This article introduces two new approaches in the areas of lexical analysis and context-free parsing. We present an extension, MGLL, of generalised parsing which allows multiple input strings to be parsed together efficiently, and we present an enhanced approach to lexical analysis which exploits this multiple parsing capability. The work provides new power to formal language specification and disambiguation, and brings new techniques into the historically well-studied areas of lexical and syntax analysis. It encompasses character-level parsing at one extreme and the classical LEX/YACC style division at the other, allowing the advantages of both approaches.

Although IP and its overlying protocols, such as TCP and UDP, are ubiquitous, they were originally designed for point-to-point connections between computers in reasonably fixed locations. They are less suited to mobile networks and broadcast communications. In this paper, we present an alternative to IP that is based on a publish-subscribe approach. The approach that we present combines an application publish-subscribe programming model with a content delivery network, which provides several advantages in certain communication environments, including quality of service based on application level needs; efficient support for reliable broadcast; support for disadvantaged, intermittent, and limited communications; and more efficient reliability and fault tolerance. The paper presents our approach, based on a streamlined Data Distribution Service and simplified Content Delivery Network, a motivating example in which the publish-subscribe based distribution and network provides advantages, and a contrast to TCP/IP in the example context.

To date, techniques to counter cyber-attacks have predominantly been reactive; they focus on monitoring network traffic, detecting anomalies and cyber-attack traffic patterns, and, a posteriori, combating the cyber-attacks and mitigating their effects. Contrary to such approaches, we advocate proactively detecting and identifying botnets prior to their being used as part of a cyber-attack (Strayer et al., 2006). In this paper, we present our work on using machine learning-based classification techniques to identify the command and control (C2) traffic of IRC-based botnets - compromised hosts that are collectively commanded using Internet relay chat (IRC). We split this task into two stages: (I) distinguishing between IRC and non-IRC traffic, and (II) distinguishing between botnet and real IRC traffic. For stage I, we compare the performance of J48, naive Bayes, and Bayesian network classifiers, identify the features that achieve good overall classification accuracy, and determine the classification sensitivity to the training set size. While sensitive to the training data and the attributes used to characterize communication flows, machine learning-based classifiers show promise in identifying IRC traffic. Using classification in stage II is trickier, since accurately labeling IRC traffic as botnet and non-botnet is challenging. We are currently exploring labeling flows as suspicious and non-suspicious based on telltales of hosts being compromised

Systems are attempting to detect botnets by examining traffic content for IRC commands or by setting up honeynets. Our approach for detecting botnets is to examine flow characteristics such as bandwidth, duration, and packet timing looking for evidence of botnet command and control activity. We have constructed an architecture that first eliminates traffic that is unlikely to be a part of a botnet, classifies the remaining traffic into a group that is likely to be part of a botnet, then correlates the likely traffic to find common communications patterns that would suggest the activity of a botnet. Our results show that botnet evidence can be extracted from a traffic trace containing almost 9 million flows