Online social networks (OSNs) provide new means of disseminating information about applications and contents served by network providers. OSN members often reveal their usage information and opinion about applications and contents to their neighbors within their social networks. Consequently, sudden popularity and viral propagation of applications among OSN members can put significant burden on network resources and degrade network performance. Further, viral exchanges might propagate malicious applications and such propagation might need to be kept in check. Accordingly, we propose a novel content distribution architecture that controls the resource utilization within an operator's network by utilizing the existing social connections between users and building a model of information diffusion within the social network. Our method is based upon computing a reward function that takes into account the influence of users over each other in a given social network in terms of application adoption and content consumption. Based on this reward function and assuming that not only the users but also the network operator can limit the exposure of application usage and content consumption over the online social networks, we present algorithms to slow down or speed up the adoption/consumption of different applications/contents given the current state of both the physical network and the social network. We evaluate the effectiveness of this method over a Flickr data set. Results suggest that such a control is indeed possible and the proposed method significantly outperforms other approaches that employs mainly degree-based mechanisms for controlling the information dissemination over the social graphs.

We propose an admission control policy that admits users into a public access network as soon as possible while limiting the overall security impact on the network and other users. In our model, each user has a particular reputation level when first requesting network access. Before admitting a user into the network, the initial risk of a user is assessed by the admission control system using past history and a scanning of the user's device which delays the user's admission into the network and updates the user's reputation level accordingly. We formulate the trade-off between the admission delay and security risk as a convex optimization problem, which can be solved for an admission control policy. The evaluation suggests that our approach can substantially increase the system security for public access networks while minimizing admission delay, in contrast to current approaches widely used in enterprise networks. The proposed framework extends the traditional quality of service- based admission control mechanisms with a well-defined notion of quality of security.

The widespread deployment of wireless networks and hot spots that employ the IEEE 802.11 technology has forced network designers to put emphasis on the importance of ensuring efficient and fair use of network resources. In this work we propose a novel framework for detection of intelligent adaptive adversaries in the IEEE 802.11 MAC by addressing the problem of detection of the worst-case scenario attacks. Utilizing the nature of this protocol we employ sequential detection methods for detecting greedy behavior and illustrate their performance for detection of least favorable attacks. By using robust statistics in our problem formulation, we attempt to utilize the precision given by parametric tests, while avoiding the specification of the adversarial distribution. This approach establishes the lowest performance bound of a given Intrusion Detection System (IDS) in terms of detection delay and is applicable in online detection systems where users who pay for their services want to obtain the information about the best and the worst case scenarios and performance bounds of the system. This framework is meaningful for studying misbehavior due to the fact that it does not focus on specific adversarial strategies and therefore is applicable to a wide class of adversarial strategies.

This paper revisits the problem of detecting greedy behavior in the IEEE 802.11 MAC protocol by evaluating the performance of two previously proposed schemes: DOMINO and the sequential probability ratio test (SPRT). The evaluation is carried out in four steps. We first derive a new analytical formulation of the SPRT that takes into account the discrete nature of the problem. Then we develop a new tractable analytical model for DOMINO. As a third step, we evaluate the theoretical performance of SPRT and DOMINO with newly introduced metrics that take into account the repeated nature of the tests. This theoretical comparison provides two major insights into the problem: it confirms the optimality of SPRT and motivates us to define yet another test, a nonparametric CUSUM statistic that shares the same intuition as DOMINO but gives better performance. We finalize the paper with experimental results, confirming our theoretical analysis and validating the introduction of the new nonparametric CUSUM statistic.

Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focu sing on the back-off manipulation by selfish nodes. We first propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework and providing an optimal detection rule for the worst-case attack scenarios. Finally, we evaluate the performance of single and colluding attackers in terms of detection delay. Although our approach is general and can be used with any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.

Buffer overflows constitute by far the most frequently encountered class of attacks against computer systems. In this paper we introduce a tool, termed bufSTAT that achieves a low probability of false alarm and issues early attack warnings. BufSTAT relies on Finite State Machines (FSM) for attack modeling and can detect every stage of an ongoing attack and can thus prevent its execution by issuing early warning in a progressive manner. It can also detect sophisticated multi-stage attacks that are executed over long periods of time. A significant attribute of our approach is that it is amenable to detecting unknown attacks as well after appropriate modification of bufSTAT.