a couple of tools that can detect such bugs easily. A software bug can cause many security vulnerabilities (known or unknown) and vice-versa, thus, creating a many-to-many mapping. In our approach, we construct a matrix of mapping between the bugs and the potential vulnerabilities. A software bug detection tool is used to identify a list of bugs and create an empirical list of the vulnerabilities in an app. The many-to-many mapping matrix is obtained by two approaches - severity mapping and probability mapping. These mappings can be used as tools to measure the unknown vulnerabilities and their strength. We believe our study is the first of its kind and it can enhance the security of Android apps in their development phase itself. Also, the reverse mapping matrix (vulnerabilities to bugs) could be used to improve the accuracy of malware detection in Android apps.

Confidentiality for DNS transactions has been a low-priority concern in DNS security for a long time due to performance requirements for the functionality of DNS and the fact that data in the DNS is considered public. However, the information carried in DNS transactions, if collected and analyzed, can pose real threats to personal privacy. This makes DNS a good target for passive eavesdropping to collect data for many purposes some of which may be malicious. The protocol described in this document is intended to facilitate an opportunistic negotiation of encryption in the DNS to provide confidentiality for the last mile of DNS resolution. It defines procedures to discover encryption-aware servers and how to establish a relationship with them with minimum overhead.

With the increasing ability to accurately classify activities of mobile users from what was once viewed as innocuous mobile sensor data, the risk of users compromising their privacy has risen exponentially. Currently, mobile owners cannot control how various applications handle the privacy of their sensor data, or even determine if a service provider is adversarial or trustworthy. To address these privacy concerns, third party applications have been designed to allow mobile users to have control over the data that is sent to service providers. However, these applications require users to set flags and parameters that place restrictions on the anonymized or real sensor data that is sent to the requestor. Therefore, in this paper, we introduce a new framework, RANDSOM, that moves the decision-making from the application level to the operating system level.

Security and privacy holds a great importance in mobile devices due to the escalated use of smart phone applications (app). This has made the user even more vulnerable to malicious attacks than ever before. We aim to address this problem by proposing a novel framework to identify potential Android malware apps by extracting the intention and their permission requests. First, we constructed a dataset consisting of 1,730 benign apps along with 273 malware samples. Then, both datasets were subjected to source code extraction. From there on, we followed a two phase approach to identify potential malware samples. In phase 1, we constructed a machine learning model to group benign apps into different clusters based on their operations known as the task-intention. Once we trained the model, it was used to identify the task-intention of an Android app. Further, in this phase, we only used the benign apps to construct the task-intentions and none of the malware signatures were involved. Therefore, our approach does not use machine learning models to identify malware apps. Then, for each task-intention group, we extracted the permission-requests of the apps and constructed the probability mass functions (PMF). We named the shape of this PMF as Intention-Shape or I-Shape. In phase 2, we used the permission-requests, task-intentions and I-Shapes to identify potential malware apps. We compared the permission-requests of an unknown app with its corresponding I-Shape to identify the potential malware apps. Using this approach, we obtained an accuracy of 89% in detecting potential malware samples. The novelty of our work is to perform potential malware identification without training any models with malware signatures, and utilization of I-Shapes to identify such potential malware samples. Our approach can be utilized to identify the safety of an app before it is installed as it performs static code analysis. Further, it can be utilized in pre-screening or multi-layer security systems. It is also highly useful in screening malware apps when launching in Android markets.

Fine-grained localization is extremely important to accurately locate a user indoors. Although innovative solutions have already been proposed, there is no solution that is universally accepted, easily implemented, user centric, and, most importantly, works in the absence of GSM coverage or WiFi availability. The advent of sensor rich smartphones has paved a way to develop a solution that can cater to these requirements. By employing a smartphone's built-in magnetic field sensor, magnetic signatures were collected inside buildings. These signatures displayed a uniqueness in their patterns due to the presence of different kinds of pillars, doors, elevators, etc., that consist of ferromagnetic materials like steel or iron. We theoretically analyze the cause of this uniqueness and then present an indoor localization solution by classifying signatures based on their patterns. However, to account for user walking speed variations so as to provide an application usable to a variety of users, we follow a dynamic time-warping-based approach that is known to work on similar signals irrespective of their variations in the time axis. Our approach resulted in localization distances of approximately 2m--6m with accuracies between 80--100% implying that it is sufficient to walk short distances across hallways to be located by the smartphone. The implementation of the application on different smartphones yielded response times of less than five secs, thereby validating the feasibility of our approach and making it a viable solution.

As vehicle manufacturers continue to increase their emphasis on safety with advanced driver-assistance systems (ADASs), we propose a device that is not only already in abundance but portable enough as well to be one of the most effective multipurpose devices that are able to analyze and advise on safety conditions. Mobile smartphones today are equipped with numerous sensors that can help to aid in safety enhancements for drivers on the road. In this paper, we use the three-axis accelerometer of an Android-based smartphone to record and analyze various driver behaviors and external road conditions that could potentially be hazardous to the health of the driver, the neighboring public, and the automobile. Effective use of these data can educate a potentially dangerous driver on how to safely and efficiently operate a vehicle. With real-time analysis and auditory alerts of these factors, we can increase a driver's overall awareness to maximize safety.

Many mobile phone applications such as pedometers and navigation systems rely on orientation sensors that most smartphones are now equipped with. Unfortunately, these sensors rely on measured accelerometer and magnetic field data to determine the orientation. Thus, accelerations upon the phone which arise from everyday use alter orientation information. Similarly, external magnetic interferences from indoor/urban settings affect the heading calculation, resulting in inaccurate directional information. The inability to determine the orientation during everyday use inhibits many potential mobile applications development. In this work, we exploit the newly built-in gyroscope in the Nexus S smartphone to address the interference problems associated with the orientation sensor. We first perform drift error analysis and apply this to gyroscope calculations. We test simple as well as complex rotations seen in walking applications. We lastly test the gyroscope's resistance to described interferences. Experiments show angular calculations with percent error no larger than 6% from actual rotated values. Further, we are able to determine the phone's orientation at any time, in magnetically-interfered areas, with the phone accelerating. With this accurate information we can virtually orient the phone to better use mobile-acquired data. This shows that the presence of a gyroscope in smartphones will certainly aid in numerous applications.

Identifying and locating oneself in different hallways of high rise buildings forms the classic indoor localization problem. GPS does not work indoors and WiFi may not be omnipresent. This paper presents a novel approach to ambient magnetic fields based indoor localization. We present a system that classifies magnetic signatures using dynamic time warping. Specifically, by aligning similar magnetic signatures that differ in magnitude or time, we classify the signatures and infer the location irrepective of the person and his/her mode of commuting. A Nexus One smartphone was employed, utilizing its builtin magnetic field sensor to create a user friendly localization application solely on the phone. By using a variety of subjects including sighted, blindfolded and people using wheelchairs to handle the human speed variation problem, we evaluated the system across 26 and 15 hallways of two different buildings and obtained accuracies of 92.6%, and 91.1% respectively. With these encouraging results, we believe our proposed solution is user independent and caters to a wide range of hallways.

Predicting future calls can be the next advanced feature of the next-generation telecommunication networks as the service providers are looking to offer new services to their customers. Call prediction can be useful to many applications such as planning daily schedules, avoiding unwanted communications (e.g. voice spam), and resource planning in call centers. Predicting calls is a very challenging task. We believe that this is an emerging area of research in ambient intelligence where the electronic devices are sensitive and responsive to people's needs and behavior. In particular, we believe that the results of this research will lead to higher productivity and quality of life. In this article, we present a Call Predictor (CP) that offers two new advanced features for the next-generation phones namely “Incoming Call Forecast” and “Intelligent Address Book.” For the Incoming Call Forecast, the CP makes the next-24-hour incoming call prediction based on recent caller's behavior and reciprocity. For the Intelligent Address Book, the CP generates a list of most likely contacts/numbers to be dialed at any given time based on the user's behavior and reciprocity. The CP consists of two major components: Probability Estimator (PE) and Trend Detector (TD). The PE computes the probability of receiving/initiating a call based on the caller/user's calling behavior and reciprocity. We show that the recent trend of the caller/user's calling pattern has higher correlation to the future pattern than the pattern derived from the entire historical data. The TD detects the recent trend of the caller/user's calling pattern and computes the adequacy of historical data in terms of reversed time (time that runs towards the past) based on a trace distance. The recent behavior detection mechanism allows CP to adapt its computation in response to the new calling behaviors. Therefore, CP is adaptive to the recent behavior. For our analysis, we use the real-life call logs of 94 mobile phone users over nine months, which were collected by the Reality Mining Project group at MIT. The performance of the CP is validated for two months based on seven months of training data. The experimental results show that the CP performs reasonably well as an incoming call predictor (Incoming Call Forecast) with false positive rate of 8%, false negative rate of 1%, and error rate of 9%, and as an outgoing call predictor (Intelligent Address Book) with the accuracy of 70% when the list has five entries. The functionality of the CP can be useful in assisting its user in carrying out everyday life activities such as scheduling daily plans by using the Incoming Call Forecast, and saving time from searching for the phone number in a typically lengthy contact book by using the Intelligent Address Book. Furthermore, we describe other useful applications of CP besides its own aforementioned features including Call Firewall and Call Reminder.

In this paper, we propose a socioscope model for social-network and human-behavior analysis based on mobile-phone call-detail records. Because of the diversity and complexity of human social behavior, no one technique will detect every attribute that arises when humans engage in social behaviors. We use multiple probability and statistical methods for quantifying social groups, relationships, and communication patterns and for detecting human-behavior changes. We propose a new index to measure the level of reciprocity between users and their communication partners. This reciprocity index has application in homeland security, detection of unwanted calls (e.g., spam), telecommunication presence, and product marketing. For the validation of our results, we used real-life call logs of 81 users which contain approximately 500 000 h of data on users' location, communication, and device-usage behavior collected over eight months at the Massachusetts Institute of Technology (MIT) by the Reality Mining Project group. Also, call logs of 20 users collected over six months by the University of North Texas (UNT) Network Security team are used. The MIT and UNT data sets contain approximately 5000 callers. The experimental results show that our model is effective.

With Twitters growing popularity, privacy has become a major concern for users wary of sensitive information falling in the wrong hands. A typical Twitter user carries hundreds of followers people who have subscribed to users twitter feeds. Our goal is to target followers that a Twitter user deems safe. Therefore, selecting followers with a closer relationship could help decrease the risk of sensitive information being sent to unknown people. We propose a privacy management system that helps a Twitter user restrict information to only certain followers based on the strength of their social tie. This system would incorporate two tools: the Exclusivity meter and the Twitter Response Estimator. The Exclusivity Meter employs user's activity profile to guess similarities between users. Preliminary results have indicated that similarity in time and level of activity between user and follower does suggest a stronger social tie. The Twitter Response Estimator uses a measure of prestige to gauge the probability of response. When applied to a set of followers, the estimator separates real friends from recreational followers.

As mobile networks expand rapidly to facilitate the rising number of mobile phone population, more mobile social services are being developed and offered. To create an efficient social functionality, characteristics of mobile social network must be studied. Social closeness is one of the basic fundamentals of any kind of social networking. In this paper, closeness in mobile social network is the subject of the study, from which social grouping scheme is proposed and validated against the feedbacks of human subjects. Based on the proposed grouping scheme, a study of the impact of the mobile social closeness to the similarity in calling patterns and reciprocity is presented.

A social network dynamically changes since the social relationships (social ties) change over time. The evolution of a social network mainly depends on the evolution of the social relationships. The social-tie strengths of person-to-person are different one another even though they are in the same group. In this paper we investigate the evolution of person-to-person social relationships, quantify and predict social tie strengths based on call-detail records of mobile phones. We propose an affinity model for quantifying social-tie strengths in which a reciprocity index is integrated to measure the level of reciprocity between users and their communication partners. Since human social relationships change over time, we map the call-log data to time series of the social-tie strengths by the affinity model. Then we use ARIMA model to predict social-tie strengths. For validation of our results, we used actual call logs of 81 users collected for a period of 8 months at MIT by the Reality Mining Project group and also used call logs of 20 users collected for a period of 6 months by UNT's Network Security team. These users have around 5000 communication partners. The experimental results show that our model is effective. We achieve prediction performance with accuracy of average 95.2% for socially close and near members. Among other applications, this work is useful for homeland security, detection of unwanted calls (e.g., spam), and marketing.

Botnets have become the major sources of spamming, which generates massive unwanted traffic on networks. An effective detection mechanism can greatly mitigate the problem. In this paper, we present a novel botnet detection mechanism based on the email "shape" analysis that relies on neither content nor reputation analysis. Shape is our new way of characterizing an email by mimicking human visual inspection. A set of email shapes are derived and then used to generate a botnet signature. Our preliminary results show greater than 80% classification accuracy (without considering email content or reputation analysis). This work investigates the discriminatory power of email shape, for which we believe will be a significant complement to other existing techniques such as a network behavior analysis.

Although peer-to-peer (P2P) Internet telephony gains more and more market share, supporting traditional telephony related use cases is an indispensable requirement. However, communication services designed for this purpose are usually traditional circuit-based, and the centralized structure makes it nearly impossible for their deployments in a distributed, unsecure telecommunication environment. This paper proposes an approach for achieving various kinds of communication services on P2P voice over IP (VoIP) systems by building trust and executing supervision through social networks. We present a system architecture design for network topology maintenance and security assurance. Social protocols and social computing are used to study how P2P entities can be efficiently mapped to social networks, and how social functionalities can benefit communication services implementation. To demonstrate the approach feasibility, we exemplify this architecture in P2P VoIP emergency services by using gossiping and membership management techniques. We believe that our proposed approach will be able to support diverse services on P2P VoIP systems with the performance and security guaranteed to compete with centralized telecommunication systems.

Opt-in phone calls or emails refer to promotional phone calls or emails that have been requested by the people receiving them. In this paper we propose a model based on dynamic sliding windows to detect opt-in phone calls based on mobile phone call detail records. This work is useful for detecting unwanted calls (e.g., spam) and commercial purposes. For validation of our results, we used actual call logs of 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. The experimental results show that our model achieves good performance with 91% accuracy.

Despite all the advances on techniques to block spam e-mail messages we still receive them on a frequent basis. This is due mainly to the ability of the spammers to modify the message and pass the filters. Therefore a testing technique that could resemble the behavior of spammers would improve the number of scenarios tested and allow filters to be developed based on the potential changes made by the spammers. An approach based on natural language processing (NLP) for the penetration of spam filters is proposed here. Preliminary results using SpamAssassin are provided indicating the feasibility of the proposed approach.

Online social networking sites (SNSs) has changed our lifestyle and become a main medium of communication among young adults to stay in touch with their friends, to organize events, to make friends, to promote themselves, to date, etc. To create content rich environment, SNSs make their platform available for third-party developers. The developers can build their applications based on users' social graph containing their personal and social information. Unfortunately, any information users posted on their profile can be harvested and used for unethical purposes due to Facebook's lack of application privacy configuration. In this paper we propose a privacy-management system for Facebook applications. The system can take advantage of the correlation between some profile features and network privacy settings, in this way it can automatically configure a users privacy settings. Our preliminary result show promising result.

Internet telephony has recently gained popularity. Voice over IP (VoIP) has emerged as an alternative to the current public switched telephone network (PSTN) system due to its cost efficiency. Spam inherently becomes a problem in VoIP networks. In this paper, we present our ongoing research in defending VoIP networks against spam by presenting a new defense mechanism using community signals.

In this paper we propose a method for combining wavelet denoising and sequential approach for detecting change points on mobile phone based on detailed call records. The Minmax method is used to estimate the thresholds of frequency and call duration for denoising. This work is useful to enhance homeland security, detecting unwanted calls (e.g., spam) and commercial purposes. For validation of our results, we randomly choose actual call logs of 20 users from 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. Simulation data is also used to validate the results. The experimental results show that our model achieves good performance with high accuracy.

Abstract Risk management refers to the process of making decisions that minimize the effects of vulnerabilities on the network hosts. This can be a difficult task in the context of high‐exploit probability and the difficult to identify new exploits and vulnerabilities. For many years, security engineers have performed risk analysis using economic models for the design and operation of risk‐prone, technological systems using attack profiles. Based on the type of attacker identified, security administrators can formulate effective risk management policies for a network. We hypothesize that sequence of network actions by an attacker depends on the social behavior (e.g., skill level, tenacity, financial ability). We extended this and formulated a mechanism to estimate the risk level of critical resources that may be compromised based on attacker behavior. This estimation is accomplished using behavior based attack graphs representing all the possible attack paths to all the critical resources. The risk level is computed based on these graphs and are used as a measure of the vulnerability of the resource and forming an effective basis for a system administrator to perform suitable changes to network configuration. Copyright © 2008 John Wiley & Sons, Ltd.

Compromised computers, known as bots, are the major source of spamming. Detecting them can help greatly improve control of unwanted traffic. In this paper, we develop a traffic control mechanism to detect and delay the traffic of suspicious senders and bots. By delaying spammer's traffic, it has been reported that 90% of spam emails can be eliminated. In our proposed mechanism, we group spammers based on their behavior and transmission patterns. These patterns of spammers show high correlation between group members irrespective of geographic location, network ID, content, and kind of receivers. After identification of these botnet groups we applied traffic shaping techniques a pre-filtering analysis to avoid use of automated machines(bots) to spam a particular domain. Thus the source for majority of spam is blocked before reaching email servers. We also identify how randomly the botnets behave and how easy it is to capture a botnet behavior, based on Information theory. To our knowledge, there is no work reported on detecting and mitigating botnets based on their behavior and in particular transmission patterns.

In every day life, people communicate through a voice(e.g., VoIP) network with different social groups that range from known people such as family members, friends, and distant relatives to unknown people such as spammers, telemarketers, and phishers. We believe that there exists a human/social dynamics between individuals by the way calls are generated, handled and received. In this paper we present how this dynamics can be used for detecting and filtering unwanted calls. In this paper, we first enumerate the communication patterns between the called party (callee) and the calling parties (callers). Next, we discuss operations on caller-callee matrices constructed based on their communication patterns, and derive call-constructs that can be used for determining the legitimacy of the calls and the callers. Finally, we discuss how these communication patterns and operations can be grouped for solutions to few of the existing IP telephony problems. These solutions can complement the existing no-call-lists in voice networks.

Presence-enabled telephony services can reduce telephone tag and improve customer satisfaction. In this paper we proposed the Bayesian inference model to calculate the willingness level of the callee to accept calls. Before making a call, the caller may use the willingness calculator to find out whether the callee is available. Based on this level the user can make a decision whether to make a call. For validation of our results, we used actual call logs of 100 users collected at MIT by the Reality Mining Project group for a period of 8 months. We used time of the day, day of the week, talk-time and location for calculating the willingness level Our results show a good agreement between computed willingness level and the number of missed/rejected calls. This service can be included as part of the presence server. When deployed, this service can increase productivity, avoid unwanted calls and reduce the call traffic congestion. This service is beneficial to both subscribers and phone service providers. However, in order to make this service a reality, we need to take into account other factors such social closeness, proximity, multiplexity and reputation of the caller.

The next generation Internet needs to support multimedia services such as voice/video over IP (VoIP) and IP-based television (IPTV) and media distribution. The goal of the project is to develop a testbed for understanding and analysis of vulnerabilities of IP-based multimedia networks. This is a collaborative project between University of North Texas, Columbia University, Purdue University, and University of California at Davis. This project was awarded in 2006 and in one year, we have developed a multi-university testbed with variety of PBX solutions including Asterisk, a multitude of voice and video IP phones, and multiple universities were connected through a secure VPN and Internet!. As with any endeavor, experiences and we have many unique issues, which sometimes cause setbacks. We have dealt with issues concerning interoperability between phones and servers, network address translation (NAT) connectivity issues, and many other collaboration issues concerning people and technology. An interworking of students from multiple universities, faculty, system administrators and support personnel has brought the testbed resources together for a working environment. In this paper we described our progress and experiences in more detail and how to fulfill our mission statement while supporting the various collaborative efforts involved with this project. In addition, we described the current research activities based on the testbed. Finally we described the next steps in the testbed development.

Email spam is the most effective form of online advertising. Unlike telephone marketing, email spamming does not require huge human or financial resources investment. Most existing spam filtering techniques concentrate on the emails’ content. However, most spammers obfuscate their emails’ content to circumvent content-based spam filters. An integrated solution for restricting spam emails is needed as content analyses alone might not provide a solution for filtering unsolicited emails. Here we present a new method for isolating unsolicited emails. Though spammers obfuscate their emails’ content, they do not have access to all the fields in the email header. Our classification method is based on the path an email traverses instead of content. Overall, our classifier produced fewer false positives when compared to current filters such as SpamAssassin. We achieved a precision of 98.65% which compares well with the precisions achieved by SPF, DNSRBL blacklists.

In our everyday life, we communicate with many people such as family, friends, neighbors, and colleagues. We communicate with them using different communication media such as email, telephone calls, and face-to-face interactions. While email is not real-time and face-to-face communications require geographic proximity, voice and video communications are preferred over other modes of communication. However, real-time voice/video calls may create nuisance to the receiver. In this article, we describe a mathematical model for computing nuisance level of incoming voice/video calls. We computed the closeness and nuisance level using the calling patterns between the caller and the callee. To validate the nuisance model, we collected cell phone call records of real-life people at our university and computed the nuisance value for all voice calls. We validated the nuisance levels using the feedback from those real-life people. Such a nuisance model is useful for predicting unwanted voice and video sessions in an IP communication network.

An accurate prediction of the number of defects in a software product during system testing contributes not only to the management of the system testing process but also to the estimation of the product's required maintenance. Here, a new approach called ED3M is presented that computes an estimate of the total number of defects in an ongoing testing process. ED3M is based on estimation theory. Unlike many existing approaches the technique presented here does not depend on historical data from previous projects or any assumptions about the requirements and/or testers' productivity. It is a completely automated approach that relies only on the data collected during an ongoing testing process. This is a key advantage of the ED3M approach, as it makes it widely applicable in different testing environments. Here, the ED3M approach has been evaluated using five data sets from large industrial projects and two data sets from the literature. In addition, a performance analysis has been conducted using simulated data sets to explore its behavior using different models for the input data. The results are very promising; they indicate the ED3M approach provides accurate estimates with as fast or better convergence time in comparison to well-known alternative techniques, while only using defect data as the input.

Many graph- and set-theoretic problems, because of their tremendous application potential and theoretical appeal, have been well investigated by the researchers in complexity theory and were found to be NP-hard. Since the combinatorial complexity of these problems does not permit exhaustive searches for optimal solutions, only near-optimal solutions can be explored using either various problem-specific heuristic strategies or metaheuristic global-optimization methods, such as simulated annealing, genetic algorithms, etc. In this paper, we propose a unified evolutionary algorithm (EA) to the problems of maximum clique finding, maximum independent set, minimum vertex cover, subgraph and double subgraph isomorphism, set packing, set partitioning, and set cover. In the proposed approach, we first map these problems onto the maximum clique-finding problem (MCP), which is later solved using an evolutionary strategy. The proposed impatient EA with probabilistic tabu search (IEA-PTS) for the MCP integrates the best features of earlier successful approaches with a number of new heuristics that we developed to yield a performance that advances the state of the art in EAs for the exploration of the maximum cliques in a graph. Results of experimentation with the 37 DIMACS benchmark graphs and comparative analyses with six state-of-the-art algorithms, including two from the smaller EA community and four from the larger metaheuristics community, indicate that the IEA-PTS outperforms the EAs with respect to a Pareto-lexicographic ranking criterion and offers competitive performance on some graph instances when individually compared to the other heuristic algorithms. It has also successfully set a new benchmark on one graph instance. On another benchmark suite called Benchmarks with Hidden Optimal Solutions, IEA-PTS ranks second, after a very recent algorithm called COVER, among its peers that have experimented with this suite.

Security administration is an uphill task to implement in an enterprise network providing secured corporate services. With the slew of patches being released by network component vendors, system administrators require a barrage of tools for analyzing the risk due to vulnerabilities in those components. In addition, criticalities in patching some end hosts raises serious security issues about the network to which the end hosts are connected. In this context, it would be imperative to know the risk level of all critical resources keeping in view the everyday emerging new vulnerabilities. We hypothesize that sequence of network actions by attackers depends on their social and attack profile (behavioral resources such as skill level, time, and attitude). To estimate the types of attack behavior, we surveyed individuals for their ability and attack intent. Using the individuals' responses, we determined their behavioral resources and classified them as having opportunist, hacker, or explorer behavior. The profile behavioral resources can be used for determining risk by an attacker having that profile. Thus, suitable vulnerability analysis and risk management strategies can be formulated to efficiently curtail the risk from different types of attackers.

Voice over IP (VoIP) is a key enabling technology for migration of circuit-switched PSTN (Public Switched Telephone Network) architectures to packet-based networks. One problem of the present VoIP networks is filtering spam calls referred to as SPIT (Spam over Internet Telephony). Unlike spam in e-mail systems, VoIP spam calls have to be identified in real time. Many of the techniques devised for e-mail spam detection rely upon content analysis, and in the case of VoIP, it is too late to analyze the content (voice) as the user would have already attended the call. Therefore, the real challenge is to block a spam call before the telephone rings. In addition, we believe it is imperative that spam filters integrate human behavioral aspects to gauge the legitimacy of voice calls. We know that, when it comes to receiving or rejecting a voice call, people use the social meaning of trust, reputation, friendship of the calling party and their own mood. In this article, we describe a multi-stage, adaptive spam filter based on presence (location, mood, time), trust, and reputation to detect spam in voice calls. In particular, we describe a closed-loop feedback control between different stages to decide whether an incoming call is spam. We further propose formalism for voice-specific trust and reputation analysis. We base this formal model on a human intuitive behavior for detecting spam based on the called party's direct and indirect relationships with the calling party. No VoIP corpus is available for testing the detection mechanism. Therefore, for verifying the detection accuracy, we used a laboratory setup of several soft-phones, real IP phones and a commercial-grade proxy server that receives and processes incoming calls. We experimentally validated the proposed filtering mechanisms by simulating spam calls and measured the filter's accuracy by applying the trust and reputation formalism. We observed that, while the filter blocks a second spam call from a spammer calling from the same end IP host and domain, the filter needs only a maximum of three calls---even in the case when spammer moves to a new host and domain. Finally, we present a detailed sensitivity analysis for examining the influence of parameters such as spam volume and network size on the filter's accuracy.

In a computer network, network security is accomplished using elements such as firewalls, hosts, servers, routers, intrusion detection systems, and honey pots. These network elements need to know the nature or anomaly of the worm a priori to detect the attack. Modern viruses such as Code Red, Sapphire, and Nimda spread quickly. Therefore, it is impractical if not impossible for human mediated responses to these fast-spreading viruses. Several epidemic studies show that automatic tracking of resource usage and control provides an effective method to contain the damage. In this paper, we propose a novel security architecture based on the control system theory. In particular, we describe a state-space feedback control model that detects and control the spread of these viruses or worms by measuring the velocity of the number of new connections an infected host makes. The mechanism's objective is to slow down a worm's spreading velocity by controlling (delaying) the number of new connections made by an infected host. A proportional and integral (PI) controller is used for a continuous control of the feedback loop. The approach proposed here has been verified in a laboratory setup, and we were able to contain the infection so that it affected less than 5 percent of the hosts. We have also implemented a protocol for exchanging control-specific information between the network elements. The results from the simulation and experimental setup combined with the sensitivity analysis demonstrate the applicability and accuracy of the approach.

An overview is presented of a micromanipulator vision system for use in automating various functions during the testing of a wafer for semiconducting parameters and inspection of VLSI circuits. Positioning the probe and touching a test pad are the chief concern of the work desired. A brief description of the experimental setup is given. The image processing techniques used in identifying and controlling the location of various components such as the probes and the test pads are discussed. The vision modules and an expert system using hierarchical plan generation to control the sequence of plans are included.>