Security protocols are not as secure as we assumed. In this paper, we identified a practical way to launch DoS attacks on security protocols by triggering exceptions. Through experiments, we show that even the latest strongly authenticated protocols such as PEAP, EAP-TLS and EAP-TTLS are vulnerable to these attacks. Real attacks have been implemented and tested against TLS-based EAP protocols, the major family of security protocols for Wireless LAN, as well as the Return Routability of Mobile IPv6, an emerging lightweight security protocol in new IPv6 infrastructure. DoS attacks on PEAP, one popular TLS-based EAP protocol were performed and tested on a major university's wireless network, and the attacks were highly successful. We further tested the scalability of our attack through a series of ns-2 simulations. Countermeasures for detection of such attacks and improvements of the protocols to overcome these types of DoS attacks are also proposed and verified experimentally.

It is crucial to detect zero-day polymorphic worms and to generate signatures at the edge network gateways or honeynets so that we can prevent the worms from propagating at their early phase. However, most existing network-based signatures generated are not vulnerability-based and can be easily evaded by attacks. In this paper, we propose generating vulnerability-based signatures on the network level without any host-level analysis of worm execution or vulnerable programs. As the first step, we design a network-based Length-based Signature Generator (LESG) for worms based on buffer overflow vulnerabilities. The signatures generated are intrinsic to buffer overflows, and are very hard for attackers to evade. We further prove the attack resilience bounds even under worst case attacks with deliberate noise injection. Moreover, LESG is fast and noise-tolerant and has efficient signature matching. Evaluation based on real-world vulnerabilities of various protocols and real network traffic demonstrates that LESG is promising in achieving these goals.

Based on synchronized responses of neuronal populations in the visual cortex to external stimuli, we proposed a computational model consisting primarily of a neuronal phase-locked loop (NPLL) and multiscaled operator. The former reveals the function of synchronous oscillations in the visual cortex. Regardless of which of these patterns of the spike trains may be an average firing-rate code, a spike-timing code, or a rate-time code, the NPLL can decode original visual information from neuronal spike trains modulated with patterns of external stimuli, because a voltage-controlled oscillator (VCO), which is included in the NPLL, can precisely track neuronal spike trains and instantaneous variations, that is, VCO can make a copy of an external stimulus pattern. The latter, however, describes multi-scaled properties of visual information processing, but not merely edge and contour detection. In this study, in which we combined NPLL with a multiscaled operator and maximum likelihood estimation, we proved that the model, as a neurodecoder, implements optimum algorithm decoding visual information from neuronal spike trains at the system level. At the same time, the model also obtains increasingly important supports, which come from a series of experimental results of neurobiology on stimulus-specific neuronal oscillations or synchronized responses of the neuronal population in the visual cortex. In addition, the problem of how to describe visual acuity and multiresolution of vision by wavelet transform is also discussed. The results indicate that the model provides a deeper understanding of the role of synchronized responses in decoding visual information.

Among various types of denial of service attacks, "dropping attack" is probably the most difficult one to handle. This paper explores the negative impacts of packet dropping attacks and a method to detect such attacks. First, three dropping patterns are classified and investigated. We demonstrate that attackers can choose different dropping patterns to degrade TCP service to different levels, and selectively dropping a very, small number of packets can result in severe damage to TCP performance. Second, we show that a hacker can utilize a DDoS attack tool to control a "uncompromised" router to emulate dropping attacks. This proves that dropping attacks are indeed practically very possible to happen in today's Internet environment. Third, we present a statistical analysis module for the detection of TCP packet dropping attacks. Three measures, session delay, the position and the number of packet reorderings, have been implemented in the statistical module. This paper has evaluated and compared their detection performance.

Many security mechanisms and protocols have been developed to handle security problems in various circumstances. This trend has created a heterogeneous security environment for today's global Internet. Although most security functions and modules can be managed "individually" through SNMP, very little has been researched in coordinating a set of distributed security modules to provide and manage an "end-to-end" security service. In order to support service management for network security, in this paper, we developed the ISCP protocol (inter-domain security management agent coordination protocol) to communicate security capability and policy information among the security management agents in each policy domain. ISCP is designed with good scalability, interoperability, extensibility and security. Performance evaluation using our ISCP prototype implementation is also presented.