M. Chandrasekaran, V. Sankaranarayanan, S. Upadhyaya
{"title":"SpyCon: Emulating User Activities to Detect Evasive Spyware","authors":"M. Chandrasekaran, V. Sankaranarayanan, S. Upadhyaya","doi":"10.1109/PCCC.2007.358933","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358933","url":null,"abstract":"The success of any spyware is determined by its ability to evade detection. Although traditional detection methodologies employing signature and anomaly based systems have had reasonable success, new class of spyware programs emerge which blend in with user activities to avoid detection. One of the latest anti-spyware technologies consists of a local agent that generates honeytokens of known parameters (e.g., network access requests) and tricks spyware into assuming it to be legitimate activity. In this paper, as a first step, we address the deficiencies of static honeytoken generation and present an attack that circumvents such detection techniques. We synthesize the attack by means of data mining algorithms like associative rule mining. Next, we present a randomized honeytoken generation mechanism to address this new class of spyware. Experimental results show that (i) static honeytokens are detected with near 100% accuracy, thereby defeating the state-of-the-art anti-spyware technique, (ii) randomized honeytoken generation mechanism is an effective anti-spyware solution.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"76 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121492859","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Mobility Support of Multi-User Services in Next Generation Wireless Systems","authors":"Luis Veloso, P. Mendes, E. Monteiro","doi":"10.1109/PCCC.2007.358874","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358874","url":null,"abstract":"The substantial advancement and proliferation of wireless technologies leads to the need to efficiently manage user mobility. Furthermore, the simultaneously emerging of services like video-conference, radio and TV has emphasized the importance to deliver content to several simultaneous receivers. This way, one of the key challenges to deploy multi-user services in the next generation wireless systems is the support of seamless mobility of multi-user services. In this paper the functioning of the seamless mobility of users for media distribution services (SEMUD) proposal is presented. This mobility management technique possesses two operation modes. To provide seamless mobility the standard mode resorts on the collaboration between caches (located in the base stations) and buffers (located in the mobile nodes). The enhanced mode introduces mobility prediction and messages for context transfer between access routers. A performance analysis is given to corroborate the merits of the proposal.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115118462","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Detecting Misused Keys in Wireless Sensor Networks","authors":"Donggang Liu, Qi Dong","doi":"10.1109/PCCC.2007.358904","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358904","url":null,"abstract":"Key management is the cornerstone for secure communication in sensor networks. Researchers have recently developed many techniques to setup pairwise keys between sensor nodes. However, these techniques allow an attacker to compromise a few sensor nodes and learn many pairwise keys used between non-compromised nodes. The attacker can then use these keys to impersonate non-compromised nodes and mislead the sensing application. To deal with this problem, this paper proposes to detect misused keys in sensor networks. The paper introduces a hidden layer of protection, which is designed for the security of pairwise keys rather than the messages in the network. It cannot be seen and will not be used by sensor nodes during normal communication. However, it can be checked by some special nodes to identify suspicious keys. With this idea, this paper develops a serial of techniques to detect misused keys. These techniques make it particularly difficult for an attacker to actively mislead the application using the compromised keys shared between non-compromised nodes. The paper also shows the effectiveness and efficiency of these techniques through analysis and experiments.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124486117","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dynamic and User-Centric Network Selection in Heterogeneous Networks","authors":"Xuejun Cai, Ling Chen, Rute C. Sofia, Yanqi Wu","doi":"10.1109/PCCC.2007.358937","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358937","url":null,"abstract":"The use of multiple interfaces to access heterogeneous networks is becoming a strong reality to end-users. Hence one realistic problem is how to select a specific access interface (and consequently network) as well as how to perform smooth and seamless handover among different types of technologies. In this paper we propose a dynamic and user-centric network selection and decision process which optimizes handover across heterogeneous networks. A satisfaction degree function (SDF) is used to evaluate, according to user's predefined criteria, available networks and select the best one(s) according to such criteria. The criteria consider incorporating user policies and information from several OSI layers, including dynamic network status and application requirements. Numerical results show that the proposed network selection process results in the choice of the best network according to the user's choices.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132059813","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Hierarchical Policy-Based Replication","authors":"C. Doherty, N. Hurley","doi":"10.1109/PCCC.2007.358902","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358902","url":null,"abstract":"We present a system for policy-based autonomic replication of data. The system supports multiple distinct replication schemes for a single data item in order to exploit the range of consistency and quality of service requirements of clients. Based on traffic mix and client requirements, nodes in the system may make independent, integrated replica management decisions based on a partial view of the network. A policy based control mechanism is used to administer, manage, and control dynamic replication and access to resources.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129167923","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Using Byzantine Agreement in the Design Of IPS Systems","authors":"F. C. Osorio","doi":"10.1109/PCCC.2007.358936","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358936","url":null,"abstract":"Intrusion detection, prevention & countermeasure systems (IPS) and architectures commonly used in commercial, as well as research environments, suffer from a number of problems that limit their effectiveness. The most common shortcoming of current IPSs is their inability to survive failures, either generated by typical faults or as a result of a deliberate malicious attack. The Wireless System Security Research Laboratory (WSSRL) attempts to correct this situation by developing a secure architecture and fault-resilient engine (SAFE), a system capable of tolerating such failures. This system makes use of solutions to the Byzantine general's problem, developed earlier by Lamport, Shostak, and Pease. Byzantine agreement protocols are used to achieve consensus about which nodes have been compromised or failed, with a series of synchronized, secure rounds of message exchanges. Once a consensus has been reached, the offending nodes can be isolated and countermeasure actions can be initiated by the system. In this manuscript, we investigate the necessary and sufficient conditions for the application of Byzantine agreement protocols to the intrusion detection problem. Further, a first implementation of this algorithm is embedded in the distributed trust manager (DTM) module of SAFE, and is discussed. The algorithms are evaluated in terms of performance (i.e., time to achieve resolution) and ability to detect attacks.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133230990","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"A Hybrid Disk-Aware Spin-Down Algorithm with I/O Subsystem Support","authors":"Timothy Bisson, S. Brandt, D. Long","doi":"10.1109/PCCC.2007.358900","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358900","url":null,"abstract":"To offset the significant power demands of hard disk drives in computer systems, drives are typically powered down during idle periods. This saves power, but accelerates duty cycle consumption, leading to earlier drive failure. Hybrid disks with a small amount of non-volatile flash memory (NVCache) are coming on the market. We present four I/O subsystem enhancements that exploit the characteristics of hybrid disks to improve system performance: 1) artificial idle periods, 2) a read-miss cache, 3) anticipatory spin-up, and 4) NVCache write-throttling. These enhancements reduce power consumption, duty cycling, NVCache block-erase impact, and the observed spinup latency of a hybrid disk, resulting in lower power consumption, greater reliability, and faster I/O.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125039256","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Vineet Chaudhary, R. Tripathi, N. Shukla, N. Nasser
{"title":"A New Channel Allocation Scheme for Real-Time Traffic in Wireless Cellular Networks","authors":"Vineet Chaudhary, R. Tripathi, N. Shukla, N. Nasser","doi":"10.1109/PCCC.2007.358939","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358939","url":null,"abstract":"In this paper a new channel allocation scheme is proposed and analyzed for real time traffic. There is no division of channels into groups. Two thresholds (lower and higher) are taken depending on the signal strength of the mobile host in the cell. The handoff calls have the right of preemption over the originating calls with signal strength less than the lower threshold value. The performance of the system is evaluated in terms of handoff dropping probability, originating call blocking probability and the channel utilization.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115565608","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Vinh Pham, Erlend Larsen, Knut Øvsthus, P. Engelstad, Ø. Kure
{"title":"Rerouting Time and Queueing in Proactive Ad Hoc Networks","authors":"Vinh Pham, Erlend Larsen, Knut Øvsthus, P. Engelstad, Ø. Kure","doi":"10.1109/PCCC.2007.358891","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358891","url":null,"abstract":"In a MANET network where nodes move frequently, the probability of connectivity loss between nodes might be high, and communication sessions may easily loose connectivity during transmission. The routing protocol is designed to find alternative paths in these situations. This rerouting takes time, and the latency is referred to as the rerouting time. This paper investigates the rerouting time of proactive routing protocols and shows that the rerouting time is considerably affected by queueing. Simulations and analysis are conducted to explore the problem. Finally, we propose a MAC-layer solution that reduces the rerouting time problems due to queueing. Simulations and analysis show that the solution is so effective that it eliminates the entire problem in many situations.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126571911","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Diversified Process Replicæ for Defeating Memory Error Exploits","authors":"D. Bruschi, L. Cavallaro, A. Lanzi","doi":"10.1109/PCCC.2007.358924","DOIUrl":"https://doi.org/10.1109/PCCC.2007.358924","url":null,"abstract":"An interpretation of the notion of software diversity is based on the concept of diversified process replicæ. We define pr as the replica of a process p which behaves identically to p but has some \"structural\" diversity from it. This makes possible to detect memory corruption attacks in a deterministic way. In our solution, p and pr differ in their address space which is properly diversified, thus defeating absolute and partial overwriting memory error exploits. We also give a characterization and a preliminary solution for shared memory management, one of the biggest practical issue introduced by this approach. Speculation on how to deal with synchronous signals delivery is faced as well. A user space proof-of-concept prototype has been implemented. Experimental results show a 68.93% throughput slowdown on a worst-case, while experiencing only a 1.20% slowdown on a best-case.","PeriodicalId":356565,"journal":{"name":"2007 IEEE International Performance, Computing, and Communications Conference","volume":"428 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2007-04-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126081524","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}