Low-rate attacks can conceal their traffic because their packets are at very low rates, which make it easy to bury themselves into the normal traffic. Thus, although a number of volume-based detection techniques are able to identify anomalies that trigger significant changes in traffic volume, they are not applicable to detecting low-rate attacks. Because of this, the problem of low-rate attacks has been attracting many researchers in the community of network security. In this study, for the first time we propose a method based on the normal behavior mode of traffic to detect outbreaks of low-rate attacks. The experimental result indicates that our proposal is efficient.
Web-based malware attacks have become one of the most serious threats that need to be addressed urgently. Several approaches that have attracted attention as promising ways of detecting such malware include employing various blacklists. However, these conventional approaches often fail to detect new attacks owing to the versatility of malicious websites. Thus, it is difficult to maintain up-to-date blacklists with information regarding new malicious websites. To tackle this problem, we propose a new method for detecting malicious websites using the characteristics of IP addresses. Our approach leverages the empirical observation that IP addresses are more stable than other metrics such as URL and DNS. While the strings that form URLs or domain names are highly variable, IP addresses are less variable, i.e., IPv4 address space is mapped onto 4-bytes strings. We develop a lightweight and scalable detection scheme based on the machine learning technique. The aim of this study is not to provide a single solution that effectively detects web-based malware but to develop a technique that compensates the drawbacks of existing approaches. We validate the effectiveness of our approach by using real IP address data from existing blacklists and real traffic data on a campus network. The results demonstrate that our method can expand the coverage/accuracy of existing blacklists and also detect unknown malicious websites that are not covered by conventional approaches.
We present the results of a comparative study on the design of meta-heuristic algorithms for achieving parabolic fairness in wireless channel allocation. Wireless channel allocation (WCA) is a basic problem of fair distribution of indivisible goods, in this case the allocation of channels to users in a wireless schedule. Parabolic fairness represents a state that coincides with maxmin fairness in fair end-to-end user traffic rate allocation. This state can also be represented by maximization of a special case of the ordered weighted averaging operator. The related task then is to find an algorithm to approximate that maximum value for the WCA as close as possible. Here, several heuristic approaches are taken into account: a simple annealing heuristic, its integration into an Iterated Local Search (ILS) and also the integration of ILS as local search of a memetic algorithm. The comparison gives that best results can be achieved by the ILS, with up to 2-3 times improved performance compared to other algorithms and for practically relevant problem dimensions.
In this paper, we present the concept design, and implementation of a novel network measurement system for the future Internet. The new protocol offers end-point applications a mechanism for utilizing internal information to maximize transport. By a cross-layer approach, we can automatically to collect information along a path while upholding a disclosure policy for the information. The protocol has been implemented on commonly used operating systems and has been tested on both commercial and test-bed networks. A peer-to-peer file sharing application has been modified to support the protocol and experiments shows that download times were reduced and bandwidth was used more efficiently.
The IP Multimedia Subsystem (IMS) supports many kinds of multimedia services and is constantly evolving to meet the growth of mobile services and Internet applications. However, the security specifications of IMS networks do not provide any features to protect the system against Denial of Service (DoS) attacks, so a malicious attack can block the system by congesting a core service of IMS. To address the DoS attack problem, we propose an anomaly-based detection system using the Tanimoto distance to identify deviations in the traffic. We use a modified moving average approach to select a threshold. We also propose using a momentum oscillator to detect a slightly increasing attack. We evaluated the ability of our technique to detect attacks using a comprehensive synthetic data set containing various malicious traffic. Experimental results show that our technique accurately identified attacks and has the flexibility to deal with many types of attack patterns.
