18970831
A Scalable, Vulnerability Modeling and Correlating Method for Network Security
Nowadays attacks are becoming increasingly frequent and sophisticated, and they are also becoming increasingly interconnected. Recent works in network security have demostrated the fact that combinations of vulnerability exploits are the typical means by which an attacker can break into a network. It is therefore in great need of performing vulnerability analysis to do security analysis first and take the initiative to find hidden safety problems, then plan effective security measures. In this paper, we propose an analysis model, which derives vulnerability analysis functionality from the interaction of three distinct processes: scanning, modeling and correlating. Scanning is served as a significant issue for identifying vulnerabilities. Modeling provides a concise representation for expressing fact base such as host configuration, vulnerability information, and network topology. Moreover, correlating is used to provide a perspective into correlating isolated vulnerabilities in order to construct layered attack graph. Transition rule is presented in scalable design, which enables highly efficient methods of vulnerability correlation algorithm. Finally, a real case study has been described to demonstrate the capability of our model.
782382
A Lightweight Mechanism to Mitigate Application Layer DDoS Attacks
Application layer DDoS attacks, to which network layer solutions is not applicable as attackers are indistinguishable based on packets or protocols, prevent legitimate users from accessing services. In this paper, we propose Trust Management Helmet (TMH) as a partial solution to this problem, which is a lightweight mitigation mechanism that uses trust to differentiate legitimate users and attackers. Its key insight is that a server should give priority to protecting the connectivity of good users during application layer DDoS attacks, instead of identifying all the attack requests. The trust to clients is evaluated based on their visiting history, and used to schedule the service to their requests. We introduce license, for user identification (even beyond NATs) and storing the trust information at clients. The license is cryptographically secured against forgery or replay attacks. We realize this mitigation mechanism and implement it as a Java package and use it for simulation. Through simulation, we show that TMH is effective in mitigating session flooding attack: even with 20 times number of attackers, more than 99% of the sessions from legitimate users are accepted with TMH; whereas less than 18% are accepted without it.
14474115
Active Measurement of Routing Table in Kad
As the first DHT implemented in real applications and involving millions of simultaneous users, all aspects of Kad must be analyzed and measured carefully. This paper focuses on measuring the routing table of Kad in eMule/aMule. We present and analyze the availability and stability of routing table by crawling actively. 
 
We find the phenomenon of ID repetition in Kad that many peers use a same ID simultaneously, which will decrease the performance of routing and then reduce the availability of routing table. The connection availability of global routing table is relatively low, the average of which is about 64.9%. Connection availability influences the efficiency of searching and routing in Kad network directly.
16398028
A Detection and Offense Mechanism to Defend Against Application Layer DDoS Attacks
Application layer DDoS attacks, which are legitimate in packets and protocols, gradually become a pressing problem for commerce, politics and military. We build an attack model and characterize layer-7 attacks into three classes: session flooding attacks, request flooding attacks and asymmetric attacks. We proposed a mechanism named as DOW (defense and offense wall), which defends against layer-7 attacks using combination of detection technology and currency technology. An anomaly dete-ction method based on K-means clustering is introduced to detect and filter request flooding attacks and asymmetric attacks. To defend against session-flooding attacks, we propose an encouragement model that uses client's session rate as currency. Detection model drops suspicious sessions, while currency model encourages more legitimate sessions. By collaboration of these two models, normal clients could gain higher service rate and lower delay of response time.
45747
A new analysis of the value of unlabeled data in semi-supervised learning for image retrieval
There has been an increasing interest in using unlabeled data in semi-supervised learning for various classification problems. Previous work shows that unlabeled data can improve or degrade the classification performance depending on whether the model assumption matches the ground-truth data distribution, and also on the complexity of the classifier compared with the size of the labeled training set. In this paper, we provide a new analysis on the value of unlabeled data by considering different distributions of the labeled and unlabeled data and showing the migrating effect for semi-supervised learning. Extensive experiments have been performed in the context of image retrieval applications. Our approach evaluates the value of unlabeled data from a new aspect and is aimed to provide a guideline on how unlabeled data should be used
10879292
Rate-limited EAFRP-a new improved model for high-speed network traffic
The Extended Alternating Fractal Renewal Process (EAFRP) model has recently been proposed for modeling the self-similar and impulsive traffic of high-speed networks. For mathematical simplicity, it assumes that the available transmission bandwidth in the network is infinite. In reality, the network has a limit R on the total traffic rate through it, and in addition, the ith user's traffic rate is often limited to special value L/sub i/, which is assigned by the bandwidth sharing protocol. We propose a model for single-user traffic, which, by taking into account the aforementioned rate limit L/sub i/ and R, and in the absence of congestion, provides insight on the distinctive two slope behavior of the loglog survival function of multiuser traffic. For small to medium number of users, such as in local area networks (LANs), the model results in non-Gaussian traffic, whereas as the number of users increases, the resulting traffic is Gaussian, both of which are consistent with real network measurements. We discuss model parameter estimation, provide queuing analysis of the multiple-user traffic model, and, based on real data, show that it achieves a closer approximation of the observed reality than existing models.
40826674
Boosting Multiple Classifiers Constructed by Hybrid Discriminant Analysis
In this paper, a set of hybrid dimension reduction schemes is constructed by unifying principal component analysis (PCA) and linear discriminant analysis (LDA) in a single framework. PCA compensates LDA for singular scatter matrix caused by small set of training samples and increases the effective dimension of the projected subspace. Generalization of hybrid analysis is extended to other discriminant analysis such as multiple discriminant analysis (MDA), and the recent biased discriminant analysis (BDA), and other hybrid pairs. In order to reduce the search time to find the best single classifier, a boosted hybrid analysis is proposed. Our scheme boosts both the individual features as well as a set of weak classifiers. Extensive tests on benchmark and real image databases have shown the superior performance of the boosted hybrid analysis.
522561
POLUS: A POwerful Live Updating System
This paper presents POLUS, a software maintenance tool capable of iteratively evolving running software into newer versions. POLUS's primary goal is to increase the dependability of contemporary server software, which is frequently disrupted either by external attacks or by scheduled upgrades. To render POLUS both practical and powerful, we design and implement POLUS aiming to retain backward binary compatibility, support for multithreaded software and recover already tainted state of running software, yet with good usability and very low runtime overhead. To demonstrate the applicability of POLUS, we report our experience in using POLUS to dynamically update three prevalent server applications: vsftpd, sshd and apache HTTP server. Performance measurements show that POLUS incurs negligible runtime overhead: a less than 1% performance degradation (but 5% for one case). The time to apply an update is also minimal.
10430483
Knowledge contribution in problem solving virtual communities: the mediating role of individual motivations
Increasing knowledge contribution in problem solving virtual communities (PSVCs) is a long-pursued question in the knowledge management arena for both researchers and practitioners. In view of various mechanisms developed in hopes of encouraging more active participations, we proposed a motivational model for PSVC contributions. Drawn on functional motivation theory and expectancy-value theory, we highlight the mediating role of individual motivations in the relationships between characteristics of PSVCs and knowledge contribution intention. By taking both self-interest and public-good perspectives, we identify eight individual motivations to knowledge contribution in the context of PSVCs. They are active learning, self-enhancement, reciprocity, reputation, enjoyment of helping others, self-protection, moral obligation and advancement of virtual community motive. Besides, we also identify four major mechanisms in PSVCs that are associated with members' motivations: codification, identity management, virtual community norms and communication methods.