The increasing reliance on online services across critical sectors (e.g., banking, healthcare, and government) makes robust network infrastructures paramount. However, these services are frequently targeted by malicious actors leveraging distributed overlay networks (botnets) to execute attacks (e.g., data theft, service disruption, and ransomware campaigns). The impact of such attacks correlates with the scale and capabilities of the compromised infrastructure. Therefore, early and proactive detection of botnet infections is crucial for limiting their growth and mitigating potential damage. This paper presents and evaluates a Digital Twin-based approach for proactive botnet detection and multi-level mitigation within large-scale networks, particularly ISP infrastructures. Through simulations using a dedicated network topology framework, we demonstrate how these strategies can effectively limit botnet growth and significantly reduce their impact on critical network operations.

DDoS attacks continue to grow in both volume and complexity, increasingly exploiting protocol-layer vulnerabilities in core Internet protocols such as NTP, DNS, and HTTP/S. Traditional defense mechanisms, primarily based on static rules and signature-based filtering, have limited adaptability and struggle to handle rapidly evolving attack strategies. This research proposes a protocol-aware and adaptive DDoS defense framework where XDP/eBPF and LLMs serve as modular, complementary components that can be deployed individually or in combination, depending on the attack scenario and the specific characteristics of the target protocol. XDP/eBPF enables high-performance, lowlevel packet filtering directly at the NIC level, offering efficient, line-rate mitigation capabilities. Meanwhile, LLMs are fine-tuned on structured protocol interaction logs (e.g., query sequences, entropy shifts, and temporal patterns) to detect semantic-level anomalies beyond traditional detection thresholds. The proposed framework improves detection accuracy and supports dynamic, context-sensitive mitigation strategies, such as real-time traffic throttling and adaptive rule generation. This modular design allows the system to dynamically adapt to evolving threats in heterogeneous networks.

Our communication systems face a constant threat of cyberattacks. Advanced attacks go beyond the capabili-ties of established detection methods. Threat Hunting (TH), a hypothesis-driven, analyst-centric approach, is one technique for detecting advanced persistent threat (APT) activities. However, it can be resource-intensive, require specialized expertise, and may not always produce immediate or clear results. In addition to TH, anomaly detection is also a way to detect APT activities, but it suffers from a high false positive rate (FPR). We explore combining TH with anomaly detection to address the high FPR in anomaly detection, reduce the analyst's workload, and improve hunting success. Our approach, FUDD, a TH framework that applies graph-based anomaly detection on log data to detect APT activities, provides the threat hunter with an anomaly report based on a hypothesis. The anomaly report makes unusual behavior visible, potentially validating the initial hypothesis and facilitating the evolution and generation of more specific hypothe-ses. Our evaluation involves instantiating FUDD and applying it to two DARPA Transparent Computing sample datasets. Our results show that analysts can use the report's top$k$anomalies to identify attacks based on an initially very broad hypothesis. Besides attacks, the report also highlights other unusual system behavior. . which helps enhance the system's overall security.

The 3rd Generation Partnership Project (3GPP) introduced a service-based architecture in the 5G core network, enabling flexible communication through modular network functions and the separation of control and user planes. While the integration of machine learning (ML) and artificial intelligence (AI) via the Network Data Analytics Function (NWDAF) has enhanced capabilities like anomaly detection and resource optimization, challenges persist in identifying unknown attacks, particularly within encrypted traffic. Current ML methods often fail to leverage the temporal graph structure inherent in network traffic, limiting their effectiveness. This paper proposes a novel anomaly detection framework, Granomaly, leveraging Temporal Graph Neural Networks (TGNNs) to analyze control plane traffic in 5G core networks. The framework includes a simulated 5G core network, two benchmark datasets tailored for TGNN anomaly detection, and the application of two TGNN methods. Results demonstrate that TG NN s effectively detect subtle traffic anomalies” improving the robustness and security of 5G networks.

Various domains, including critical infrastructures, industry, and the private sector, deploy cyber-physical systems (CPS). These systems integrate IT and OT components and interact with the environment and therefore differ significantly from pure IT setups. However, CPS often operate as black boxes, hindering effective attack detection. Our research addresses the challenge of detecting attacks in CPS relying on network data and learning on normal behavior. We show the performance of two methods in use for attack detection without attack knowledge. We propose new memory update strategies that can be used in practice. Specifically, we optimize for temporal graphs using graph neural networks (GNN) to capture system behavior. Negative sampling helps to use one-class learning. Our results show that a temporal graph network (TGN), combined with negative sampling, is suitable for one-class learning and can be used for attack detection. Additionally, a simple heuristic suffices for detecting basic attacks. Notably, existing benchmark datasets do not adequately support one-class learning, highlighting the need for tailored evaluation.

MANETs comprise several mobile nodes, wirelessly connected with each other. Transmission capacities in these networks are limited and easily over-utilized, especially if multiple flows are present. Paths are constructed decentralized, where each participant's routing decision is based on local and incomplete topology knowledge. This makes multi-flow path distribution costly and complex. Nodes of MANETs are mobile and topologies are continuously changing, which on top forces routing to compute paths as fast as possible. Recent work proposes a topology update algorithm, constructing a graph out of the complete network topology at runtime. We leverage this knowledge and propose the pathfinding technique RbDRP, aiming for capacity-conform paths in minimum execution time. Therefore, we artificially generate over-utilized network segments, which have to be resolved by our approach. RbDRP applies a robust link metric to compute long-living paths. Evaluations compare and discuss the results regarding the number of found capacity-conform path settings, the runtimes, and their connection lifetimes.

The Border Gateway Protocol (BGP) is known to have several security weaknesses. Two major threats are BGP prefix hijacking and BGP route leaks. A hijack refers to the illegitimate announcement of another Autonomous System’s (AS) IP prefix space while a route leak is the accidental forwarding of a route to a peer that should not have received such an announcement. The Resource Public Key Infrastructure (RPKI) provides origin validation and is able to mitigate a subset of prefix hijacking attacks. Route leaks and forged-origin prefix hijacks are not yet properly addressed. Autonomous System Provider Authorization (ASPA) and AS-Cones are two path plausibility algorithms proposed within the Internet Engineering Task Force (IETF) to mitigate these issues. This work implements ASPA and AS-Cones in a simulation testbed. We compare deployment strategies and recommend to start deploying both algorithms in a top-down manner, starting with the AS with the highest connectivity. While AS-Cones requires less ASes to participate it shows similar benefits in route leak mitigation. Only ASPA can mitigate the forged-origin prefix hijack and results heavily depend on the victim AS to participate in ASPA object creation.

The adoption of the Resource Public Key Infrastructure (RPKI) is increasing. To better understand and improve RPKI deployment, measuring route origin authorization (ROA) objects, RPKI route origin validation (ROV), and RPKI resilience is essential. In this paper, we survey RPKI-related research that aims to understand RPKI deployment. Additionally, we enrich our survey with many industry and IETF-related contributions. Our work provides an in-depth analysis of the many ideas and challenges discussed in studies of the RPKI ecosystem and includes lessons from mistakes made in the past, which we should avoid in the future.

Due to their high volume and data recency, communications from social media platforms have become an excellent source for monitoring information diffusion. The insights leveraged are invaluable for social media analysts in the areas of event analysis and emergency management. Existing work ranges from the initial detection of incidents over information enrichment to determining an incident's relevance and life span. Until now, individual parts of this process have been considered separately, but never in combination.

BGP is known to be inherently insecure. Many solutions have been proposed, with the RPKI becoming operational in 2011. The RPKI only provides origin validation. This leaves path manipulation attacks and route leaks unsolved. In this demo session, we present our integration of two path plausibility algorithms, namely ASPA and AS-Cones, into the GoBGP routing daemon. We present advantages and drawbacks of both approaches and extend the NIST BGP-SRx software suite with the first implementation of AS-Cones.

BGP has been known to be vulnerable to hijacking and path manipulation attacks for many years. Several solutions have been proposed to secure either the origin, the path, or both. A known issue for new ideas is their evaluation. Simulation environments are easy to use but can only mimic real-world deployments to a certain extent. In this work, we propose BGPEval. A framework that is capable of creating large-scale testbeds based on the KVM hypervisor and Docker container technology that mimics the interconnection of ASes according to a provided AS graph. We use several layers of abstraction to spawn and interconnect as many as 55,000 containers. Our work takes significant effort away from an evaluator, who can now focus on the implementation rather than the creation of testbeds for the evaluation.

MANETs comprise several mobile nodes, wirelessly connected with each other. These networks are self-organized, each participant is responsible for routing and data forwarding. Routing protocols only provide local or outdated topology knowledge because participants are moving continuously. Also, transmission capacities are limited which often results in over-utilized network segments. Capacity conform path distribution is challenging since nodes route based on their incomplete topology knowledge. Recent work showed that an up-to-date and complete network topology representation can quickly be delivered to a controller, which is instantiated on an arbitrary node. Now, routing and path deployment can be outsourced to the controller. With this knowledge, we introduce several path finding approaches to answer the question if and to which extent non over-utilizing routes for several flows can be found where common MANET routing techniques would fail. Also, paths have to be computed quickly since topologies change due to the mobility of nodes. Our path finding techniques also focus on routes aiming for long connection lifetime. We compare our approaches regarding capacity usage, computation times, and connection lifetimes, taking into consideration typical MANET behavior.

Botnets are the top concern responsible for SPAM, Cryptomining, DDoS attacks and offer a variety of attacks-as-a-service to disrupt IT infrastructure and services. Current approaches to detect and analyze Botnet characteristics rely on disassembly and reverse engineering, and single instance deployments in an isolated environment. However, Botnets consist of distributed and interconnected instances and thus current approaches only observe a fraction of a Botnet and its characteristics. In this paper, we introduce the framework DMEF to deploy and analyze malware in a scalable, distributed and secure environment. DMEF provides a training environment for network administrators and researchers in the fight against malware and contributes to optimize intrusion response.

The “Single European Sky” air traffic management master plan foresees the introduction of several modern digital data links for aeronautical communications. The candidate for long-range continental communications is the L-band Digital Aeronautical Communications System (LDACS). LDACS is a cellular, ground-based digital communications system for flight guidance and communications related to safety and regularity of flight. Hence, the aeronautical standards, imposed by the International Civil Aviation Organization (ICAO), for cybersecurity of the link and network layer, apply. In previous works, threat- and risk analyses of LDACS were conducted, a draft for an LDACS cybersecurity architecture introduced, algorithms proposed, and the security of a Mutual Authentication and Key Establishment (MAKE) procedure of LDACS formally verified. However, options for cipher-suites and certificate management for LDACS were missing. Also, previous works hardly discussed the topic of post-quantum security for LDACS. This paper proposes a cell-attachment procedure, which establishes a secure LDACS communication channel between an aircraft and corresponding ground-station upon cell-entry of the aircraft. Via the design of a hybrid LDACS Public Key Infrastructure (PKI), the choice of a pre- or post-quantum Security Level (SL) is up to the communications participants. With that, this work introduces a full LDACS cell-attachment protocol based on a PKI, certificates, certificate revocation and cipher-suites including pre- and post-quantum options. Evaluations in the symbolic model show the procedure to fulfill LDACS security requirements and a communications performance evaluation demonstrates feasibility, matching requirements imposed by regulatory documents.

The deployment of the Resource Public Key Infrastructure (RPKI) is currently gaining traction within the operator community and so are measurement methodologies trying to measure the current deployment status. These methodologies, which are attempting to infer Autonomous Systems (ASs) performing Route Origin Validation (ROV), are applied onto real world data but validation of the results is usually hard as no ground-truth dataset exists. We propose to build such a dataset with the help of Mininet in a way that ROV measurement methodologies can be evaluated within a testbed in which filtering ASs are known to the experimenter. The Mininet topology generator will not only be specific for RPKI measurements but could be used also as an evaluation testbed for any kind of measurements that require a ground-truth dataset. Our framework is fed with real world BGP collector data, renders an abstraction of the acquired topology graph and translates it into a Mininet topology. In our scenario, RPKI filtering is deployed within the topology such that the testbed can later on be used to evaluate existing RPKI ROV measurement methodologies. We therefore plan to contribute an automated Mininet topology generator and insights into the accuracy of current ROV identification methodologies.

Artificial Intelligence is often part of state-of-the-art Intrusion Detection Systems. However, attackers use Artificial Intelligence to improve their attacks and circumvent IDS systems. Botnets use artificial intelligence to improve their Domain Name Generation Algorithms. Botnets pose a serious threat to networks that are connected to the Internet and are an enabler for many cyber-criminal activities (e.g., DDoS attacks, banking fraud and cyber-espionage) and cause substantial economic damage. To circumvent detection and prevent takedown actions, bot-masters use DGAs to create, maintain and hide C&C infrastructures. Furthermore, botmasters often release its source code to prevent detection, leading to numerous similar botnets that are created and maintained by different botmasters. As these botnets are based on nearly the same source code basis, they often share similar observable behavior. Current work on detection of DGAs is often based on applying machine learning techniques, as they are capable to generalize and to also detect yet unknown derivatives of a known botnets. However, these machine learning based classifiers can be circumvented by applying adversarial learning techniques. As a consequence, there is a need for resilience against adversarial learning in current Intrusion Detection Systems. In our work, we focus on adversarial learning in DNS based IDSs from the perspective of a network operator. Further, we present our concept to make existing and future machine learning based IDSs more resilient against adversarial learning attacks by applying multi-level Moving Target Defense strategies.

Machine learning has proved to be a promising technology to determine whether a piece of software is malicious or benign. However, the accuracy of this approach comes sometimes at the expense of its robustness and probing these systems against adversarial examples is not always a priority. In this work, we present a gradient-based approach that can carefully generate valid executable malicious files that are classified as benign by state-of-the-art detectors. Initial results demonstrate that our approach is able to automatically find optimal adversarial examples in a more efficient way, which can provide a good support for building more robust models in the future.

Differentiated Services Code Points are values that can be used on IP packets to mark traffic and allow for different Quality of Service treatment during the traversal through a network. Explicit Congestion Notifications are used to indicate that congestion on a network occurred. Both values are encoded in the previously called Type of Service field in the IP header. In this paper, we look at codepoint values for DSCP and ECN in relation to the ports used on the transport layer, which lets us infer the application that is generating the traffic. We provide new measurement data by analyzing traffic from Internet backbone links collected by CAIDA from the months March, April, and May 2018 in New York City. Our results show that DSCP codepoints are rarely used in IPv4 but even less in IPv6. Moreover, most traffic using DSCP codepoints is only using default values and not values designed for prioritization of packets. ECN-enabled traffic is scarce in IPv4, while in IPv6 it appears to be neglectable. However, we could observe differences for certain application traffic in the usage of DSCP and ECN codepoints and elaborate on their distribution.

Nearly all scenarios in the networking domain require reliable radio communication. However, for some use-cases such as military operations or disaster recovery in the realm of catastrophic events it is even more crucial for successful completion. In practice, MANETs are commonly used for these scenarios as they expose features that suit military as well as civil requirements very well, e.g. strict QoS limitations and specific data type support. Since new applications require not only the transmission of static content, but instead the continuous transfer of large audio and video streams, a network structured according to the MANET architecture might easily be over-utilized. This usually results in higher delays and increased loss rate. However, aforementioned scenarios are a common use-case in which MANETs should still deliver on QoS guarantees to avoid DoS conditions. In this paper, we propose a solution for a MANET that is highly utilized by adding a SDN controller responsible for traffic scheduling, although the traffic itself continues to be routed through the MANET. Our approach monitors the MANET's bandwidth utilization and determines routes according to this knowledge. In addition, the controller decreases the bandwidth of flows if the MANET cannot provide the requested resources. We show, that the use of CSMA/CA for the scheduling algorithm within the controller lacks certain properties and elaborate on solving this issue.

Distributed large-scale cyber attacks targeting the availability of computing and network resources still remains a serious threat. In order to limit the effects caused by those attacks and to provide a proactive defense, mitigation should move to the networks of Internet Service Providers. In this context, Moving Target Defense (MTD) is a technique that increases uncertainty due to an ever-changing attack surface. In combination with Software Defined Networking (SDN), MTD has the potential to reduce the effects of a large-scale cyber attack. In this paper, we combine the defense techniques moving-target using Software Defined Networking and investigate their effectiveness. We review current moving-target defense strategies and their applicability in context of large-scale cyber attacks and the networks of Internet Service Providers. Further, we enforce the implementation of moving target defense strategies using Software Defined Networks in a collaborative environment. In particular, we focus on ISPs that cooperate among trusted partners. We found that the effects of a large-scale cyber attack can be significantly reduced using the moving-target defense and Software Defined Networking. Moreover, we show that Software Defined Networking is an appropriate approach to enforce implementation of the moving target defense and thus mitigate the effects caused by large-scale cyber attacks.

Many publications deal with profile matching across online social networks and the approaches become increasingly complex. Almost all of them rely on common profile attributes like names and hobbies or structural attributes like relations to other user profiles. These approaches require high effort concerning computation, because each profile of one network has to be compared to all profiles of the other network. Complex approaches are not well suited to handle large datasets. Therefore, we present an approach to significantly reduce complexity by exploiting special properties of dataset IDs. We provide a proof of concept by an implementation of the use case of matching user profiles accross Twitter and Instagram. Additionally to the complexity problem of existing approaches, many profiles with similar attributes often lead to a restrictive trade-off between precision and recall of the matching strategy. Furthermore, profile attributes and relationships are not trustworthy, as these are due to arbitrary change by profile owners. In contrast to most existing approaches that rely on user definable attributes, we rather focus on timing properties of user publications across social media platforms. There are already profile matching approaches based on timing patterns. However, these do not aim to reduce complexity, what is a necessary requirement to be applicable to real-world online social networks. As we will show, the approach can be easily transferred to other networks.

Intrusion detection has been an active field of research for more than 35 years. Numerous systems had been built based on the two fundamental detection principles, knowledge-based and behavior-based detection. Anyway, having a look at day-to-day news about data breaches and successful attacks, detection effectiveness is still limited. Even more, heavy-weight intrusion detection systems cannot be installed in every endangered environment. For example, Industrial Control Systems are typically utilized for decades, charging off huge investments of companies. Thus, some of these systems have been in operation for years, but were designed afore without security in mind. Even worse, as systems often have connections to other networks and even the Internet nowadays, an adequate protection is mandatory, but integrating intrusion detection can be extremely difficult - or even impossible to date. We propose a new lightweight current-based IDS which is using a difficult to manipulate measurement base and verifiable ground truth. Focus of our system is providing intrusion detection for ICS and SCADA on a low-priced base, easy to integrate. Dr. WATTson, a prototype implemented based on our concept provides high detection and low false alarm rates.

IP Geolocation is a key enabler for many areas of application like Content Delivery Networks, targeted advertisement and law enforcement. Therefore, an increased accuracy is needed to improve service quality. Although IP Geolocation is an ongoing field of research for over one decade, it is still a challenging task, whereas good results are only achieved by the use of active latency measurements. This paper presents an novel approach to find optimized Landmarks positions which are used for active probing and introduce an improved location estimation. Since a reasonable Landmark selection is important for a highly accurate localization service, the goal is to find Landmarks close to the target with respect to the infrastructure and hop count. Current techniques provide less information about solving this problem as well as are using imprecise models. We demonstrate the usability of our approach in a real-world environment. The combination of an optimized Landmark selection and advanced modulation results in an improved accuracy of IP Geolocation.

The identification of the exact path that packets are routed on in the network is quite a challenge. This paper presents a novel, efficient traceback strategy named Tracemax in context of a defense system against distributed denial of service (DDoS) attacks. A single packet can be directly traced over many more hops than the current existing techniques allow. In combination with a defense system it differentiates between multiple connections. It aims to letting non-malicious connections pass while bad ones get thwarted. The novel concept allows detailed analyses of the traffic and the transmission path through the network. The strategy can effectively reduce the effect of common bandwidth and resource consumption attacks, foster early warning and prevention as well as higher the availability of the network services for the wanted customers.

Cyber Physical Systems (CPSs) are widely expected to be formed of networked resource constrained devices. To suit the constraints of such networks, the IETF developed the RPL routing protocol for Low-power and Lossy Networks (LLNs). Security in CPSs is important for maintaining the integrity and privacy of data, while also improving network resiliency to attacks. Even though RPL provides support for integrity and confidentiality of messages, details regarding key management and signatures are not covered. Since complexity and size is a core concern in LLNs, off-loading the security features to a Trusted Platform Module (TPM) can make it possible to include sophisticated security provisions in an RPL implementation. This paper presents how it would be possible to use the security mechanisms of a TPM in order to secure the communication in an RPL network.

Wireless Sensor Networks (WSNs) have recently emerged as an important research topic. Due to the enormous number of sensor nodes and the constrained resources, specific research challenges can be identified with respect to security. Almost all available commercial and research sensor nodes are equipped with ZigBee transceiver chips, and thus making ZigBee the de-facto standard in WSN communication. Since Joshua Wright's KillerBee Framework was released with its focus on exploring and exploiting the security of ZigBee networks, non security-hardened WSNs increase the risk of being vulnerable against certain attacks such as simple association flooding and packet replay attacks. We propose an anomaly-based approach intrusion detection system (IDS) optimized for ZigBee-based WSN to protect ZigBee-based WSN nodes against KillerBee supported attacks. We describe the KillerBee attack procedure and propose an approach of guarding a ZigBee transceiver. Based on an extended sensor node/network simulation and analysis framework, we demonstrate furthermore how our anomaly-based detection engine can thwart attacks on a ZigBee transceiver.

Service Level Agreements (SLAs) are well-known from a large variety of business branches. However, despite the increasing importance of the Internet and electronic communication, a fairly low dissemination of IP carrying SLAs is observed. IP carrying SLAs are offered by Internet Service Providers (ISPs) documenting network service levels such as maximum packet loss, maximum packet delay, or availability. Among the reasons for the low dissemination are certainly the difficult monitoring and measurement possibilities in a multi-provider environment. This paper presents an architecture for a multi-domain auditing system, which is able to monitor the fulfillment of service levels documented in SLAs across several domains. With the already proposed MeSA protocol this architecture presents a comprehensive solution. We conclude the paper with a detailed assessment, including simulation results that are based on real trace input data, showing the validity of the overall approach.

Social networks are very popular for several years and are one of the most important communication channels in the Internet today. Facebook and Twitter are well-known examples. According to a study of the Nielsen Company, communication on social networks already has overtaken the use of Email. Numerous users are releasing a lot of private information and details about their daily habits and lifestyle, trusting the correct treatment and protection of their data as appointed in the terms of usage. Furthermore, not only private communication but also in the commercial environment, advertising and business contacts are done by social networks and are increasingly important. On the other side, headlines of data leakage are appearing day-to-day. Also, the creation of user profiles or disposition of posted messages is an upcoming and fast evolving threat. The use of protected connections like TLS is not enough, because the data itself presented on the servers of the social networks is not secured. Yet, there is no solution for ensuring the confidentiality of the user data stored on a public server and accessible for a specific user group on the one side and being fully transparent and without any server-side requirements for the protection on the other side. Therefore, new concepts are necessary to enable the users to protect their own information by themselves without the need for cooperation of the service provider. We propose a new concept for securing shared information on public servers in a transparent manner. A first prototype for the Firefox browser and the social network Facebook was built and tested very successfully. It has a modular design and therefore it is easy to include new websites or cryptographic modules. The mode of operation is transparent for the user and very easy to use. By the use of our encryption concept, the user can control the distribution of her data in an easy and effective way.

Encrypting network traffic is a normal procedure to protect information for exchange. This prevents tapping and manipulation but it also hampers intrusion as well as data leakage and misuse detection. Obtaining knowledge about users of encrypted communications is, however, beneficial in terms of monitoring access, security and accounting reasons. Thus, the objective is to provide evidence of the source of actions, especially to detect insiders and illegal connections, without the necessity of decrypting the network traffic. We propose a novel architecture to identify users of encrypted traffic in a network environment of a company. It is based on statistical evaluation of monitored network packets. The proposed approach utilizes and combines two main aspects, the mode of operation of remote sessions and the keystroke dynamics of users. Aspects such as capturing and clustering network traffic, generating user profiles and patterns, and statistical analysis are part of the architecture.

Intrusion Detection Systems (IDS) are integral components for the detection of malicious code and attacks. Detection methods can be differentiated in signature-based and anomaly-based systems. While the former ones search for well-known patterns which are available in a database, the latter ones build a model of the normal behavior of a network and later on attacks can be detected by measuring significant deviation of the network status against the normal behavior described by the model. Often this requires the availability of the payload of the network packets. If encryption protocols like SSL or SSH are used, searching for attack signatures in the payload is not possible any longer and also the usage of behavior based techniques is limited: Statistical methods like flow evaluation can be used for anomaly detection, but application level attacks hidden in the encrypted traffic can be undetectable. At the moment, only a few systems are designed to cope with encrypted network traffic. Even so, none of these systems can be easily deployed in general because of the need for protocol modifications, special infrastructures or because of high false alarm rates which are not acceptable in a production environment. In this paper, we propose a new IDS for encrypted traffic which identifies command sequences in encrypted network traffic and evaluates the attack possibility of them. The encrypted traffic is clustered and possibilities for different commands are calculated. Based on that, command sequences are analysed. The system evaluates probabilities for commands and command sequences and the likeliness for an attack based on the identified sequences without a decryption of the packets. Because of only using statistical data gathered from the network traffic, the system can be deployed in general. The current prototype of the system focuses on the command evaluation.

The provisioning of remote and composed services in support of various application areas has dramatically increased over recent times. Thus, the concept of Grids has evolved, in the sense of a common platform for electronic service provisioning in multi-domain environments. While, traditionally, Grids have seen a quite static existence, many new service compositions have to take place on-demand and for certain periods of time only. To tackle those issues the concept of Virtual Organizations (VO) delivers a highly suitable representation of such dynamic Grids. However, one important open problem at this stage is the lack of applicable, distributed, and efficient accounting schemes for commercial resource and service consumptions. Even for simple management purposes, e.g., sampling or archiving, this functionality is essential. Therefore, a comprehensive model for Grid accounting has been developed and suitable accountable units have been defined, in which an underlying activity- and resource-based accounting model covers economic cost theory. Furthermore, this work is based on a service model proposed for service provisioning in dynamic VOs, overcoming the typically static nature of traditional Grids.

As of today, grids provide the technology, applications, and platforms for a seamless access to resources, services, and content in a fully decentralized world of distributed information, computing power, and information technology business. Grid systems have evolved over time from pure computational grids to service grids and therefore provide a sustainable platform for electronic service provisioning in research-oriented and commercial multi-domain environments. Dealing with complex virtual services and virtual resources where service compositions have to take place on-demand, for certain periods of time, and across organizational boundaries imposes new challenging requirements to the underlying accounting system. The paper proposes an accounting system for complex virtual services and resources in grid environments based on (i) a service model for dynamic virtual organizations, overcoming the typically static nature of traditional grids, and (ii) a detailed description of a job workflow, in order to identify accounting relevant components and interfaces within a virtual organization. Based on the insights gained, a concept is proposed to derive accounting records, documenting the usage of virtual services and resources, out of the various data sources. Since virtual services and resources are provided by several providers (real or virtual organizations), the complexity of this task is obvious. An assessment, of the proposed system is done through a prototypical implementation based upon specific data from grid middlewares such as the Globus toolkit.

As of today, grids provide the technology, applications, and platforms for a seamless access to resources, services, and content in a fully decentralized world of distributed information, computing power, and information technology business. Grid computing is about resource sharing and coordinated problem solving in dynamic, multi-institutional virtual organization. Increasingly, advanced grid approaches address knowledge grids. Therefore, the goal is to create a transparent grid infrastructure, to make the grid invisible and to overcome today's rather static approaches. Thus, the dynamic virtual organizations (DVOs) approach provides the right incentives to act as an enabler for invisible grids. First, this paper studies DVOs and its grid service management requirements. Second, a concept for service management of DVOs is presented

This paper addresses the problem of dynamic service provisioning. The vision is that customers would be able to review a set of services or service packages, select or customize a package, send their selection to a service provider, whereupon the provider clicks an "execute" button, and the services are turned on, monitored, and managed. To address this issue, we propose a framework for a service provisioning system. The key issues of the framework are: (i) the concept of a service template and (ii) the idea of looking at a service template as a case and applying case-based reasoning methods to an automated service provisioning system.

Problems in planning IT services can be regarded as constraint satisfaction problems (CSP). A CSP is defined by a set of variables, a set of values for variables, and a set of constraints over variables. A solution to the CSP is an assignment of variables (i.e., a value for each variable) such that all constraints are satisfied.