Many network solutions and overlay networks utilize probabilistic techniques to reduce information processing and networking costs. This survey article presents a number of frequently used and useful probabilistic techniques. Bloom filters and their variants are of prime importance, and they are heavily used in various distributed systems. This has been reflected in recent research and many new algorithms have been proposed for distributed systems that are either directly or indirectly based on Bloom filters. In this survey, we give an overview of the basic and advanced techniques, reviewing over 20 variants and discussing their application in distributed systems, in particular for caching, peer-to-peer systems, routing and forwarding, and measurement data summarization.

/pdf/theory-and-practice-of-bloom-filters-for-distributed-systems-5a641nvijc.pdf

Theory and Practice of Bloom Filters for Distributed Systems

We present a new attack framework for conducting cache-based side-channel attacks and demonstrate this framework in attacks between tenants on commercial Platform-as-a-Service (PaaS) clouds. Our framework uses the FLUSH-RELOAD attack of Gullasch et al. as a primitive, and extends this work by leveraging it within an automaton-driven strategy for tracing a victim's execution. We leverage our framework first to confirm co-location of tenants and then to extract secrets across tenant boundaries. We specifically demonstrate attacks to collect potentially sensitive application data (e.g., the number of items in a shopping cart), to hijack user accounts, and to break SAML single sign-on. To the best of our knowledge, our attacks are the first granular, cross-tenant, side-channel attacks successfully demonstrated on state-of-the-art commercial clouds, PaaS or otherwise.

/pdf/cross-tenant-side-channel-attacks-in-paas-clouds-4sdfksyx0e.pdf

Cross-Tenant Side-Channel Attacks in PaaS Clouds

The scalability of large-scale networked virtual environments (NVEs) such as today's massively multiplayer online games (MMOGs) faces inherent limits imposed by client-server architectures We identify an emerging research direction that applies peer-to-peer (P2P) networks in order to realize more scalable and affordable NVEs The central issue for P2P-based NVE (P2P-NVE) systems is to correctly and efficiently maintain the topology of all participating peers by solving the neighbor discovery problem We also propose the Voronoi-based overlay network (VON), a simple and efficient design that maintains the P2P topology in a fully-distributed, low-latency, and message-efficient manner Simulation results show that by bounding the per-node resource consumption, VON can be fundamentally more scalable than existing methods while achieving high topology consistency and reliability

/pdf/von-a-scalable-peer-to-peer-network-for-virtual-environments-34llq742sv.pdf

VON: a scalable peer-to-peer network for virtual environments

Website phishing is considered one of the crucial security challenges for the online community due to the massive numbers of online transactions performed on a daily basis. Website phishing can be described as mimicking a trusted website to obtain sensitive information from online users such as usernames and passwords. Black lists, white lists and the utilisation of search methods are examples of solutions to minimise the risk of this problem. One intelligent approach based on data mining called Associative Classification (AC) seems a potential solution that may effectively detect phishing websites with high accuracy. According to experimental studies, AC often extracts classifiers containing simple “If-Then” rules with a high degree of predictive accuracy. In this paper, we investigate the problem of website phishing using a developed AC method called Multi-label Classifier based Associative Classification (MCAC) to seek its applicability to the phishing problem. We also want to identify features that distinguish phishing websites from legitimate ones. In addition, we survey intelligent approaches used to handle the phishing problem. Experimental results using real data collected from different sources show that AC particularly MCAC detects phishing websites with higher accuracy than other intelligent algorithms. Further, MCAC generates new hidden knowledge (rules) that other algorithms are unable to find and this has improved its classifiers predictive performance.

Phishing detection based Associative Classification data mining

Internet has become an essential component of our everyday social and financial activities. Nevertheless, internet users may be vulnerable to different types of web threats, which may cause financial damages, identity theft, loss of private information, brand reputation damage and loss of customer's confidence in e-commerce and online banking. Phishing is considered as a form of web threats that is defined as the art of impersonating a website of an honest enterprise aiming to obtain confidential information such as usernames, passwords and social security number. So far, there is no single solution that can capture every phishing attack. In this article, we proposed an intelligent model for predicting phishing attacks based on artificial neural network particularly self-structuring neural networks. Phishing is a continuous problem where features significant in determining the type of web pages are constantly changing. Thus, we need to constantly improve the network structure in order to cope with these changes. Our model solves this problem by automating the process of structuring the network and shows high acceptance for noisy data, fault tolerance and high prediction accuracy. Several experiments were conducted in our research, and the number of epochs differs in each experiment. From the results, we find that all produced structures have high generalization ability.

/pdf/predicting-phishing-websites-based-on-self-structuring-38h2trhdl7.pdf

Predicting phishing websites based on self-structuring neural network

Today's Multi-player Online Games (MOGs) are challenged by infrastructure requirements, because of their server-centric nature Peer-to-peer networks are an interesting alternative, if they can implement the set of functions that are traditionally performed by centralized authoritative servers In this paper, we propose a zoned federation model to adapt MOG to peer-to-peer networks In this model, zoning layer is inserted between the game program and peer-to-peer networks We introduce the concept of zone and zone owner to MOG Zone is some part of the whole game world, and zone owner is an authoritative server of a specific zone According to the demands of the game program, each node actively changes its role to zone owner and works in the same way as a centralized authoritative server By dividing the whole game world into several zones, workloads of the centralized authoritative game server can be distributed to a federation of nodes We have implemented the zoned federation model, and evaluate it with a prototypical multi-player game Evaluation results indicate that our proposed approach is applicable to small and medium-sized MOGs, where the number of nodes is less than 500

/pdf/zoned-federation-of-game-servers-a-peer-to-peer-approach-to-2un5b6x6qh.pdf

Zoned federation of game servers: a peer-to-peer approach to scalable multi-player online games

In this paper, we present the performance of machine learning-based methods for detection of phishing sites. We employ 9 machine learning techniques including AdaBoost, Bagging, Support Vector Machines, Classification and Regression Trees, Logistic Regression, Random Forests, Neural Networks, Naive Bayes, and Bayesian Additive Regression Trees. We let these machine learning techniques combine heuristics, and also let machine learning-based detection methods distinguish phishing sites from others. We analyze our dataset, which is composed of 1,500 phishing sites and 1,500 legitimate sites, classify them using the machine learning-based detection methods, and measure the performance. In our evaluation, we used f1 measure, error rate, and Area Under the ROC Curve (AUC) as performance metrics along with our requirements for detection methods. The highest f1 measure is 0.8581, the lowest error rate is 14.15%, and the highest AUC is 0.9342, all of which are observed in the case of AdaBoost. We also observe that 7 out of 9 machine learning-based detection methods outperform the traditional detection method.

An evaluation of machine learning-based methods for detection of phishing sites

Cloud computing provides a multitenant feature that enables an IT asset to host multiple tenants, improving its utilization rate. The feature provides economic benefits to both users and service providers since it reduces the management cost and thus lowers the subscription price. Many users are, however, reluctant to subscribe to cloud computing services due to security concerns. To advance deployment of cloud computing, techniques enabling secure multitenancy, especially resource isolation techniques, need to be advanced further. Difficulty lies in the fact that the techniques range and cross various technical domains, and it is difficult to get the big picture. To cope with that, this paper introduces technical layers and categories, with which it identifies and structures technical issues on enabling multitenancy by conducting a survey. Based on the survey result, this paper discusses technical maturity of multitenant cloud computing from the standpoint of security and the needs for developing both technical and operational security toward the development and wide deployment of multitenant cloud computing.

/pdf/enabling-secure-multitenancy-in-cloud-computing-challenges-17py0e0dy3.pdf

Enabling secure multitenancy in cloud computing: Challenges and approaches

Hash-based IP traceback is a technique to generate audit trails for traffic within a network. Using the audit trails, it reconstructs not only the true attack paths of a Distributed Denial of Service attack (DDoS attack), but also the true path of a single packet attack. However, hash-based IP traceback cannot identify attacker nodes themselves because it has no audit trail on the subnet’s layer-2 network under the detected leaf router, which is the nearest node to an attacker node on a layer-3 network. We propose a layer-2 extension to hash-based IP traceback, which stores two identifiers with packets’ audit trails while reducing the memory requirement for storing identifiers. One of these identifiers shows the leaf router’s interface through which an attacking packet came, and the other represents the ingress port on a layer-2 switch through which the attacking packet came. We implement a prototype on FreeBSD and evaluate it in a preliminary experiment. key words: Distributed Denial of Service attack (DDoS), hash-based IP traceback, layer-2 traceback

A Layer-2 Extension to Hash-Based IP Traceback

The Bloom Filter (BF), a space-and-time-efficient hash-coding method, is used as one of the fundamental modules in several network processing algorithms and applications such as route lookups, cache hits, packet classification, per-flow state management or network monitoring. BF is a simple space-efficient randomized data structure used to represent a data set in order to support membership queries. However, BF generates false positives, and cannot count the number of distinct elements. A counting Bloom Filter (CBF) can count the number of distinct elements, but CBF needs more space than BF. We propose an alternative data structure of CBF, and we called this structure an Adaptive Bloom Filter (ABF). Although ABF uses the same-sized bit-vector used in BF, the number of hash functions employed by ABF is dynamically changed to record the number of appearances of a each key element. Considering the hash collisions, the multiplicity of a each key element on ABF can be estimated from the number of hash functions used to decode the membership of the each key element. Although ABF can realize the same functionality as CBF, ABF requires the same memory size as BF. We describe the construction of ABF and IABF (Improved ABF), and provide a mathematical analysis and simulation using Zipf's distribution. Finally, we show that ABF can be used for an unpredictable data set such as real network traffic.

/pdf/adaptive-bloom-filter-a-space-efficient-counting-algorithm-3175mxd8hj.pdf

Hiroaki Hazeyama

Papers

Zoned federation of game servers: a peer-to-peer approach to scalable multi-player online games

An evaluation of machine learning-based methods for detection of phishing sites

Enabling secure multitenancy in cloud computing: Challenges and approaches

A Layer-2 Extension to Hash-Based IP Traceback

Adaptive Bloom Filter: A Space-Efficient Counting Algorithm for Unpredictable Network Traffic