{"title":"It's Time for An Internet-wide Recommitment to Measurement: And Here's How We Should Do It","authors":"P. Vixie","doi":"10.1145/2903185.2903186","DOIUrl":"https://doi.org/10.1145/2903185.2903186","url":null,"abstract":"There has never been a greater need for comprehensive Internet metrics than now. Even basic security-critical facts about the Internet, such as \"How many systems are botted?\" or \"What networks still don't do Source Address Validation?\" remain murky and poorly quantified. Likewise, traffic characterization and summary inter-AS flow data typically remain closely-held proprietary information, rather than routinely-shared basic operational data. Without trustworthy Internet measurements of this sort, we're \"driving blind\" and will routinely make suboptimal choices about critical technical policies, including issues as fundamental as network neutrality. System and network measurements were once an integral part of Internet practice, something that was hardly surprising given the Internet's roots in the university community. Scientists naturally make observations, record data, and analyze that data to document phenomena and advance the state-of-the-art. More recently, however, a variety of factors have created an online environment that's hostile to legitimate academic Internet measurement and monitoring efforts. Major drivers contribute to that public hostility, including overly-aggressive marketing analytics and domestic pervasive monitoring by the intelligence community. It all feels like eavesdropping to the public, even though important real differences exist and reforms have taken place. Bottom line, the public is having none of any of it.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127278562","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Session details: Algorithms","authors":"Maciej Korczyński","doi":"10.1145/3254076","DOIUrl":"https://doi.org/10.1145/3254076","url":null,"abstract":"","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115046191","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"FNFD: A Fast Scheme to Detect and Verify Non-Technical Loss Fraud in Smart Grid","authors":"Wenlin Han, Yang Xiao","doi":"10.1145/2903185.2903188","DOIUrl":"https://doi.org/10.1145/2903185.2903188","url":null,"abstract":"Non-Technical Loss (NTL) fraud is a very common fraud in power systems. In traditional power grid, energy theft, via meter tampering, is the main form of NTL fraud. With the rise of Smart Grid, adversaries can take advantage of two-way communication to commit NTL frauds by meter manipulation or network intrusion. Previous schemes were proposed to detect NTL frauds but are not efficient. In this paper, we propose a Fast NTL Fraud Detection and verification scheme (FNFD). FNFD is based on Recursive Least Square (RLS) to model adversary behavior. Experimental results show that FNFD outperforms existing schemes in terms of efficiency and overhead.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"72 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126529629","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Characterizing Roles and Spatio-Temporal Relations of C&C Servers in Large-Scale Networks","authors":"Romain Fontugne, J. Mazel, K. Fukuda","doi":"10.1145/2903185.2903192","DOIUrl":"https://doi.org/10.1145/2903185.2903192","url":null,"abstract":"Botnets are accountable for numerous cybersecurity threats. A lot of efforts have been dedicated to botnet intelligence, but botnets versatility and rapid adaptation make them particularly difficult to outwit. Prompt countermeasures require effective tools to monitor the evolution of botnets. Therefore, in this paper we analyze 5 months of traffic from different botnet families, and propose an unsupervised clustering technique to identify the different roles assigned to C&C servers. This technique allows us to classify servers with similar behavior and effectively identify bots contacting several servers. We also present a temporal analysis method that uncovers synchronously activated servers. Our results characterize 6 C&C server roles that are common to various botnet families. In the monitored traffic we found that servers are usually involved in a specific role, and we observed a significant number of C&C servers scanning the Internet.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"98 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127501598","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Session details: Measurements of Security, Attacks, and Fraud","authors":"M. van Eeten","doi":"10.1145/3254075","DOIUrl":"https://doi.org/10.1145/3254075","url":null,"abstract":"","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127109825","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Huan Guo, Zhengmin Li, Qingyun Liu, Jia Li, Zhou-yu Zhou, Bo Sun
{"title":"A High Performance IPv6 Flow Table Lookup Algorithm Based on Hash","authors":"Huan Guo, Zhengmin Li, Qingyun Liu, Jia Li, Zhou-yu Zhou, Bo Sun","doi":"10.1145/2903185.2903187","DOIUrl":"https://doi.org/10.1145/2903185.2903187","url":null,"abstract":"With the rapid increasing IPv6 network traffic, some network process systems like DPI and firewall cannot meet the demand of high network bandwidth. Flow table based on hash is one of the bottlenecks. In this paper, we measure the characteristics of IPv6 address and propose an entropy based revision hash algorithm, which can produce a better distribution within acceptable time. Moreover, we use a hierarchical hash strategy to reduce hash table lookup times further more even in extreme cases.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128068460","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Jiawei Su, K. Yoshioka, Junji Shikata, Tsutomu Matsumoto
{"title":"An Efficient Method for Detecting Obfuscated Suspicious JavaScript Based on Text Pattern Analysis","authors":"Jiawei Su, K. Yoshioka, Junji Shikata, Tsutomu Matsumoto","doi":"10.1145/2903185.2903189","DOIUrl":"https://doi.org/10.1145/2903185.2903189","url":null,"abstract":"The malicious JavaScript is a common springboard for attackers to launch several types of network attacks, such as Drive-by-Download and malicious PDF delivery attack. In order to elude detection of signature matching, malicious JavaScript is often packed (so-called \"obfuscation\") with diversified algorithms therefore the occurrence of obfuscation is always a good pointer for potential maliciousness. In this investigation, we propose a light weight approach for quickly filtering obfuscated JavaScript by a novel method of tokenizing JavaScript text at letter level and information-theoretic measures, based on the previous work in the domain of detecting obfuscated malicious code as well as the pattern analysis of natural languages. The new approach is apparently time efficient compared to existing systems since it processes much less objects while it is also proved to be able to reach the acceptable detection accuracies.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130646595","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Fast and Accurate Identification of Active Recursive Domain Name Servers in high-speed Network","authors":"Xiaomei Liu, Yong Sun, Caiyun Huang, Xueqiang Zou, Zhiguang Qin","doi":"10.1145/2903185.2903190","DOIUrl":"https://doi.org/10.1145/2903185.2903190","url":null,"abstract":"Fast and accurate identification of active recursive domain name servers (RDNS) is a fundamental step to evaluate security risk degrees of DNS systems. Much identification work have been proposed based on network traffic measurement technology. Even though identifying RDNS accurately, they waste huge network resources, and fail to obtain host activity and distinguish between direct and indirect RDNS. In this paper, we proposed an approach to identify direct and forward RDNS based on our three key insights on their request-response behaviors, and proposed an approach to identify indirect RDNS based on CNAME redirect behaviors. To work in high-speed backbone networks, we further proposed an online connectivity estimation algorithm to obtain estimated values used in our identification approaches. According to our experiments, we can identify RDNS with a high accuracy by selecting the reasonable thresholds. The accuracy of identifying direct and forward RDNS can reach 89%.The accuracy of identifying indirect RDNS can reach 90%.Moreover, our work is capable of real-time analyzing high speed backbone traffics.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"41 6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114029947","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Image Processing Pipeline Model Integrating Steganographic Algorithms for Mobile Cameras","authors":"P. Dahal, D. Peng, H. Sharif","doi":"10.1145/2903185.2903191","DOIUrl":"https://doi.org/10.1145/2903185.2903191","url":null,"abstract":"Mobile phones these days are extensively used to capture and share multimedia right from the device without the basic security processing like watermarking. This necessitates the need for multimedia to be watermarked right within the mobile hardware for copyright protection and authentication. In this paper, we propose an image processing pipelining model for mobile cameras that integrates watermarking algorithm with the image capturing processes in cameras. Differently from existing works reported in literature, the unique contribution in this paper is to have image watermarked while in the early capturing process. In other words, the processes for digital image capturing and watermarking have become as a single non-separable procedure in the camera hardware systems. The paper proposes watermarking raw image data before it becomes display ready within the image capturing process. Also, the watermarking algorithm used to develop the model, without losing generality, caters to the computational efficiency requirement for mobile devices while being robust against image coding at the same time. Simulations results demonstrate that the proposed approach is robust against JPEG compression.","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"55 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-05-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114667087","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","authors":"","doi":"10.1145/2903185","DOIUrl":"https://doi.org/10.1145/2903185","url":null,"abstract":"","PeriodicalId":308602,"journal":{"name":"Proceedings of the 2016 ACM International on Workshop on Traffic Measurements for Cybersecurity","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132658193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}