The nefarious practice of cyber typosquatting involves deliberately registering Internet domain names containing typographical errors that primarily target popular domain names in an effort to steal their traffic for monetary gain. Typosquatting has existed for well over two decades and continues to be a credible threat to this day. In this work, we discuss the results of a user study that exposes subjects to several uniform resource locators (URLs) in an attempt to determine the effectiveness of several typosquatting techniques that are prevalent in the wild. We also attempt to determine if security education and awareness of cybercrimes such as typosquatting will affect the behavior of Internet users.
Traditional text password authentication is widely used to gain access to computing resources. Older users find the cognitive effort, and manual dexterity skills needed to use strong text passwords challenging. We designed and evaluated our Graphical Password system based on touchscreen selection of familiar facial images embedded randomly among unfamiliar, yet similar images. In our usability study, older users demonstrated a recall rate of 97%, password entropy superior to short PINs, and authentication time comparable to short text passwords.
Wireless providers today are highly motivated to improve efficiencies of spectrum usage. One approach to achieve this is to shift the load from expensive cellular networks to cheaper WiFi networks. In this context, we propose Precog, an action-based prefetching solution for time-shifted WiFi offloading. We argue that traditional prefetching solutions, that rely on the URLs visited in the past by a user for predicting future access, are ineffective in today's dynamic, interactive, and personalized web. Precog addresses this issue by remembering, not the exact URL accessed in the past, but the actions performed on a particular website. The actions are remembered as interactions with the content layout, which stays consistent over a long period of time. Unlike prior offloading solutions that require concurrent cellular and WiFi connectivity, Precog offloads cellular content over time-shifted WiFi access. We evaluate Precog over both synthetic and real user datasets to demonstrate its benefits.
Publish/Subscribe is a widely adopted communication pattern in the Internet. Yet, supporting rich information structures that are common in real life, such as graph-based relationship, has remained an open problem. In this paper, we address this challenge by proposing Graph-Pubsub, an efficient pub/sub architecture that supports graph-based information relationship. Graph-Pubsub spans across multiple layers to maximize dissemination efficiency. In particular, it achieves efficient delivery using Information-Centric Network (ICN), which is able to deliver content based on identities instead of locations. In order not to over-complicate the network with the graph logic, an information layer that works closely with both network and application layers is adopted to maintain the membership for each topic and the relationship among topics. With case studies, we show that the proposed architecture can support a variety of demanding applications with higher efficiency and better flexibility than existing solutions.
By collectively leveraging advanced communications systems, sensing, drones, wearable technologies and large-scale data analysis, smart firefighting is envisioned as the next generation firefighting with the capacities of gathering massive real-time scene data, transferring them into useful information and insights for fire responders, and even providing them with more safe and accurate decisions. For smart firefighting, timeliness and accuracy are two foremost system requirements, yet they are unsatisfied in many applications. One reason for such dilemma is due to the underlying used computing architecture (i.e. cloud computing) that can produce extra latency in large-scale data transmission. To address this problem, we explore the firefighting field utilizing edge computing and discuss the overall system architecture, opportunities, challenges, as well as some early technical suggestions on building edge-enabled smart firefighting. To validate the feasibility of edge computing, we simulate the firefighting context and respectively deploy a video-based flame detection algorithm on a local Intel's edge computing platform and a remote Amazon EC2. The preliminary results show that edge computing can significantly increase system's reactive speed, with on average 50% reduction in system latency.
The principle of least privilege is a fundamental guideline for secure computing that restricts privileged entities to only the permissions they need to perform their authorized tasks. Achieving least privileges in an environment composed of many heterogeneous web services provided by a third party is an important but difficult and error prone task for many organizations. This paper explores the challenges that make achieving least privileges uniquely difficult in the cloud environment and the potential benefits of automated methods to assist with creating least privilege policies from audit logs. To accomplish these goals, we implement two frameworks: a Policy Generation Framework for automatically creating policies from audit log data, and an Evaluation Framework to quantify the security provided by generated roles. We apply these frameworks to a real world dataset of audit log data with 4.3 million events from a small company and present results describing the policy generator's effectiveness. Results show that it is possible to significantly reduce over-privilege and administrative burden of permission management.
Feeding decision support systems with Web information typically requires sifting through an unwieldy amount of information that is available in human-friendly formats only. Our focus is on a scalable proposal to extract information from semi-structured documents in a structured format, with an emphasis on it being scalable and open. By semi-structured we mean that it must focus on information that is rendered using regular formats, not free text; by scalable, we mean that the system must require a minimum amount of human intervention and it must not be targeted to extracting information from a particular domain or web site; by open, we mean that it must extract as much useful information as possible and not be subject to any pre-defined data model. In the literature, there is only one open but not scalable proposal, since it requires human supervision on a per-domain basis. In this paper, we present a new proposal that relies on a number of heuristics to identify patterns that are typically used to represent the information in a web document. Our experimental results confirm that our proposal is very competitive in terms of effectiveness and efficiency.
Random Subdomain DDoS attacks on the Domain Name System (DNS) infrastructure are becoming a popular vector in recent attacks (e.g., recent Mirai attack on Dyn). In these attacks, many queries are sent for a single or a few victim domains, yet they include highly varying non-existent subdomains generated randomly. Motivated by these attacks we designed and implemented novel and efficient algorithms for distinct heavy hitters (dHH). A (classic) heavy hitter (HH) in a stream of elements is a key (e.g., the domain of a query) which appears in many elements (e.g., requests). When stream elements consist of ¡key, subkey¿ pairs, (¡domain, subdomain¿) a distinct heavy hitter (dhh) is a key that is paired with a large number of different subkeys. Our algorithms dominate previous designs in both the asymptotic (theoretical) sense and practicality. Specifically the new fixed-size algorithms are simple to code and with asymptotically optimal space accuracy tradeoffs. Based on these algorithms, we build and implement a system for detection and mitigation of Random Subdomain DDoS attacks. We perform experimental evaluation, demonstrating the effectiveness of our algorithms.
In modern society, social networks play an important role for online users. However, one unignorable problem behind the booming of the services is privacy issues. At the same time, neural networks have been swiftly developed in recent years, and are proved to be very effective in inference attack. This paper conducts an extensive study to infer sensitive personal information from public insensitive attributes in social networks by deploying fully connected neural networks. Correlation matrices and the details of constructing neural networks for social networks are elaborated. To show the advantages of neural networks on inference attack, different traditional machine learning algorithms are also studied. The results show that neural networks can achieve about 4 times of the baseline accuracy to classify low-correlation, high-noise dataset to infer sensitive users' attributes. In addition, neural networks outperform all the selected traditional algorithms. Outcomes from the study are deliberately discussed, and the limitations of both neural networks and traditional machine learning algorithms are also illustrated.
A distributed revision control system (dRCS) such as git or mercurial allows users to track changes1 to a common document.2 When multiple users commit, a primary challenge of a dRCS becomes to provide one view of the current repository state.
Today's websites achieve scalability by either deploying their own platforms with sufficient spare capacity or signing up for services from a content delivery network (CDN). This paper investigates another alternative, where a website directly recruits Internet users to contribute their resources to help deliver the site's content. We show that this alternative, which we call NoCDN, can be implemented securely, transparently to the users accessing the site, and without changes to the content itself.
This paper presents a knowledge and reasoning toolkit for developing cognitive applications which have significant requirements for managing structured and semi-structured data. Our system provides enhanced querying and reasoning capabilities along with natural language processing support and the ability to automatically extract data from PDF documents. We also have the capability to manage ontologies in a user-friendly way. Our system is implemented as a set of Web services, and we provide enhanced clients to allow applications to easily access our knowledge and reasoning toolkit.
With the rapid growth of online social network sites such as Face-book and Twitter, social question and answering (Q&A) has become an important venue for people to seek and share information. However, due to lack of specific Q&A feature design and users' motivations in answering questions, social Q&A has been reported to have a much lower response rate compared with traditional professional Q&A sites such as Stack Overflow and Yahoo! Answers. Recently, WenDa, an emerging social Q&A product built on top of a leading Chinese social website (Sina WeiBo) has been launched to fill this gap. WenDa employs a novel economic model to motivate users to ask and answer questions. In this paper, we conduct an empirical study to understand the effectiveness of this economic model in motivating users to participate in the social Q&A. Besides, we analyze how this economic model and the social user relationships shape the question types as well as question topics. Our observations and study results are of significant values in providing insights for the design and development of social Q&A.
In the past decade, the information security and threat landscape has grown significantly making it difficult for a single defender to defend against all attacks at the same time. This called for introducing information sharing, a paradigm in which threat indicators are shared in a community of trust to facilitate defenses. Standards for representation, exchange, and consumption of indicators are proposed in the literature, although various issues are undermined. In this paper, we take the position of rethinking information sharing for actionable intelligence, by highlighting various issues that deserve further exploration. We argue that information sharing can benefit from well-defined use models, threat models, well-understood risk by measurement and robust scoring, well-understood and preserved privacy and quality of indicators and robust mechanism to avoid free riding behavior of selfish agents. We call for using the differential nature of data and community structures for optimizing sharing designs and structures.
Deduplication is nearly ubiquitous in backup environments, common for data distribution, and increasingly important for wide-area networking. Each of these three domains handles deduplication in a separate manner, but integrating them into an end-to-end deduplication paradigm would enable efficiencies and simplifications that will improve performance, scalability, and functionality.
The centralized zone data service (CZDS) was introduced by the Internet Corporation for Assigned Names and Numbers (ICANN) to facilitate sharing and access to zone data of the new generic Top-Level Domains (gTLDs). CZDS aims to improve the security and transparency of the naming system. In this paper, we investigate CZDS's transparency by measurement. By requesting access to zone data of all gTLDs listed in the CZDS portal, we analyze various aspects of CZDS, including access status, responsiveness and provided reasons for granting access or denial. Among other findings, we find that while a large percent of the gTLD admins respond within reasonable time, more than 10% of them have a long request-to-decision waiting time, and sometimes requests go unanswered even after 6 months of a request. Furthermore, we find that denial cases were for unjustified reasons, requesting information that was provided in the request forms. We discuss implications, and how to enforce better outcomes of CZDS using insight from our measurement.
The Web has many types of third-party domains and has a variety of available ad blockers. This work evaluates ad blocking tools for their effectiveness in blocking the retrieval of different categories of third-party content during download of popular websites. The results of this work demonstrate that there is much variation in the effectiveness of current ad blocking tools to prevent requests to different types of third-party domains. Non-configurable tools such as Blur and Disconnect provide only modest blockage of third-party domains in most categories. The tool uBlock generally demonstrates the best default configuration performance. By default, Ghostery provides no protection while Adblock Plus and Adguard provide minimal protection. They must be manually configured to obtain effective protection. The behavior of Adblock Plus is particularly notable as usage data indicates it has an 85% share of the ad blocking tool market. Other results based on network traces suggest that approximately 80% of these Adblock Plus users employ its default configuration. Construction of a "composite" ad blocker reflecting current usage of ad blockers and their configurations shows this composite ad blocker provides only a modest range reduction of 13-34% in the set of third-party domains retrieved in each category relative to not employing any ad blocker.
The Content Delivery Network (CDN) has become an important element in the Internet, which uses applicationlayer caches to improve user experience and reduce network/server load. However, CDNs face efficiency issues due to the following two reasons: 1) they are not aware of the network status, and 2) the underlying location-centric network (IP) does not understand content. At the same time, the Information-Centric Network (ICN) has been developed to address these issues: they use content identities as routing labels and support functions such as multi-source, multicast and in-network caching. While these in-network caches can help improve the content delivery performance, they are unaware of applicationspecific characteristics like policy and popularity. As a result, we believe application-layer CDN solutions are still beneficial in ICN. They can take advantage of ICN content delivery capabilities while having access to application-level details, therefore getting the best from both worlds. In this paper, we propose a CDN architecture over Mobility-First - a representative example of ICN - to show the benefit of such a design. The solution uses self-certifying names that can enable efficient content validation in CDNs, an applicationlayer CDN design that can maximize the utility of caches, and a pushing mechanism that allows content providers cache content proactively. Through a prototype, we show the feasibility and efficiency of the architecture.
While video watching is now an indispensable part of the general public media consumption, yet very little is known about the relationship between how users interact with each other and how that affects video consumption patterns. In this paper, we explore the relationship between user commenting behavior and how that might or might not be predictive of video consumption patterns such as watch time. Contrary to recent findings, we found that video watch time is correlated with the positive sentiment expressed in the comments of YouTube videos. More precisely, videos with more positive sentiment on average in the comments are more likely to be watched longer; while videos with negative comment sentiment on average are more likely to have shorter watch durations. These results suggest that users prefer videos that evoke positive emotional responses. If the findings here generalizes to other social media, this suggests a motivational design finding that is useful for other system designers.
Enterprises that host services in the cloud need to protect their cloud resources using network services such as firewalls and deep packet inspection systems. While middle boxes have typically been used to implement such network functions in traditional enterprise networks, their use in cloud environments by cloud tenants is problematic due to the boundary between cloud providers and cloud tenants. Instead we argue that network function virtualization is a natural fit in cloud environments, where the cloud provider can implement Network Functions as a Service using virtualized network functions running on cloud servers, and enterprise cloud tenants can employ theseservices to implement security and performance optimizations for their cloud resources. In this paper, we focus on placement issues in the design of a NFaaS cloud and present two placement strategies-tenant-centric and service-centric-for deploying virtualized network services in multi-tenant settings. We discuss several tradeoffs of these two strategies. We implement a prototype NFaaS testbed and conduct a series of experiments to quantify the benefits and drawbacks of our two strategies. Our results suggest that the tenant-centric placement provides lower latencies while service-centric approach is more flexible for reconfiguration and capacity scaling.
