The distributed cryptocurrency networking is critical because the information delivered through it drives the mining consensus protocol and the rest of the operations. However, the cryptocurrency peer-to-peer (P2P) network remains vulnerable, and the existing security approaches are either ineffective or inefficient because of the permissionless requirement and the broadcasting overhead. We design and build a Lightweight and Identifier-Oblivious eNgine (LION) for the anomaly detection of the cryptocurrency networking. LION is not only effective in permissionless networking but is also lightweight and practical for the computation-intensive miners. We build LION for anomaly detection and use traffic analyses so that it minimally affects the mining rate and is substantially superior in its computational efficiency than the previous approaches based on machine learning. We implement a LION prototype on an active Bitcoin node to show that LION yields less than 1% of mining rate reduction subject to our prototype, in contrast to the state-of-the-art machine-learning approaches costing 12% or more depending on the algorithms subject to our prototype as well, while having detection accuracy of greater than 97% F1-score against the attack prototypes and real-world anomalies. LION therefore can be deployed on the existing miners without the need to introduce new entities in the cryptocurrency ecosystem.

Blockchain relies on the underlying peer-to-peer (p2p) networking to broadcast and get up-to-date on the blocks and transactions. It is therefore imperative to have high p2p connectivity for the quality of the blockchain system operations. High p2p networking connectivity ensures that a peer node is connected to multiple other peers providing a diverse set of observers of the current state of the blockchain and transactions. However, in a permissionless blockchain network, using the peer identifiers—including the current approach of counting the number of distinct IP addresses and port numbers—can be ineffective in measuring the number of peer connections and estimating the networking connectivity. Such current approach is further challenged by the networking threats manipulating the identifiers. We build a robust estimation engine for the p2p networking connectivity by sensing and processing the p2p networking traffic. We implement a working Bitcoin prototype connected to the Bitcoin Mainnet to validate and improve our engine’s performances and evaluate the estimation accuracy and cost efficiency of our estimation engine.

The ability of securely perform computations over encrypted data creates the opportunity of outsourcing data processing without compromising its privacy. With the always increasing data availability, cloud-based applications are becoming the new norm, which makes securely storing homomorphically encrypted data on the cloud a much current need since it allows one to conciliate availability with confidentiality. We introduce a homomorphic image encryption framework with which images can be processed while encrypted. We demonstrate the practicability of our construction by implementing a set of pixel transformations that are only performed over encrypted images. We present the results of our experiments in terms of image transformations, security and efficiency.

We introduce a fully homomorphic symmetric-key encryption scheme, a homomorphic key update and a key exchange protocols for exchanging secret keys among multiple parties, updating secret keys on existing ciphertexts without prior decryption, and generating secret keys for partial, ephemeral and/or consolidated data, which have useful applications in cloud computing.

Many security related big data problems, including document, traffic, and system log analysis require analysis of unstructured text. Consider the task of analyzing company documents for secure storage. Some might be too sensitive to put on a public cloud and require private storage with associated backup overhead, some may safe on the cloud in encrypted form, and some may be sufficiently non-sensitive to be stored on the cloud in plain-text without encryption and decryption overhead. Being able to make such categorizations autonomously can significantly strengthen data security, organization, and storage efficiency. In this paper, we analyze several base machine learning based security risk assessment algorithms and develop techniques to improve upon standard algorithms. In particular, we examine labeling document sensitivity, labeling each paragraph in the document with one of three levels of security risk. For evaluation, we use real sensitive texts, from documents leaked by the WikiLeaks organization. We improve upon the base models using probabilistic topic modeling via Latent Dirichlet Analysis to identify samples from impure subtopics in the training set, prior to training a logistic regression classifier.

In recent years, traditional cybersecurity safeguards have proven ineffective against insider threats. Famous cases of sensitive information leaks caused by insiders, including the WikiLeaks release of diplomatic cables and the Edward Snowden incident, have greatly harmed the U.S. government's relationship with other governments and with its own citizens. Data Leak Prevention (DLP) is a solution for detecting and preventing information leaks from within an organization's network. However, state-of-art DLP detection models are only able to detect very limited types of sensitive information, and research in the field has been hindered due to the lack of available sensitive texts. Many researchers have focused on document-based detection with artificially labeled “confidential documents” for which security labels are assigned to the entire document, when in reality only a portion of the document is sensitive. This type of whole-document based security labeling increases the chances of preventing authorized users from accessing non-sensitive information within sensitive documents. In this paper, we introduce Automated Classification Enabled by Security Similarity (ACESS), a new and innovative detection model that penetrates the complexity of big text security classification/detection. To analyze the ACESS system, we constructed a novel dataset, containing formerly classified paragraphs from diplomatic cables made public by the WikiLeaks organization. To our knowledge this paper is the first to analyze a dataset that contains actual formerly sensitive information annotated at paragraph granularity.

Software Defined Networking and OpenFlow have forever changed the landscape of computer networking. Researchers and leading IT corporations have been embracing this evolution in recent years, but greater commercial and industrial acceptance is contingent upon successful “real-world” testing. Testing which focuses on the stability and performance gains SDN/OpenFlow provides. One particular area of performance enhancement is the arena of network security via dynamic administrator control. This paper proposes a framework for large-scale M&S of denial of service attacks against SDN/OpenFlow networks. Beyond the M&S framework research of particular attack methodologies, large-scale tools, and an evaluation of their effectiveness is provided.

In this paper we propose N-Cloud scheme which improves performance, availability, and confidentiality in cloud storage. N-Cloud provides availability by dividing/splitting a file into many chunks, and replicating in a non-overlapping manner these chunks into many cloud storages, based on security and reliability consideration. In this scheme, the chunks of a file can be encrypted concurrently while the encrypted chunks can be uploaded to geographical separated cloud storages in parallel. Same benefit can be achieved for the downloading and decrypting process. It greatly speeds up the processing and transfer. N-Cloud provides confidentiality by dividing/splitting a file into many chunks, encrypting all chunks, and distributing these chunks to many clouds. N-Cloud ensures that no one cloud has the whole file; the scheme will not be compromised unless an attacker breaks into all cloud storage. A preliminary results show significant performance improvement over existing schemes.

Slowdown, defined as the ratio of a request's queueing delay to its service time, is accepted as an important quality of service metric of Internet servers. In this paper, we investigate the problem of providing proportional slowdown differentiation (PSD) services to various applications and clients on cluster-based Internet servers. We extend a closed-form expression of the expected slowdown of a popular Internet workload model with a typical heavy-tailed service time distribution from a single server mode to a server cluster mode. Based on the closed-form expression, we design a two-tier resource allocation approach, which integrates a dispatcher-based node partitioning scheme and a server-based dynamic process allocation scheme. We evaluate the two-tier resource allocation approach via extensive simulations and compare it with an one-tier node partitioning approach. Simulation results show that the two-tier approach can provide fine-grained PSD services on cluster-based Internet servers. We implement the two-tier approach on a cluster testbed. Experimental results further demonstrate the feasibility of the approach in practice.

A secure MANET system, called SMANET, was developed that accepts only those packets whose MAC addresses are in the Linux iptable firewall rules. Detailed iptable set up and the performance of the firewall are presented. SMANET is integrated with a simple intrusion alert system based on TCP DUMP utility.

In this paper, we present the design and implementation of the secure collective defense (SCOLD) system against distributed denial of service (DDoS) attacks. The key idea of SCOLD is to follow the intrusion tolerance paradigm and provide alternate routes via a set of proxy servers and alternate gateways when the normal route is unavailable or unstable due to network failures, congestion, or DDoS attacks. The BIND9 DNS server and its DNS update utilities are enhanced to support new DNS entries with indirect routing information. Protocol software for supporting the establishment of indirect routes based on the new DNS entries is developed for Linux systems. Experimental results show that SCOLD can improve the network security, availability and performance. Preliminary simulation results using NS2 indicate that the performance is scalable with respect to the indirect route initial setup overhead and processing overhead.

There is a growing demand for provisioning of different levels of quality of service (QoS) on scalable Web servers to meet changing resource availability and satisfy different client requirements. The proportional differentiation model is getting momentum because of its fairness and differentiation predictability. It states that QoS of different traffic classes should be kept proportional to their pre-specified differentiation parameters, independent of the class loads. In this paper, we present a processing rate allocation scheme for providing proportional response time differentiation on Web servers. A challenging issue is how to achieve processing rates for different request classes in the implementation. We propose a process allocation strategy, which dynamically and adaptively changes the number of processes allocated for handling different request classes while ensuring the ratios of process allocation specified by the processing rate allocation scheme. We implement the process allocation strategy at application level on Apache Web servers. Experimental results show that the processing rate can be achieved by the adaptive process allocation strategy and the Web servers can provide predictable and controllable proportional response time differentiation.

This paper presents the study, design and implementation of a firewall, in particular a major component of a firewall: the dynamic packet filter. A packet filter may be static or dynamic. A dynamic packet filter checks, on the fly, the outgoing IP packets from a computer and then allows incoming packets to get through the packet filter if the packets are from the same computer as the outgoing packets were sent to. There are currently no dynamic packet filters on the Linux operating system which has been chosen to be the development and test environment due to the source code availability. Some performance measurements have also been obtained to show that a safe system does not necessarily have to be very slow. This might otherwise be of some concern, as there is a trade-off between the security and the performance of the system.

Three multicast path-finding algorithms for networks with directed links are designed and implemented: an optimal algorithm based on the dynamic programming technique, a heuristic algorithm with the assumption that all vertices have the multicast capability, and a heuristic algorithm for networks where some vertices do not have the multicast capability. Computation results show that the heuristic algorithms can find multicast paths whose costs are close to optimal and can operate with reasonable response time for large networks. Applications of these path-finding algorithms to set up multipoint connections for broadband multimedia multiparty services are discussed.>

A heterogeneous intelligent network has been designed and implemented to allow multimedia real-time communications and messaging among local area network workstations with logically associated speakerphones and among ISDN voice/data terminals with transparent tablets on top of bitmap screens and stylus pens. The architecture, presentation, editing, storage, and retrieval of multimedia documents in these two different kinds of terminals are described. The messages and protocol conversion facilities used for multimedia communications are presented, as are the lessons learned in internetworking a local area network with ISDN.>

The PROSPEC software environment for designing and verifying communication protocols is described. It integrates several tools that implement methods for protocol verification and construction (i.e., fair reachability analysis, multiphase construction, and protocol projection). The system provides a unified graphical interface to facilitate the application of these methods and creates an interactive environment for specifying, verifying, and designing communication protocols. PROSPEC was used successfully to design and verify versions of BSC, X.21, X.25, and Telnet document transfer protocols.>

Many communication protocols can be observed to go through different phases performing a distinct function in each phase. A multiphase model for such protocols is presented. A phase is formally defined to be a network of communicating finite-state machines with certain desirable correctness properties; these include proper termination and freedom from deadlocks and unspecified receptions. A multifunction protocol is constructed by first constructing separate phases to perform its different functions. It is shown how to connect these phases together to realize the multifunction protocol so that the resulting network of communicating finite state machines is also a phase (i.e., it possesses the desirable properties defined for phases). The modularity inherent in multiphase protocols facilitates not only their construction but also their understanding and modification. An abundance of protocols have been found in the literature that can be constructed as multiphase protocols. Three examples are presented here: two versions of IBM's BSC protocol for data link control and a token ring network protocol.