Detecting Stealthy Backdoors with Association Rule Mining

in IFIP Networking 2012 (2012)

In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system ... [more ▼]

In this paper we describe a practical approach for detecting a class of backdoor communication channel that relies on port knocking in order to activate a backdoor on a remote compromised system. Detecting such activation sequences is extremely challenging because of varying port sequences and easily modifiable port values. Simple signature-based ap- proaches are not appropriate, whilst more advanced statistics-based test- ing will not work because of missing and incomplete data. We leverage techniques derived from the data mining community designed to detect se- quences of rare events. Simply stated, a sequence of rare events is the joint occurrence of several events, each of which is rare. We show that search- ing for port knocking sequences can be reduced to a problem of finding rare associations. We have implemented a prototype and show some ex- perimental results on its performance and underlying functioning. [less ▲]

Improving Highway Traffic through Partial Velocity Synchronization

in Proceedings of the IEEE Global Communications Conference 2012 (2012)

In this paper we address the problem of uncoor- dinated highway traffic. We first identify the main causes of the capacity drop, namely high traffic demand and inadequate driver reaction. In the past ... [more ▼]

In this paper we address the problem of uncoor- dinated highway traffic. We first identify the main causes of the capacity drop, namely high traffic demand and inadequate driver reaction. In the past, traffic and user behavior have been accurately described by cellular automata (CA) models. In this paper we extend the CA model to deal with highway traffic fluctuations and jams. Specifically, the model incorporates the communication layer between vehicles. The model thus enables us to study the impact of inter-vehicular communications and in particular the delivery of critical and timely upstream traffic information on driver reaction. Based on the newly-available traffic metrics, we propose an Advanced Driver Assistance System (ADAS) that suggests non-intuitive speed reduction in order to avoid the formation of so-called phantom jams. The results show that using such a system considerably increases the overall traffic flow, reduces travel time and avoids unnecessary slow-downs. [less ▲]

Comparison of Low-Latency Anonymous Communication Systems - Practical Usage and Performance

in Ninth Australasian Information Security Conference (2011)

The most popular system for providing practical low-latency anonymity on the Internet is Tor. However, many other tools besides Tor exist as both free and commercial solutions. In this paper, we consider ... [more ▼]

The most popular system for providing practical low-latency anonymity on the Internet is Tor. However, many other tools besides Tor exist as both free and commercial solutions. In this paper, we consider five most popular low-latency anonymisation services that represent the current state of the art: single-hop proxies (Perfect Privacy and free proxies) and Onion Routing based solutions (Tor, I2P, and Jon-Donym). We assess their usability and rank them in regard to their anonymity. We also assess their efficiency and reliability. To this end, we define a set of metrics and present extensive measurements based on round-trip time, inter-packet delay variation and throughput. Apart from the technical realization, economic aspects are also crucial for anonymous communication systems. In order to attract more users, which is mandatory in order to improve anonymity per se, systems need to exhibit a certain payoff. We therefore define an economic model that takes all relevant aspects into consideration. In this paper, we describe the results obtained, lessons learned, and provide guidance for selecting the most appropriate system with respect to a set of requirements. [less ▲]

Measuring anonymity using network coordinate systems

in International Symposium on Communications and Information Technologies (ISCIT), 2011 (2011)

Popularity and awareness of anonymisation systems increased tremendously over the past years, however only a very few systems made it from research to production. These systems usually add intermediate ... [more ▼]

Popularity and awareness of anonymisation systems increased tremendously over the past years, however only a very few systems made it from research to production. These systems usually add intermediate nodes in the communication path aiming to hide user identities. Several attacks against these systems exist, like timing attacks or exploitation of latency information. In this paper, we propose an alternative approach to disclose users of current popular anonymisation systems in practice by the means of virtual network coordinate systems, a widely accepted method for latency prediction and network optimisation. Mapping physical nodes to a n-dimensional space can reveal a geographical proximity that is used to disclose users, who expect to stay anonymous. We define a model that leverages network coordinates in order to measure quantitatively the anonymity services and evaluate it on the Planet-Lab research network. The basic idea is to analyse the relative distance between nodes and to calculate the probability of nodes being hosted in the same location. Evaluation proves that our proposed model can be used as a measure of anonymity. [less ▲]

Website Fingerprinting in Onion Routing Based Anonymization Networks

in 18th ACM Computer and Communications Security (ACM CCS) Workshop on Privacy in the Electronic Society (WPES) (2011)

Performance Bound for Routing in Urban Scenarios

in Proceedings of the 7th Asian Internet Engineering Conference (AINTEC 2011) (2011)

In this paper we present a novel evaluation methodology for the comparison of ad hoc routing protocols in urban scenarios applied to inter-vehicular communications. We introduce a new route evaluation ... [more ▼]

In this paper we present a novel evaluation methodology for the comparison of ad hoc routing protocols in urban scenarios applied to inter-vehicular communications. We introduce a new route evaluation metric that identifies the goodness of a given route. Through analysis of subsequent mobility snapshots of the network topology, we compute an optimal route between two communicating vehicles. We compare the properties of the obtained route to the most representative routing approaches namely reactive and proactive routing. Based on this evaluation we provide a detailed discussion on the pros and cons of the different schemes when applied to urban scenarios. [less ▲]

Defensive configuration with game theory

in The 11th IFIP/IEEE International Symposium on Integrated Network Management (2009)

Modeling and Reconfiguration of critical Business Processes for the purpose of a Business Continuity Management respecting Security Risk and Compliance requirements at Credit Suisse using Algebraic Graph Transformation

in Enterprise Distributed Object Computing Conference Workshops, 2009. EDOCW 2009. 13th, Proc. International Workshop on Dynamic and Declarative Business Processes (DDBP 2009) (2009)

Critical business processes can fail. Therefore, continuity processes are needed as backup solutions. At the same time business processes are required to comply with security, risk and compliance ... [more ▼]

Critical business processes can fail. Therefore, continuity processes are needed as backup solutions. At the same time business processes are required to comply with security, risk and compliance requirements. In the context discussed here, they should be modeled in a decentralized local and declarative way, including methodological support by tools. By discussing a simplified loan granting process in the context of a Business Continuity Management System at Credit Suisse, we show how algebraic graph transformation can contribute a methodologically sound solution being compatible with all these requirements in a coherent way. As a consequence significant benefits of automation and quality can be realized. The presented contribution is theoretically sound and implementable by the people in the field. [less ▲]

Slotted Packet Counting Attacks on Anonymity Protocols

in The proceedings of the Australasian Information Security Conference (2009)

In this paper we present a slotted packet counting attack against anonymity protocols. Common packet counting attacks make strong assumptions on the setup and can easily lead to wrong conclusions, as we ... [more ▼]

In this paper we present a slotted packet counting attack against anonymity protocols. Common packet counting attacks make strong assumptions on the setup and can easily lead to wrong conclusions, as we will show in our work. To overcome these limitations, we account for the variation of traffic load over time. We use correlation to express the relation between sender and receiver nodes. Our attack is applicable to many anonymity protocols. It assumes a passive attacker and works with partial knowledge of the network traffic. [less ▲]

Emergency Group Calls over Interoperable Networks

in Proceedings of the 11th IEEE International Conference on Computational Science and Engineering (2008)