The virtualization of computing resources provided by containers has gained increasing attention and has been widely used in cloud computing. This new demand for container technology has been growing and the use of Docker and Kubernetes is considerable. According to recent technology surveys, containers are now mainstream. However, currently, one of the major challenges rises from the fact that multiple containers, with different owners, may cohabit on the same host. In container-based multi-tenant environments, security issues are of major concern. In this paper we investigate the performance of container-level anomaly-based intrusion detection systems for multi-tenant applications. We investigate the use of Bag of System Calls (BoSC) technique and the sliding window with the classifier and we consider eight machine learning algorithms for classification purposes. We show that among the eight machine learning algorithms, the best classification results are obtained with Decision Tree and Random Forest which lead to an F-Measure of 99.8%, using a sliding window with a size of 30 and the BoSC algorithm in both cases. We also show that, although both Decision Tree and Random Forest algorithms leads to the best classification results, the Decision Tree algorithm has a shorter execution time and consumes less CPU and memory than the Random Forest.

The applications of Internet of Things (IoT) and associated technologies have been spreading rapidly across a wide range of domains, including environmental monitoring, home automation, and supply chain, having a significant bearing on the social and economic well-being of humans as well as enhancing environmental sustainability. In recent years, however, there have been several data breaches and other security and privacy incidents involving IoT devices , which have attracted significant attention from the research community in both academia and industry. This has resulted in a surge of proposals put forward by many researchers, including IoT blockchain-based security solutions, IoT intrusion detection systems , IoT authentication systems , and IoT security analytics . While these proposals are aimed at addressing various IoT security and privacy-related issues, many of these solutions arguably seem not to focus on helping designers and developers with little or no security expertise in start-up companies to produce secure IoT systems. To this end, the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework was proposed to foster the design and implementation of secure IoT systems. In this paper, we present the performance and usability evaluation of the Security Requirements Elicitation (SRE) and Security Best Practice Guidelines (SBPG) component tools of IoT-HarPSecA, which are two of the three component tools of the security framework. Results show that the two components of the IoT-HarPSecA framework can facilitate the development of secure IoT systems and that the SRE and SBPG tools are easy to use.

The exponential growth in the number of Internet of Things (IoT) devices and applications in recent years can be attributed partly to the emergence of several new IoT startup companies and potential applications. While many of these startups offer significant innovations in the IoT, some of them lack security expertise, resulting in the development of ill-equipped IoT devices and applications in terms of security. For example, one of the fundamental problems faced by non-security experts in the IoT space is how to select the right Lightweight Cryptographic Algorithm (LWCA) for a given security requirement. To address this specific problem, an IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework is proposed in this paper. The security framework is aimed at facilitating the choice of specific security algorithms given a set of security goals, hardware specifications, message payload size, application area, and energy requirement. Within the scope of this framework, we develop an easy-to-use tool in C++ that allows users to interact with the IoT-HarPSecA framework. The tool can potentially help non-security experts, such as electronics and computer engineers as well as application developers make informed decisions on selecting the appropriate security algorithms for their various applications. Finally, the paper presents some preliminary results and discussion.

The world is witnessing the emerging role of Internet of Things (IoT) as a technology that is transforming different industries, global community and its economy. Currently a plethora of interconnected smart devices have been deployed for diverse pervasive applications and services, and billions more are expected to be connected to the Internet in the near future. The potential benefits of IoT include improved quality of life, convenience, enhanced energy efficiency, and more productivity. Alongside these potential benefits, however, come increased security risks and potential for abuse. Arguably, this is partly because many IoT start-ups and electronics hobbyists lack security expertise, and some established companies do not make security a priority in their designs, and hence they produce IoT devices that are often ill-equipped in terms of security. In this paper, we discuss different IoT application areas, and identify security threats in IoT architecture. We consider security requirements and present typical security threats for each of the application domains. Finally, we present several possible security countermeasures, and introduce the IoT Hardware Platform Security Advisor (IoT-HarPSecA) framework, which is still under development. IoT-HarPSecA is aimed at facilitating the design and prototyping of secure IoT devices.

Cloud computing is an established technology to provide computing resources on demand that currently faces several challenges. Main challenges include management of shared resources, energy consumption, load balancing, resource provisioning and allocation, and fulfilment of service level agreements (SLAs). Due to its inherent complexity, cloud simulation is largely used to experiment new models and algorithms. This work presents CloudSim Plus, an open source simulation framework that pursues conformance to software engineering principles and object-oriented design in order to provide an extensible, modular and accurate tool. Based on the CloudSim framework, it aims to improve several engineering aspects, such as maintainability, reusability and extensibility. This work shows the benefits of CloudSim Plus, its particular features, how it ensures more accuracy, extension facility and usage simplicity.

In virtual worlds (including computer games), users develop trust relationships from their in-world interactions with others. However, these trust relationships end up not being represented in the data structures (or databases) of such virtual worlds, though they sometimes appear associated with reputation and recommendation systems. In addition, as far as we know, the user is not provided with a personal trust tool to sustain his/her decision-making while he/she interacts with other users in the virtual or game world. In order to come up with a computational formal representation of these personal trust relationships, we need to succeed in converting in-world interactions into reliable sources of trust-related data. In this paper, we develop the required formalisms to gather and represent in-world interactions-which are based on the activity theory-as well as a method to convert in-world interactions into trust networks. In the companion paper, we use these trust networks to produce a computational trust decision based on subjective logic. This solution aims at supporting in-world user (or avatar) decisions about others in the game world.

Representing, manipulating, and inferring trust from the user point of view certainly is a grand challenge in virtual worlds, including online games. When someone meets an unknown individual, the question is “Can I trust him/her or not?” This requires the user to have access to a representation of trust about others, as well as a set of operators to undertake inference about the trustability of other users/players. In this paper, we employ a trust representation generated from in-world data in order to feed individual trust decisions. To achieve that purpose, we assume that such a representation of trust already exists; in fact, it was proposed in another paper of ours. Thus, the focus here is on the trust mechanisms required to infer trustability of other users/players. More specifically, we use an individual trust representation deployed as a trust network as base to the inference mechanism that employs two subjective logic operators (consensus and discount) to automatically derive trust decisions. The proposed trust inference system has been validated through OpenSimulator scenarios, which has led to a 5% increase on trustability of avatars in relation to the reference scenario (without trust).

The degradation of the security of password-based mechanisms, combined with the increasing number of perils on the Internet, is rendering one-factor authentication outdated. This threatens the security of online operations for enterprises and end users, and consequently affects cloud computing solutions. Although cloud computing provides appealing benefits in terms of costs reduction, while increasing productivity, it introduces uncharted security issues (e.g., see [1]) beyond the ones inherited from the Internet. The emergence of mobile computing also makes authentication a priority, and has been reinforcing the need to build stronger and more resilient mechanisms; and simultaneously providing the means to develop new authentication mechanisms, namely Multi-Factor Authentication (MFA) schemes. The convergence to Single Sign-On (SSO) models is being used to eliminate or decrease password management complexity. MFA mostly appears in the form of Two-Factor Authentication (2FA) mechanisms based on One-Time Passwords (OTPs) for the second factor after standard password authentication. Such mechanisms can be based on public-key cryptography and may resort to several technologies to improve user experience, namely Quick Response (QR) codes, Short Message Service (SMSes), Trusted Platform Modules (TPMs), or even contactless Near Field Communication (NFC). Another trend leans to the adoption of risk-based authentication. Efforts for securing authentication are mainly being undertaken by the Initiative for Open AuTHentication (OATH) and the Fast IDentity Online (FIDO) alliance.

Classifying network traffic constitutes one of the most defying research topics nowadays. On the one hand, traffic classification is critical for assuring Quality of Service (QoS), the correct functioning and the security of the networks. On the other hand, the increasing complexity and throughput of networks, added to the problems caused by encryption and other evasive techniques, make of traffic classification a difficult and expensive task to perform. This paper describes a traffic classification in the dark mechanism based on matching several empirical distributions representing computer applications with the one of the target traffic. The classifier combines two methods for performing such matching in real-time and on a packet-by-packet manner: one based on the Kolmogorov-Smirnov test, and another one based on the Chi-Squared test. The experimental results included show that the mechanism is accurate and suitable for implementations demanding real-time operation.

Dynamic contrast-enhanced magnetic resonance (DCE-MR) of the breast is especially robust for the diagnosis of cancer in high-risk women due to its high sensitivity. Its specificity may be, however, compromised since several benign masses take up contrast agent as malignant lesions do. In this paper, we propose a novel method of 3D multifractal analysis to characterize the spatial complexity (spatial arrangement of texture) of breast tumors at multiple scales. Self-similar properties are extracted from the estimation of the multifractal scaling exponent for each clinical case, using lacunarity as the multifractal measure. These properties include several descriptors of the multifractal spectra reflecting the morphology and internal spatial structure of the enhanced lesions relatively to normal tissue. The results suggest that the combined multifractal characteristics can be effective to distinguish benign and malignant findings, judged by the performance of the support vector machine classification method evaluated by receiver operating characteristics with an area under the curve of 0.96. In addition, this paper confirms the presence of multifractality in DCE-MR volumes of the breast, whereby multiple degrees of self-similarity prevail at multiple scales. The proposed feature extraction and classification method have the potential to complement the interpretation of the radiologists and supply a computer-aided diagnosis system.

Voice over Internet Protocol (VoIP) applications based on peer-to-peer (P2P) communications have been experiencing considerable growth in terms of number of users. To overcome filtering policies or protect the privacy of their users, most of these applications implement mechanisms such as protocol obfuscation or payload encryption that avoid the inspection of their traffic, making it difficult to identify its nature. The incapacity to determine the application that is responsible for a certain flow raises challenges for the effective management of the network. In this paper, a new method for the identification of VoIP sessions is presented. The proposed mechanism classifies the flows, in real-time, based on the speech codec used in the session. To make the classification lightweight, the behavioral signatures for each analyzed codec were created using only the lengths of the packets. Unlike most previous approaches, the classifier does not use the lengths of the packets individually. Instead, it explores their level of heterogeneity in real time, using entropy to emphasize such feature. The results of the performance evaluation show that the proposed method is able to identify VoIP sessions accurately and simultaneously recognize the used speech codec.

The inclusion of encryption or evasive techniques in popular applications increased the importance of characterizing network traffic based on behavior. This study aims to characterize peer-to-peer (P2P) traffic from the perspective of host computers by focusing on the packet lengths. The article explores the dissimilarities between the lengths of Internet Protocol (IP) packets generated by P2P and non-P2P applications. The heterogeneity of those lengths was assessed using entropy and compared for different classes of applications, through the implementation of a sliding analysis window. Initial observations show that the lengths of the packets generated by P2P applications are more varied than those of non-P2P applications. These patterns were used to implement a method to identify hosts running P2P applications. Unlike previous studies on this area, we used the heterogeneity of the packet lengths instead of the length value per se, and a sliding window calculation procedure was adopted to allow real-time processing. The results of this study can be used for the characterization of traffic generated by P2P applications, as well as for traffic classification and management purposes.

doi: 10.1093/comjnl/bxr127 Comp J 2012;55(6): 740–755 In the above article, on page 751, the image used for Figure 7 was incorrect. The image should have been:

The motion compensation is one of the most important mechanisms in the context of video coding, allowing the efficient coding of temporal information. Video coding standards have been using entropy coding for motion information which is more prone to transmission errors than fixed-length coding. In this paper, we propose a joint source-channel decoding (JSCD) scheme for robustly decoding motion vectors, enabling the traditional usage of motion compensation in noisy channel scenarios while still maintaining a good coding efficiency. At the encoder, motion vectors are simply coded using scalar quantization enabling scalable video coding setups. The decoder then tries to recover corrupted motion vectors by means of a maximum-a-posteriori (MAP) estimation. This scheme works in open-loop mode, not requiring feedback from the decoder, which is equally important for noisy channel environments. Because some of the coding complexity is brought from the encoder to the decoder, this scheme can be employed in nontraditional applications like video streaming from low power mobile peers.

Processing medical data has always been an interesting field that has shown the need for effective image segmentation methods. Modern medical image segmentation solutions are focused on 3D image volumes, which originate at advanced acquisition devices. Operating on such data in a 3D environment is essential in order to take the full advantage of the available information. In this paper we present an extended version of our 3D image segmentation and reconstruction model that belongs to the family of Deformable Models and is capable of processing large image volumes in competitive times and in fully 3D environment, offering a big level of automation of the process and a high precision of results. It is also capable of handling topology changes and offers a very good scalability on multi-processing unit architectures. We present a description of the model and show its capabilities in the field of medical image processing.

The number and popularity of applications developed over the Peer-to-Peer (P2P) network paradigm has been growing over the last decade, some of which are dedicated to streaming multimedia content. To deceive traffic shaping mechanisms or improve the security of the communications, these applications generate encrypted traffic or resort to several obfuscation techniques, making it difficult to manage this kind of traffic at the network level. In this work, we propose a method that explores transmission vulnerabilities of the encrypted traffic allowing its detection. Hence, an experimental test bed was created to capture a diversity of traffic, which includes flows of a widely used P2P media streaming application called Goal Bit. The collected traces of traffic were then analysed, and a set of rules was created for the SNORT network intrusion detection system, which allows the successful detection of the encrypted traffic generated by Goal Bit. The accuracy of this system was then validated experimentally.

Wireless channels are more prone to transmission errors than wired communications counterparts, leading to excessive packet retransmission that is very inconvenient on media streaming. The multiple-description-coding (MDC) has proven to be very effective against transmission errors, thus providing a solution for that problem. What is presented is a method for MDC using the highly optimized and scalable JPEG 2000. Descriptions are encoded by our modified version of JPEG 2000 which produces compatible codestreams provided with key-error detection registers. The multiple-description JPEG 2000 decoder is then capable of precisely detecting transmission errors and to efficiently choose between available description-information, achieved by a clever exploitation of the EBCOT system. To test the potential of the proposed method, it is integrated as a spatial MD-Coder in a state-of-the-art joint-source channel video coder framework capable of an efficient bit-allocation between descriptions. A comprehensive set of experimental results is presented.

Traffic monitoring and analysis is of critical importance for managing and designing modern computer networks, and constitutes nowadays a very active research field. In most of their studies, researchers use techniques and tools that follow a statistical approach to obtain a deeper knowledge about the traffic behaviour. Network administrators also find great value in statistical analysis tools. Many of those tools return similar metrics calculated for common properties of network packets. This paper presents NetOdyssey, a new tool for the statistical analysis of network traffic. It is able to capture the traffic from the network card or from a pre-collected trace, and generates several statistics calculated for different traffic properties in separate threads. Its modular architecture allows one to adapt NetOdyssey to specific analysis purposes, resorting to the possibility to easily implement custom-made modules, whose implementation principles are also described in here.

Traffic modeling and simulation plays an important role in the area of Network Monitoring and Analysis, for it provides practitioners with efficient tools to evaluate the performance of networks and of their elements. This article focus on the traffic generated by a single source, providing an overview of what was done in the field and studying the statistical properties of the traffic produced by a personal computer, including analysis of the autocorrelation structure. Different distributions were fitted to the interarrival times, packet sizes, and byte count processes with the goal of singling out the ones most suitable for traffic generation.

In this paper we present a novel approach for image segmentation using Active Nets and Active Volumes. Those solutions are based on the Deformable Models, with slight difference in the method for describing the shapes of interests - instead of using a contour or a surface they represented the segmented objects with a mesh structure, which allows to describe not only the surface of the objects but also to model their interiors. This is obtained by dividing the nodes of the mesh in two categories, namely internal and external ones, which will be responsible for two different tasks. In our new approach we propose to negate this separation and use only one type of nodes. Using that assumption we manage to significantly shorten the time of segmentation while maintaining its quality.

This paper presents a novel model for 3D image segmentation and reconstruction. It has been designed with the aim to be implemented over a computer cluster or a multi-core platform. The required features include a nearly absolute independence between the processes participating in the segmentation task and providing amount of work as equal as possible for all the participants. As a result, it is avoid many drawbacks often encountered when performing a parallelization of an algorithm that was constructed to operate in a sequential manner. Furthermore, the proposed algorithm based on the new segmentation model is efficient and shows a very good, nearly linear performance growth along with the growing number of processing units.

Deformable models are a popular family of image segmentation techniques, which has been gaining significant focus in the last two decades, serving both for real-world applications as well as the base for research work. One of the features that the deformable models offer and that is considered a much desired one, is the ability to change their topology during the segmentation process. Using this characteristic it is possible to perform segmentation of objects with discontinuities in their bodies or to detect an undefined number of objects in the scene. In this paper we present our model for handling the topology changes in image segmentation methods based on the Active Volumes solution. The said model is capable of performing the changes in the structure of objects while the segmentation progresses, what makes it efficient and suitable for implementations over powerful execution environment, like multi-core architectures or computer clusters.

This paper presents a new architecture for optical burst switched networks where the control plane of the network functions in a cooperative manner. Each node interprets the data conveyed by the control packet and forwards it to the next nodes, making the control plane of the network distribute the relevant information to all the nodes in the network. A cooperation transmission tree is used, thus allowing all the nodes to store the information related to the traffic management in the network, and enabling better network resource planning at each node. A model of this network architecture is proposed, and its performance is evaluated.

The increasing number of applications offering their services over peer-to-peer (P2P) platforms is changing the properties of the traffic within computer networks. Their massive use raises a few imperative challenges for network administrators and Internet service providers, regarding the quality of service and security of their networks. It such scenario, it is important to develop mechanisms to control and efficiently manage the P2P traffic and prepare the networks to support it, for which it is necessary to study the effect of P2P applications in the traffic of computer networks and to develop methodologies to characterise its behaviour. In this paper, the characteristics of the traffic generated by P2P applications are analysed from the behavioural point of view, and entropy is used to measure the heterogeneity embedded in the packet sizes. The results obtained show evident difference between P2P and non-P2P traffic, being the proposed approach applicable to real-time and high-speed networks with encrypted P2P traffic, where the existing methodologies are useless.

This paper proposes a new resource reservation protocol for optical burst switching networks, called enhanced just-in-time (E-JIT). E-JIT intends to improve and optimize the traditional JIT protocol, keeping all the advantages of its simplicity in terms of implementation. E-JIT aims to improve data channel scheduling, reducing the period of time in which the data channel remains in reserved status, optimizing channel utilization and reducing the burst loss probability. A performance assessment of E-JIT is presented for mesh optical burst switching networks with 16 nodes. It is shown that E-JIT may lead to a better performance than JIT for small burst loss probabilities.

In this paper, we present a performance analysis of WDM-based networks with nodal degrees between 2 and 3 leads to higher nodal degree gains. These results make degree 3 and degree 4 topologies very attractive for use in the optical core of IP-over-WDM networks. Our results show that there are several degree four topologies, with a performance very close to the optimum, which may be implemented in the optical core of IP-over-WDM networks. These results clearly increase the implementation flexibility of degree four topologies in those environments.

This paper presents a simulation methodology for performance assessment of wavelength division multiplexing (WDM) systems using directly modulated quantum-well lasers and optically preamplified direct detection receivers. The methodology is based on a pure semi-analytical method which combines noiseless WDM transmission simulation with noise analysis in those systems. Using this approach, we discuss the performance implications of single-cavity, double-cavity and three-mirror Fabry-Perot (FP) demultiplexers for dispersion supported transmission (DST) of three WDM channels separated by 1 nm. Assuming that a three-mirror filter is used as demultiplexer, the performance of a 40 Gbit/s capacity four-channel WDM-DST system is assessed for 0.5 nm channel spacing. The robustness of the multichannel DST method against pattern dependencies is also investigated for this channel spacing.