With the increasing sophistication of Advanced Persistent Threats (APTs), the demand for effective detection and mitigation strategies and methods has escalated. Program execution leaves traces in the system audit log, which can be analyzed to detect malicious activities. However, collecting and analyzing large volumes of audit logs over extended periods is challenging, further compounded by insufficient labeling that hinders their usability. Addressing these challenges, this paper introduces SAGA (Synthetic Audit log Generation for APT campaigns), a novel approach for generating find-grained labeled synthetic audit logs that mimic real-world system logs while embedding stealthy APT attacks. SAGA generates configurable audit logs for arbitrary duration, blending benign logs from normal operations with malicious logs based on the definitions the MITRE ATT&CK framework. Malicious audit logs follow an APT lifecycle, incorporating various attack techniques at each stage. These synthetic logs can serve as benchmark datasets for training machine learning models and assessing diverse APT detection methods. To demonstrate the usefulness of synthetic audit logs, we ran established baselines of event-based technique hunting and APT campaign detection using various synthetic audit logs. In addition, we show that a deep learning model trained on synthetic audit logs can detect previously unseen techniques within audit logs.

This paper presents APILI, an innovative approach to behavior-based malware analysis that utilizes deep learning to locate the API calls corresponding to discovered malware techniques in dynamic execution traces. APILI defines multiple attentions between API calls, resources, and techniques, incorporating MITRE ATT&CK framework, adversary tactics, techniques and procedures, through a neural network. We employ fine-tuned BERT for arguments/resources embedding, SVD for technique representation, and several design enhancements, including layer structure and noise addition, to improve the locating performance. To the best of our knowledge, this is the first attempt to locate low-level API calls that correspond to high-level malicious behaviors (that is, techniques). Our evaluation demonstrates that APILI outperforms other traditional and machine learning techniques in both technique discovery and API locating. These results indicate the promising performance of APILI, thus allowing it to reduce the analysis workload.

Cyber threats have become more prevalent than ever. Cyber Threat Intelligence (CTI) reports and MITRE ATTCK® framework play an imperative role in helping experts and organizations assess current and potential attacks, such as Advanced Persistent Threats (APT). However, the task of extracting valuable information from unstructured texts remains an ongoing challenge. In this work, we present a framework for understanding and reasoning adversary tactics and techniques. We construct an ontology structure and propose an automatic information extraction method that is capable of integrating the parsed information from CTI reports into each instance. The ontology is represented in the Web Ontology Language (OWL) accessible with the SPARQL query language. Our evaluation shows that the proposed information extraction method outperforms other state-of-the-art neural network-based methods in terms of precision. Furthermore, our framework can effectively infer adversary information, which efficiently supports security analysts recognize tactics and techniques.

Cyber threats are one of the most pressing issues in the digital age. There has been a consensus on deploying a proactive defense to effectively detect and respond to adversary threats. The key to success is understanding the characteristics of malware, including their activities and manipulated resources on the target machines. The MITRE ATT&CK framework (ATT&CK), a popular source of open source intelligence (OSINT), provides rich information and knowledge about adversary lifecycles and attack behaviors. The main challenges of this study involve knowledge collection from ATT&CK, malicious behavior identification using deep learning, and the identification of associated API calls. A MITRE ATT&CK based Malicious Behavior Analysis system (MAMBA) for Windows malware is proposed, which incorporates ATT&CK knowledge and considers attentions on manipulated resources and malicious activities in the neural network model. To synchronize ATT&CK updates in a timely manner, knowledge collection can be an automatic and incremental process. Given these features, MAMBA achieves the best performance of malicious behavior discovery among all the compared learning-based methods and rule-based approaches on all datasets; it also yields a highly interpretable mapping from the discovered malicious behaviors to relevant ATT&CK techniques, as well as to the related API calls.

With the advance of hardware, network, and virtualization technologies, cloud computing has prevailed and become the target of security threats such as the cross virtual machine (VM) side channel attack, with which malicious users exploit vulnerabilities to gain information or access to other guest virtual machines. Among the many virtualization technologies, the hypervisor manages the shared resource pool to ensure that the guest VMs can be properly served and isolated from each other. However, while managing the shared hardware resources, due to the presence of the virtualization layer and different CPU modes (root and non-root mode), when a CPU is switched to non-root mode and is occupied by a guest machine, a hypervisor cannot intervene with a guest at runtime. Thus, the execution status of a guest is like a black box to a hypervisor, and the hypervisor cannot mediate possible malicious behavior at runtime. To rectify this, we propose a hardware-assisted VMI (virtual machine introspection) based in-guest process monitoring mechanism which supports monitoring and management applications such as process profiling. The mechanism allows hooks placed within a target process (which the security expert selects to monitor and profile) of a guest virtual machine and handles hook invocations via the hypervisor. In order to facilitate the needed monitoring and/or management operations in the guest machine, the mechanism redirects access to in-guest memory space to a controlled, self-defined memory within the hypervisor by modifying the extended page table (EPT) to minimize guest and host machine switches. The advantages of the proposed mechanism include transparency, high performance, and comprehensive semantics. To demonstrate the capability of the proposed mechanism, we develop an API profiling system (APIf) to record the API invocations of the target process. The experimental results show an average performance degradation of about 2.32%, far better than existing similar systems.

Many researchers have indicated that the prior knowledge has great effects on students' performance in learning mathematics. The low prior knowledge (LPK) students were expected to have lower learning performance and achievement than those of high prior knowledge (HPK) students. To help the low prior knowledge students, researchers suggested that to provide a self-regulated learning (SRL) support may be effective and helpful. However, the prior knowledge might also affect students' self-regulated learning. Thus, the relationship among SRL, prior knowledge, and learning performance remain unclear. To deal with this issue, this study not only investigates whether an enhanced SRL is helpful for students to improve learning performance but also explored how HPK and LPK students behaved differently when interacting with the SRL environment. The results suggested the SRL environment offers opportunities to remove the gap caused by prior knowledge in long-term. Accordingly, further finding, and implications are discussed.

Malware developers often use various obfuscation techniques to generate polymorphic and metamorphic versions of malicious programs. As a result, variants of a malware family generally exhibit resembling behavior, and most importantly, they possess certain common essential codes so to achieve the same designed purpose. Meantime, keeping up with new variants and generating signatures for each individual in a timely fashion has been costly and inefficient for anti-virus software companies. It motivates us the idea of no more dancing with variants. In this paper, we aim to find a malware family's main characteristic operations or activities directly related to its intent. We propose a novel automatic dynamic Android profiling system and malware family runtime behavior signature generation method called Runtime API sequence Motif Mining Algorithm (RasMMA) based on the analysis of the sensitive and permission-related execution traces of the threads and processes of a set of variant APKs of a malware family. We show the effectiveness of using the generated family signature to detect new variants using real-world dataset. Moreover, current anti-malware tools usually treat detection models as a black box for classification and offer little explanations on how malwares behave and how they proceed step by step to infiltrate targeted system and achieve the goal. We take malware family DroidKungFu as a case study to illustrate that the generated family signature indeed captures key malicious activities of the family.

Abuse of drug cause serious problems around the world by years. Thus, anti-drug materials have been increasingly developed. However, conventional anti-drug materials had limited effects on preventing drugs abuse, especially for drug addictive users. To this end, game-based anti-drug materials have been considered as a promising approach to deal with the issue in this study. As far as the drug-addicted experience is concerned, how drug addictive users and drug non-addictive users interacted with the game-based anti-drug materials is analyzed. The results revealed that the drug-addicted experience influenced users' performance of accessing information during gaming process, preference of completing tasks and the approach to reach goals.

In this paper, we examine the possibility to utilize the well-known approximations of Jaccard metric in order to reduce computational complexity of Edit Distance metric estimation. The scope of our analytical results is the representing strings rather than the original (raw) textual data, still in practice we obtained a solid indication that the results can be applied to (raw) strings that have low n-gram repetitions. We formulate inequalities between the Jaccard metric and the Edit Distance, that impose upper and lower bounds on the Edit Distance values in terms of the Jaccard values. We validate our inequality over strings of API call traces where (the small) clusters obtained are refined by applying Edit Distance. Jaccard is a measure of similarity between two sets, while Edit Distance is a measure for two strings, such as traces of API calls. The computation associated with creating n-grams and using Jaccard similarity is much more efficient than the computation of Edit Distance (linear versus quadratic time complexity). Thus, our new bounds on the Edit Distance given the Jaccard value are of practical interest. Another new aspect we coped with in our research is the inherent imbalance between malicious and benign API traces that are harvested from the system, as most of the traces are benign. We performed clustering only on the malware traces where each cluster concentrates malware with some specific common essence. The obtained clustering is used with great success in classifying new query traces for being either benign or malware. The traces for our research were obtained from the KVM hypervisor Runtime Execution Introspection and Profiling (REIP) system based on Virtual Machine Introspection (VMI) techniques to profile hooked Windows API calls.

Over the last few decades, there has been a growing interest in technology assisted multimedia learning. The purpose of this study was to develop an online multimedia learning system, TEDQuiz, for English language learners to practice their listening skills. The system is comprised of an easy-to-use browser extension and a personalized online learning management platform. This can help learners to manage listening materials by automatically generating multiple -- choice questions, synchronously connecting to friends in a social network website and personally managing their learning progress and word bank. The use of the system involves six steps: skimming, asking questions, listening, answering questions, linking and reviewing. Taking TED talks as an example, users can skim the website, have guiding questions, listen to talks, answer the questions, link to a social network website, and review their profile on the TEDQuiz website. The experimental results demonstrate that students with the TEDQuiz system spent more time on video watching. In the questionnaire, students had a positive view of the functions of the TEDQuiz system. They thought it is useful and helpful, and they were willing to use it in the future. We also found that the usefulness factor was statistically significant in predicting the future usage of TEDQuiz.

Malicious apps may install unwanted program or gather sensitive information from mobile devices. We notice Android apps fork several threads to accomplish a complex task intrinsically, and so does Android malware, that makes security experts difficult to analyze them without knowing their structure. In this paper, we propose an analysis scheme to group and analyze Android malware based on their dynamic behaviors, and to identify the behaviors of a malware family. In addition, we apply the techniques of phylogenetic tree, significant principal components and dot matrix on different malware families to demonstrate their behavioral correlations. The proposed methods can automatically discover similar behaviors of different malware groups, extract the characteristics of each malware group, and provide visualized information based on runtime behaviors. We anticipate the grouping result and the structure of malware family are important and essential for further malware behavior analysis researches.

In the last few years, researchers in the field of e-learning and Natural Language Processing (NLP) have shown an increased interest in automatic question generation. However, little research has discussed the automatic evaluation of listening comprehension in multimedia learning. In this work, we present an automatic quiz generation for TED Talks video clips, called TED Quiz. TED Quiz generates multiple-choice questions in two question types, gist-content questions and detail questions. We use a graph-based algorithm, Lex Rank, to identify the most important part of a talk, as the main concept of a gist-content question. We also proposed an approach to distractor selection for detail question generation that generates grammatically correct but semantically wrong sentences as distractors. The experimental results demonstrated that the measured results from automatically generated questions are comparable with that from manually generated questions because their scores were significantly correlated. Moreover, most subjects agreed that the generated listening comprehension questions were of quality and usefulness.

High-speed rail systems are becoming increasingly popular among long-distance travelers. With the explosive growth in the number of mobile devices, the provision of high-quality telecommunication and Internet access services on high-speed trains is now a pressing problem. Network mobility (NEMO) has been proposed to enable a large number of mobile devices on a vehicle to access the Internet; however, several issues must be solved before it can be put into practice, e.g., frequent handovers, long handover latency, and poor quality of service. To resolve these problems, we propose an LTE femtocell-based network mobility scheme that uses multiple egress network interfaces to support seamless handover for high-speed rail systems called MEN-NEMO. The results of simulations show that the proposed MEN-NEMO scheme reduces the handover latency and transmission overhead of handover signaling substantially.

Providing end-to-end quality of service (QoS) for delay-sensitive flows with variable-bit-rate (VBR) traffic in wireless mesh networks is a major challenge. There are several reasons for this phenomenon, including time-varied bandwidth requirements, competition for transmission opportunities from flows on the same link, and interference from other wireless links. In this paper, we propose a flexible bandwidth allocation and uncoordinated scheduling scheme, called two-stage link scheduling (2SLS), to support flow delay control in TDMA-based wireless mesh networks. The scheme is implemented in two stages: slot allocation and on-the-go scheduling. The slot allocation mechanism allocates contiguous time slots to each link in each frame based on predefined maximum and minimum bandwidth requirements. Then, each link's on-the-go scheduling mechanism dynamically schedules the transmissions within the allocated time slots. The objective is to maximally satisfy the demand of all flows on the link according to the bandwidth requirements and channel condition. Compared with traditional slot allocation approaches, 2SLS achieves higher channel utilization and provides better end-to-end QoS for delay-sensitive flows with VBR traffic.

A slow-paced attack, such as slow worm or bot, can remain undetectable indefinitely by slowing down the pace of its movement. Detecting slow attacks based on traditional anomaly detection techniques may yield high false alarm rates. Since attacks are usually controlled by pre-programmed computer codes, their behaviors have regularity. In this paper, we track outbound connections of hosts by using a time series. Although the correlation among slow attacks' connections is temporally weak; the regularity of these connections remains preserved in the time series. Accordingly, we focus on time series spectrum analysis, and propose a detection method to identify peculiar spectral patterns which can represent the occurrence of a recurring and persistent activity in the time domain. We use both synthesized traffic and real-world traffic to evaluate our method. The results show that our method is efficient and effective in detecting slow-paced persistent activities even in a noisy environment with legitimate traffic.

With the emergence of Web 2.0, social tagging provides an opportunity to help learners to share, organize, and manage the learning information from reading materials. Moreover, a tag-based learning system can enable them to complete their learning activities in an effective and efficient way through the use of web 2.0 social tagging technologies. However, few studies have directly discussed why social tagging can benefit from user-generated tags in reading learning. Therefore, this paper first explores the use of effective social tagging learning to help students not only improve their understanding of the English material that they read, but also develop their ability to read well. We then investigate how to apply tag-based learning to help learners focus on studying the resources and make sense of the material and remember it more easily. The experimental results showed that tag-based learning can improve users’ efficiency in reading learning.

Prior knowledge in concept acquisition among students is an important issue. Traditional studies on prior knowledge generation during learning have focused on extracting sentences from reading materials that are manually generated by website administrators and educators. From the reports of previous studies, tag-based recommendation and assessment has been recognized as being an effective approach that can assist learners in finding out the clues and concepts of articles, such that it enables learners to be familiar with the learning content. However, sparse noisy data influences the quality of recommendations, especially for tag choices that are not mapped to the features of both the users and content. To cope with these problems, we adopt a hybrid recommendation method to consider tag preference, tag relevance and social networking. The experimental results show that the approach benefits from the additional information embedded in social knowledge, and can be an effective and efficient mechanism for enhancing the quality of prior knowledge recommendation.

Prior knowledge learning for increasing the efficiency of the learning processes is an important issue. Traditional studies on prior knowledge generation during language learning have focused on providing additional supplemental materials from reading materials that are manually generated by educators. This is time-consuming and hence personalized prior knowledge recommendation is difficult to perform and monitor. To cope with these problems, we purpose a novel tag-cloud visualization learning approach to automatically monitor running activities and student status. In addition, we incorporate cloud tags into a prior knowledge learning system (TAK), which provides students an engaging way to reinforce meaningful topics, identifies suitable supplementary materials through tag cloud navigation, and helps students reevaluate their reading process. Our experimental results demonstrate that our approach not only significantly improves the efficiency of prior knowledge learning but also helps teachers assist students in improving their reading ability.

With growing interest in estimating true ability in contemporary learning, the demand for personalized learning and Web-based learning environments has become increasingly important. This paper develops a statistical and interpretable method of estimating ability. This method captures the succession of learning over time and provides an explainable interpretation of a statistical measurement, based on Item Response Theory and the quantiles of acquisition distributions. The results from the simulation and empirical study demonstrate that the estimated abilities can successfully recognize the actual abilities of students. The correlation values between the estimated abilities and the post-test score, which incorporate this testing history, are higher than values that only consider test responses at the time of testing. Furthermore, the pre-test and post-test administered to the experimental group show significant student improvement. These results suggest that this method serves as a successful alternative ability estimation and provides a better understanding of student competence.

Recent years have seen increased attention given to computer-aided question generation for language student testing and evaluation. However, this approach often directly provides examinees with exhaustive questions. This is inappropriate, because these questions are not designed for any specific testing purpose. In this work, we present a personalized automatic quiz generation model that generates multiple-choice questions at various difficulty levels and categories, including grammar, vocabulary, and reading comprehension. We combined this model with a quiz strategy for estimating examinee proficiency and question selection. The proficiency is estimated using Exponential Moving Average, combining the test responses with a student’s past history. The results show that the subjects in the experimental group corrected their mistakes more frequently as well as answered more difficult questions than the control group. The experimental group also demonstrated the most progress between the pre-test and post-test. In addition, most of subjects agree the quality of the generated questions in the questionnaire analysis.

With the advent of Web 2.0 technology, researchers have attempted to use Web 2.0 tools to develop adaptive and cooperative learning environments. However, in building learning and teaching diagnostic system, one of the major difficulties is the lack of prior knowledge to help learners read and understand what they read in articles. Moreover, because of the lack of a mechanism to assist teachers in monitoring the running activities and student progress, such that constructive suggestions can be given to the students and tutoring strategies can be improved accordingly. Therefore, this paper presents a framework for calculating semantically meaningful prior knowledge and generating spreading energy for discovering student's reading status in semantic networks using a modified version of Semantic Analysis and Social Network techniques. An application to the development of a Tag-based Collaborative reading learning system is very useful for teachers and students.

In many metropolitan areas, traffic congestion is an escalating problem which causes a significant waste of money and time. Nowadays, cars equipped with GPS devices become widespread. The location information of those cars is very useful for estimate traffic condition in the complex city road network. Using the accurate and real time traffic condition, we can provide dynamic route guidance to ease traffic congestion. In this paper, we proposed a speed pattern model, called two phase piecewise linear speed model (2PEED), to estimate traffic condition and represent speed pattern in a road network using GPS data collected vehicles. With the estimated traffic condition and speed pattern, a proposed classification-based route guidance approach using machine learning technique provides dynamic routing for drivers. Using both current traffic data and the experience learned from history data, our route guidance approach is able to accurately predict the future traffic condition and selects a best route. We give simulation results to show that the proposed approach is able to select and dynamically update a route to prove drivers a best (e.g., less traffic and shortest travel time) route to their destination.

The wireless spectrum is a limited resource. The concepts of cognitive radio and dynamic spectrum allocation (DSA) have been considered as a possible mechanism to improve the efficiency of bandwidth usage and solve the bandwidth deficiency problem. In this work, we propose an open interactive dynamic bandwidth trading model to enable periodic, short-term trading of unused bandwidth by licensed spectrum owners to sublet their surplus resources to service providers that need bandwidth. The model comprises of two phases. The goal of the phase one is to find out the demand of the intended buyers through multiple rounds of learning and revising of the quantity-price schedule. Based on the type distribution of the intended potential buyers, the optimal quantity-price schedule is derived which satisfies the incentive compatibility (aka self-selection) and the individually rational constraints that maximizes the MNO's profit and assures that the quantity-price pair designed for MVNO of a specific type will choose the pair that maximizes its utility. We also present an algorithm to convert the continuous optimal quantity-price schedule to a discrete one so as to provide a simple easy-to-read format for MVNOs' selection. If the total number of bandwidth requests exceeds the total capacity constraint, a bounded knapsack problem is used to resolve for final bandwidth allocation. Lastly, an example is provided to illustrate the process.

Traditional spectrum allocation approaches assume that the intended users of BSs are treated equally, without consideration of their distances. Consequently, the efficiency of spectrum usage for downlink transmissions may suffer, because a BS may interfere with other BS transmissions; this would not happen if a proper transmission power is used. In this paper, we propose a user-centric spectrum allocation algorithm based on a physical interference model for downlink transmissions. In our approach, BSs set the power of an allocated spectrum band to ensure an effective transmission range for covering a group of intended users. A spectrum band is allocated to a BS if it can satisfy a group of users with the least amount of power possible (relative to other spectrum bands). Thus, after spectrum bands and transmission ranges are assigned, each BS owns several spectrum bands that can cover a group of users within varying transmission ranges. This approach leads to a higher rate of spectral reuse and improves system performance. In addition, the approach properly considers fairness issues among both users and BSs. Overall, simulation results show that our approach not only outperforms traditional BS-centric approaches by offering a 26% higher throughput in dense networks, but also provides fairer spectrum allocation.

Reading exercises are critical for developing strong reading comprehension. With the advent of Web 2.0 technology, researchers have attempted to use Web 2.0 tools to develop adaptive and cooperative learning environments. Moreover, previous research has demonstrated that the use of social tagging technologies allows teachers to empower learners and create exciting new learning opportunities. However, in building a teaching support system, one of the major difficulties is the lack of a mechanism to assist teachers in monitoring running activities and student progress, such that constructive suggestions can be given to the students, and tutoring strategies can be improved accordingly. To cope with this problem, this paper proposes an automatic tag-based early-alert mechanism (TEA). Moreover, an application to the development of a tag-based collaborative reading learning system has depicted the superiority of our approach.

Reading difficulty is a measurement for estimating the appropriate reading level of a document. Almost all prior studies are designed for first language learners, but not for second language learners. In this study, we propose a robust estimation scheme, including features such as word frequency, official word grade and grammar patterns, to train a linear model to estimate the difficulty of the document for second language learners. The experiment results show that the proposed estimation scheme outperforms other reading difficulty estimations.

Reading is an important skill for gaining knowledge and discovering new information in a global society. Reading competence also strongly influences a person’s learning ability. However, in building better reading skills, one of the major difficulties is an absence of background knowledge to help learners read and understand material. Background knowledge helps learners make connections to construct clues within the text and determine the meaning of new vocabulary or sentences. Often, learners lack a mechanism to help them construct prior knowledge, preventing them from fully understanding their reading. To cope with these problems, this study adopts one of the most popular Web 2.0 techniques—social tagging—to help learners both read and understand English articles. We test our approach using a tag-based collaborative reading learning system. Our conclusions demonstrate the approach’s effectiveness, and reveal areas for future research.

One of the most popular applications of IEEE 802.16 network is to serve as a backhaul service for IEEE 802.11 networks. However, the traffic of an IEEE 802.16 connection aggregated from IEEE 802.11 networks fluctuates. Thus, efficient bandwidth reservation at the subscriber station (SS) is an importance issue. This study proposes a simple and flexible bandwidth reservation scheme at the SS, called multi-stage self-correction bandwidth reservation (MSBR), to make effective use of the bandwidth without violating the QoS requirements for real-time traffic under the proposed cost model. The MSBR scheme introduces the concept of Decision Period for bandwidth reservation to reduce the control message overheads. The proposed method also adopts the RLS algorithm to predict the traffic arrival and applies the MSBR method to capture the traffic dynamics for bandwidth reservation. Simulation results demonstrate that the proposed MSBR scheme utilizes the bandwidth efficiently without violating the QoS requirements of real-time services.

With the birth of Web 2.0, the development of the Internet has entered a new age. In addition to constant changes in information technology, Internet user behavior is radically different than in the past. However, as an educational tool, the application of Web 2.0 is still in its infancy. In this paper, we develop IWiLL 2.0, an online learning community based around the core concepts of Web 2.0. According to our research results, we find that learners experience more interaction from IWiLL 2.0 than IWiLL 1.0, with significant differences. We also present the future work for further study.

Reading exercises are critical for developing strong reading comprehension. However, due to resource constraints and a lack of accurate evaluation methods, English instructors can hardly assess student reading ability effectively. In past decades, learning by reading is known to be challenging for both teachers and students involved, especially for students learning English as a Foreign Language (EFL). To cope with this problem, in this paper, we proposed a Tag-based assessment approach to both elicit reading behaviors from EFL learners and assist the teachers in tracing and evaluating the student reading ability effectively. The experimental results showed that the novel approach can not only find out the relations between learners’ tags and their comprehension, but also help teachers to evaluate students’ reading ability.

We anticipate future attacks would evolve to become more sophisticated to outwit existing intrusion detection techniques. Existing anomaly analysis techniques and signature-based detection practices can no longer effective. We believe intrusion detection systems (IDSs) of the future will need to be capable to detect or infer attacks based on more valuable information from the network-related properties and characteristics. We observed that even though the signatures or traffic patterns of future stealthy attacks can be modified to outwit current IDSs, certain behavioral aspects of an attack are invariant. We propose a novel approach that jointly monitors network activities at three different levels: transport layer protocols, (vulnerable) network services, and invariant anomaly behaviors (called attack symptoms). Our system, SecMon, captures the network behaviors by simultaneously performing cross-level state correlation for effective detection of anomaly behaviors. For the most part, the invariant anomaly behavior has not been fully exploited in the past. A probabilistic attack inference model is also proposed for attack assessment by correlating the observed attack symptoms to achieve the low false alarm rate. The evaluations demonstrate our prototype system is efficient and effective for sophisticated attacks, including polymorphism, stealthy, and unknown attack.

Employing multiple radio access technologies such as WiMAX, HSDPA and Wi-Fi in a mobile network to provide users with more cost-effective communication services has long been a vision of many service network providers. In this paper, we propose a novel user-decided service model for a cooperative wireless network in which the radio resources of multiple wireless networks are collectively managed. Under the model, users are provided with multiple service options with different levels of service quality and charges. It is up to users to choose the most suitable service option (and access network) based on their personal preference and the amount of money they are willing to pay. We use a video streaming service in a WiMAX/HSDPA network as an example to illustrate the key concepts and resource management of our approach. The results of simulation show that, under the model, the service network can accommodate more users and provide higher user satisfaction than the traditional network-decided service model. It can also achieve higher resource utilization and revenues. This demonstrates the importance of defining the concept of user-decided service model in a cooperative heterogeneous networking environment.

Wireless channel contention/interference problems combined with the constraints imposed by the TCP congestion control scheme have a severe impact on TCP throughput performance and fairness in a wireless mesh network. In this paper, we propose a TCP-sleek spatial TDMA scheduling algorithm to construct a sleek data and ACK packet flowing environment for TCP flows along the wireless paths. The proposed scheme considers the TCP demands of individual directional links during channel access scheduling and time slot assignment to enable the TCP congestion control mechanisms to perform as effectively as they do in wired networks, irrespective of their spatial locations and the number of hops traversed. In addition, employing link-layer retransmission can effectively hide local transmission errors from the end-to-end TCP congestion control mechanisms. The simulation results demonstrate that, under the proposed scheme, the problem of unfair bandwidth sharing to long-hop TCP flows caused by wireless communication is successfully eliminated, and the throughput disparity between long- and short-hop TCP flows is also substantially reduced. The scheme also achieves high overall network throughput.

Online learning communities are gradually altering the traditional learning style of people because of the pervasiveness of the Internet. The environment of the online learning community has been formed gradually as more and more people join Web sites and learn from each other. A total of 436 senior high school students in Taiwan participated in this research. To test the hypotheses of this research, we use structural equation modeling (SEM) method for validation. All hypotheses we proposed were supported. Finally, we list several implications of this research results as guidelines for developing an online learning community for future study.

Network mobility introduces a new communication paradigm that provides sets of mobile hosts (MH) moved collectively as a unit with high-mobility. Efficient network mobility handover design is essential to meet QoS requirements for real-time VoIP-like applications. IETF MIPv6-NEMO design has some problems and introduces extra overheads on packet header and tunnel processing, and added transmission delays due to additional routing legs. Inflexible execution sequence between tasks in MIPv6-NEMO causes negative effect on handover latency performance. In this work, we combine the designs of routing and resource allocation with network mobility management, and introduce the notion of foreign mobility agent in a hierarchical backhaul packet forwarding architecture, referred to as HiMIP-NEMO, to facilitate QoS-handovers and reduce latency and packet loss during handover. Under the architecture, a QoS-incorporated registration protocol and handover protocol with several new layers 2 and 3 message types are also proposed. Both the analytical and simulation results are presented. The results show the effectiveness of the proposed integrated designs in the support of QoS-handover and significant improvements in latency and packet loss performances.

This article describes the successful experiences of National Taiwan University Hospital (NTUH) in moving from IBM Mainframe to connected networking computer systems. We use multi-tier architecture and HL7 standard to implement our new outpatient hospital information system (HIS). The NTUH HIS is a complex environment with several operating systems, databases, and information systems. We adopt service-oriented architecture (SOA) to reduce the complex relations between systems and solve data consistency problems among databases. We also show that the distributed architecture can provide us stable and reasonable system performances. Our main contribution is proving that the distributed environment with HL7 standard and SOA can sustain in a highly demanding environment

Newly popular Internet applications such as WebTV and Internet streaming requires network to support end-to-end delay bound. In this paper, we propose a novel network scheduling scheme, called the bulk scheduling scheme (BSS), built on top of existing schedulers of intermediate nodes (routers) without modifying transmission protocols on both sender and receiver. By inserting TED packets into packet flows at the ingress router periodically, the BSS schedulers of the intermediate nodes can dynamically allocate the necessary bandwidth to each flow to enforce the end-to-end delay. The introduction of TED packets incurs a lower overhead than the per-packet marking approaches, while achieves similar performance. Three flow bandwidth estimation methods are presented and a dropping policy is introduced to discard late packets. We also propose a feedback mechanism to discover and resolve the bottlenecks for the BSS. The simulation results show that BSS performs efficiently as expected.

This research mainly investigates how to utilize Internet technology to assist the teaching of "Supply Chain Management". It uses the related web-based learning theories as the foundation to develop a webbase learning system. Researchers use observations, questionnaires, and learner portfolio records to collect data for quantitative and qualitative analyses. The major findings of this research are as follow: 1. Through the use of this web-based learning system, students show obvious improvement in learning, and it also serve as supplement for the insufficiency of traditional classroom learning. 2. Among peer students, there shows a high rate of interaction. 3. From verification, the design of this web-based learning system meets the related learning theories.

Virtual private networks (VPNs) provide customers with a secure and manageable communication environment. A VPN resource provisioning model, called hose model, provides customers with the flexibility to specify the bandwidth requirement of a VPN. For the network service provider (NSP), traffic engineering is an essential requirement for better utilization of the network backbone, while meeting the requirements specified by customers. In this paper, two vital traffic engineering problems for hose-model VPNs are investigated: (1) how to maximize the number of VPNs successfully established on the network backbone, and (2) how to find a set of resource-efficient backup paths for a VPN under a single link failure model. To address these problems, we propose two novel algorithms for hose-model VPN provisioning. We use rejection ratio for the first problem and protected bandwidth allocation for the second as the main performance metrics to evaluate different algorithms, respectively. Simulation results show that our algorithms outperform previous proposed approaches.

Rapid deployment of IEEE 802.11 based wireless access networks in hot spots and the integration of the networks to the existing wide-area communication infrastructure have become a major driving force to speed up the design and development of necessary security and quality of service (QoS)-guaranteed mechanisms with roaming capacity to mobile users. Three issues are raised in such a communication environment: a) service users would like to have IP-based roaming capability as they move rather than being constrained to a single spot or being forced to disconnect because his/her service provider does not have entire coverage of the city/region; b) the need on security and accounting management for mobile Internet; and c) the execution of AAA however would incur extra delay to handoff latency. For applications like VoIP, video streaming and TCP connections, it may disrupt the on-going communications if such latency becomes too large. In this paper, we propose an AAA-enabled roaming alliance architecture that provides fast and secure universal roaming service across multiple service domains. The associated protocols and the supporting security mechanisms are also proposed. Our design provides continuing communications service to mobile user belonging to different service operators to quickly and securely access service when roaming across multiple service domains. Mobile users only need to carry a U-mobile token to receive the service. The schemes proposed only incur minimal latency in security check. This is particularly important to the support of real-time mobile applications.

In this paper, a Web document classification scheme, progressive analysis scheme (PAS) is proposed to efficiently and effectively classify HTML Web documents. When an author writes a Web document, HTML tags are used to visually emphasize the texts related to main concepts. The design of PAS is to catch the authoring convention in terms of the contributions of nested HTML tags to document classification. During the learning phase, PAS provides an enhanced tag sequence model to resolve the sample lacking problem in learning the classification contributions of HTML tag sequences. While in classification phase, PAS decomposes a Web document into regions based on the DOM tag-tree, and analyzes the regions in the descending order of their classification contributions. PAS also provides a mechanism called emphasis degree adjustment to defer the processing of noisy region during classification. The simulation results shows that PAS has better performance than full-text (e.g. SVM) and sequential classifier.

Although there are various wireless access network technologies with different characteristics and performance level have been developed, no single network that can satisfy the anytime, anywhere, and any service wireless access needs of mobile users. A truly seamless mobile environment can only be realized by considering vertical and horizontal handoffs together. With the advantages of Mobile IPv6, a more comprehensive and integrated framework of heterogeneous networks can be developed. In this paper, we discuss the issues related to handoffs including horizontal and vertical handoffs. We present a scheme for integrating wireless local area network and wide area access networks, and propose a micromobility management method called HiMIPv6+. We also propose a QoS-based (quality-of-service-based) vertical handoff scheme and algorithm that consider wireless network transport capacity and user service requirement. Our prototype evaluations and the simulations show that our framework performs as expected.

While existing weighted fair scheduling schemes guarantee minimum service rates of a shared server (such as a computer or a communication channel), maximum rate control was generally enforced by employing policing mechanisms. The previous approaches use either a concatenation of rate controller and scheduler, or a policer in front of scheduler. The concatenation method uses two sets of queues and management apparatus, and thus incurs overhead. The other method allows bursty job requests that may violate maximum rate constraint. In this paper, we present a new weighted fair scheduling scheme, WF/sup 2/Q-M, to simultaneously support maximum rate control by distributing the excess bandwidths of maximum rate constrained sessions to other sessions without recalculating the virtual starting and finishing times of regular sessions. In terms of performance metrics, we prove that WF/sup 2/Q-M is theoretically bounded by a fluid reference model. A procedural scheduling implementation of WF/sup 2/Q-M is proposed and proof of correctness is given. Finally, we conduct extensive experiments to show the performance of WF/sup 2/Q-M is just as we claim.

Maximum rate control in a shared channel is important to service providers and carriers for various reasons. Previous approaches either use a concatenation of regulator and scheduler, which employs two set of queues and two management systems, or a policer in front of scheduler. The former requires extra management overhead and inaccuracy, and the latter causes bursty traffic as well as inaccuracy. In this paper, we propose a new scheduling algorithm, called WF/sup 2/Q-M (worst-case fair weighted fair queueing with maximum rate control), to simultaneously support maximum rate control and provide minimum service rate guarantee. WF/sup 2/Q-M has similar worst case time complexity with WF/sup 2/Q designed to provide accurate scheduling. WF/sup 2/Q-M employs virtual clock adjustment to distribute the excess bandwidth of saturated sessions to other sessions without recalculating their virtual starting and finishing times. WF/sup 2/Q-M performance is theoretically bounded by a fluid reference mode, and simulations show WF/sup 2/Q-M performs just as claimed.

In this paper, we present PVA, an adaptive personal view information agent system to track, learn and manage, user's interests in Internet documents. When user's interests change, PVA, in not only the contents, but also in the structure of user profile, is modified to adapt to the changes. Experimental results show that modulating the structure of user profile does increase the accuracy of personalization systems.

Differentiation service (Diffserv) is regarded as one of the practical architectures to realize quality of service (QoS) on the Internet. Relative differentiated service, which achieves relative QoS differentiation between traffic classes, is a simple and easily-deployed service model. Based on the concept of relative differentiated service, Dovrolis et al. (ACM SIGMETRICS Performance Evaluation Review vol.27, no.1, pp.204-5, 1999; IEEE Network, September 1999; ACM SIGCOMM-99, September 1999) proposed a proportional differentiation service model which guarantees the ratios of service differences between classes. They claimed that weighted fair queuing (WFQ) is not suitable for implementing relative differentiation service and employed priority-based scheduling algorithms in their model. In this paper, we extend WFQ and apply it to proportional delay differentiation service. The extended WFQ algorithm adjusts the weighting of each class dynamically so that the delay differences between classes can be well controlled. Simulations show that the proposed methods can realize proportional delay differentiation service effectively and efficiently.

Many real-time, multimedia applications (e.g., teleconferencing) have been successful deployed over the Internet and its overlayed multicast backbone network (MBONE). However poor, unpredictable transfer performance of the continuous media in Internet is common and inevitable due to the intrinsic "best-effort" transport techniques used. Before the full-blown ATM networks or any other networks with QoS offerings are in place, Ethernets are still the most popular networks in today's office environments. We investigate how application-level traffic shaping (spacing) can help to reduce the possibly drastic performance degradation of real-time multimedia conferencing applications on a heavily-loaded Ethernet. An experimental testbed is constructed and all the application software is implemented in our laboratory. Performance results measured from the testbed are presented to provide insights of how the performance degradations occur and to illustrate how a real-time application can lessen the situation.

A switching architecture, synchronous fast packet switching (SFPS), is proposed whereby an optical space switch provides a circuit-switching type of transmission to applications with rigid delay requirement and continuous traffic pattern (e.g., video). A fast packet switch fabric is connected to the space switch to handle packets of more conventional applications. The transmission scheme and the switch design are described.>