A promising avenue for improving the effectiveness of behavioral-based malware detectors is to leverage two-phase detection mechanisms. Existing problem in two-phase detection is that after the first phase produces borderline decision, suspicious behaviors are not well contained before the second phase completes. This article improvesChameleon, a framework to realize the uncertain environment.Chameleonoffers two environments: standard—for software identified as benign by the first phase, and uncertain—for software received borderline classification from the first phase. The uncertain environment adds obstacles to software execution through random perturbations applied probabilistically. We introduce a dynamic perturbation threshold that can target malware disproportionately more than benign software. We analyzed the effects of the uncertain environment by manually studying 113 software and 100 malware, and found that 92 percent malware and 10 percent benign software disrupted during execution. The results were then corroborated by an extended dataset (5,679 Linux malware samples) on a newer system. Finally, a careful inspection of the benign software crashes revealed some software bugs, highlightingChameleon's potential as a practical complementary anti-malware solution.

Dynamic Information Flow Tracking (DIFT), also called Dynamic Taint Analysis (DTA), is a technique for tracking the information as it flows through a program’s execution. Specifically, some inputs or data get tainted and then these taint marks (tags) propagate usually at the instruction-level. While DIFT has been a fundamental concept in computer and network security for the past decade, it still faces open challenges that impede its widespread application in practice; one of them being the indirect flow propagation dilemma: should the tags involved in an indirect flow, e.g., in a control or address dependency, be propagated? Propagating all these tags, as is done for direct flows, leads to overtainting (all taintable objects become tainted), while not propagating them leads to undertainting (information flow becomes incomplete). In this paper, we analytically model that decisioning problem for indirect flows, by considering various tradeoffs including undertainting versus overtainting, importance of heterogeneous code semantics and context. Towards tackling this problem, we design MITOS, a distributed-optimization algorithm, that: decides about the propagation of indirect flows by properly weighting all these tradeoffs, is of low-complexity, is scalable, is able to flexibly adapt to different application scenarios and security needs of large distributed systems. Additionally, MITOS is applicable to most DIFT systems that consider an arbitrary number of tag types, and introduces the key properties of fairness and tag-balancing to the DIFT field. To demonstrate MITOS’s applicability in practice, we implement and evaluate MITOS on top of an open-source DIFT, and we shed light on the open problem. We also perform a case-study scenario with a real in-memory only attack and show that MITOS improves simultaneously (i) system’s spatiotemporal overhead (up to 40%), and (ii) system’s fingerprint on suspected bytes (up to 167%) compared to traditional DIFT, even though these metrics usually conflict.

Ultra-dense small cell networks will require sophisticated user association algorithms that consider (i) channel characteristics, (ii) base station load, and (iii) uplink/downlink (UL/DL) traffic profiles. They will also be characterized by high spatio-temporal variability in UL/DL traffic demand, due to the fewer users per BS. In this direction, Dynamic TDD is a promising new technique to match BS resources to actual demand. While plenty of literature exists on the problem of user association, and some recent on dynamic TDD, most works consider these separately. In this paper, we argue that user association policies are strongly coupled with the allocation of resources between UL and DL. We propose an algorithm that decomposes the problem into separate subproblems that can each be solved efficiently and in a distributed manner, and prove convergence to the global optimum. Simulation results suggest that our approach can improve UL and DL performance at the same time, with an aggregate improvement of more than 2×, compared to user association under static TDD allocation.

Operators, struggling to continuously add capacity and upgrade their architecture to keep up with data traffic increase, are turning their attention to denser deployments that improve spectral efficiency. Denser deployments make the problem of user association challenging, and much work has been devoted to finding algorithms that strike a tradeoff between user quality of service, and network-wide performance (load-balancing). Nevertheless, the majority of these algorithms typically consider simple setups with a single type of traffic, usually elastic non-guaranteed bit rate (GBR). They also focus on the radio access part, ignoring the backhaul topology and potential capacity limitations. Backhaul constraints are emerging as a key performance bottleneck in future networks, partly due to the continuous improvement of the radio interface, and partly due to the need for inexpensive backhaul links to reduce capital and operational expenditures. To this end, we propose an analytical framework for user association that jointly considers radio access and backhaul network performance. Specifically, we derive an algorithm that takes into account spectral efficiency, base station load, backhaul link capacities and topology, and two traffic classes (GBR and non-GBR) in both the uplink and downlink directions. We prove analytically an optimal user association rule that ends up maximizing either an arithmetic or a weighted harmonic mean of the achieved performance along different dimensions (e.g., uplink and downlink performances or GBR and non-GBR performances). We then use extensive simulations to study the impact of: 1) traffic differentiation; and 2) backhaul capacity limitations and topology on key performance metrics.

Operators, struggling to continuously add capacity and upgrade their architecture to keep up with data traffic increase, are turning their attention to denser deployments that improve spectral efficiency. Denser deployments make the problem of user association challenging, and much work has been devoted to finding algorithms that strike a tradeoff between user quality of service (QoS), and network-wide performance (load-balancing). Nevertheless, the majority of these algorithms typically consider only the radio access part, and ignore the backhaul topology and potential capacity limitations. Backhaul constraints are emerging as a key performance bottleneck in future heterogeneous networks, partly due to the continuous improvement of the radio interface, and partly due to the need for inexpensive backhaul links to reduce CAPEX/OPEX. To this end, we propose an analytical framework for user association that jointly considers radio access and backhaul performance. We derive an algorithm that takes into account spectral efficiency, base station load, backhaul link capacities and topology, and uplink and downlink traffic demand, and prove it converges to an optimal solution. We then use extensive simulations to study the impact of (i) backhaul capacity limitations and (ii) backhaul topology on key performance metrics.

In this work we propose a novel handover (HO) algorithm, that considers system performance from both user and network perspective, in the context of heterogeneous networks (HetNets), i.e., networks composed of BSs with asymmetrical transmission power. In such an environment, conventional HO algorithms that consider only the user perspective, e.g., received signal strength (RSS)-based, might offer suboptimal performance, since they mainly push users to cells with high transmission powers. Thus, new algorithms that take into account also the network perspective, e.g., cell load, are needed. In this work, a load-aware algorithm is proposed considering the service delay that a user experiences from the network. In addition, an implementable framework based on Software Defined Networking (SDN) architecture is sketched to support the algorithm. The proposed algorithm is compared with the traditional one we meet in long-term evolution (LTE) systems and a distance-based one. Extracted cell assignment probability and user service delay performance results show that the load-aware approach outperforms both of them.

The widespread adoption of tablets and smartphones, and an abundance of data-hungry mobile applications, are overwhelming wireless networks with increased demand and introduce considerable traffic diversity. Operators struggling to continuously add capacity and upgrade their architecture have resorted instead to building denser deployments to improve spectral efficiency. By increasing the number of cells a user can associate with, (i) user quality of service (QoS) can be improved, and (ii) traffic can be offloaded from congested base stations, to achieve better load balancing. However, these two goals are not always aligned. To this end, we develop an analytical framework for optimal user association in future HetNets that investigates the potential tradeoffs between user- and network-related performance, in a more realistic setup encompassing additional key features: (i) different types of user flows, and (ii) uplink and downlink performance. We believe this better reflects the diversity of the services offered to users and their impact on system performance. We evaluate our proposed framework through extensive simulations, and provide some qualitative and quantitative insights on the related tradeoffs.

Small cell networks (SCNs) are widely considered as a promising solution for future cellular deployments. Lately, the benefits of small cells to improve spectrum utilization and the user quality of experience (QoE) have been well documented. In addition, the power consumption of current deployments, for instance due to idle power and cooling equipment, is a major concern for operators. Small cells offer the opportunity for more dynamic power management of base stations, due to coverage overlaps and larger spatio-temporal load fluctuations. Yet, such power management decisions (e.g. turning off a base station) should not lead to excessive performance degradation for users associated with it or additional power consumption. This tradeoff becomes significantly more challenging to evaluate in future networks, due to the diversity of services offered to users beyond the traditional voice calls, as well as the complexity of traffic scheduling algorithms. The goal of this paper is to make a first step towards an analytical investigation of this tradeoff. To this end, we propose a number of QoE constraints that a power management decision should consider, and analytically relate them to key parameters such as user traffic mix, cell load, user density, etc. We then use this framework to perform a preliminary study of the potential energy savings an operator could achieve, while guaranteeing the satisfaction of these constraints. Our results provide some qualitative and quantitative insights on the interesting tradeoff between switch-off duration and number of small cells one can safely switch off.