In some embodiments, heuristic botnet detection is provided. In some embodiments, heuristic botnet detection includes monitoring network traffic to identify suspicious network traffic; and detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor, in which the suspicious network traffic behavior includes command and control traffic associated with a bot master. In some embodiments, heuristic botnet detection further includes assigning a score to the monitored network traffic, in which the score corresponds to a botnet risk characterization of the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); and determining the suspicious behavior is associated with a botnet based on the score.

Heuristic botnet detection

A system, apparatus, and method for reducing fraud in payment transactions by identifying a potential point of compromise (POC) that may lead to subsequent fraudulent transactions, or confirming that a suspected point of compromise is in fact responsible for a security breach leading to fraudulent payment transactions. The invention is also directed to a system, apparatus, and method for identifying data or transaction characteristics that may be used to most effectively identify a point of compromise in a payment transaction system.

System and method for identifying a point of compromise in a payment transaction processing system

Optical properties of periodic, quasi-periodic, and disordered one-dimensional photonic structures

A method for fraud detection leverages an existing financial institution's fraud classification functionality, which produces a first level detection, with a “user-centric” classification functionality, which produces a “second” or more fine-grained detection regarding a potentially fraudulent transaction. After passing through an existing (“institution-centric”) fraud detection technique, a transaction that has been identified as potentially fraudulent is then subject to further analysis and classification at the “user” level, as it is the user is presumed to be the best source of knowledge of the legitimate credit card use. Information about the transaction is shared with the consumer, preferably via one or more near real-time mechanisms, such as SMS, email, or the like. Based on the user's response (or lack thereof, as the case may be), one or more business rules in the institution's fraud detection system can then take an appropriate action (e.g., no action, reverse the transaction if complete, deny the transaction if in-progress, or the like).

Method and System for Identification By A Cardholder of Credit Card Fraud

Tracking mobile targets in wireless sensor networks (WSNs) has many important applications. As it is often the case in prior work that the quality of tracking (QoT) heavily depends on high accuracy in localization or distance estimation, which is never perfect in practice. These bring a cumulative effect on tracking, e.g., target missing. Recovering from the effect and also frequent interactions between nodes and a central server result in a high energy consumption. We design a tracking scheme, named t-Tracking , aiming to achieve two major objectives: high QoT and high energy efficiency of the WSN. We propose a set of fully distributed tracking algorithms, which answer queries like whether a target remains in a “specific area” (called a “face” in localized geographic routing, defined in terms of radio connectivity and local interactions of nodes). When a target moves across a face, the nodes of the face that are close to its estimated movements compute the sequence of the target’s movements and predict when the target moves to another face. The nodes answer queries from a mobile sink called the “tracker”, which follows the target along with the sequence. t-Tracking has advantages over prior work as it reduces the dependency on requiring high accuracy in localization and the frequency of interactions. It also timely solves the target missing problem caused by node failures, obstacles, etc., making the tracking robust in a highly dynamic environment. We validate its effectiveness considering the objectives in extensive simulations and in a proof-of-concept system implementation.

Local Area Prediction-Based Mobile Target Tracking in Wireless Sensor Networks

A computerized method for detecting fraud includes obtaining frequency information on entities in transaction data for at least one individual account, converting frequency information to a frequency variable, and predicting whether an activity is fraudulent in response to the frequency variable. In some embodiments, the frequency variable is used with at least one other variable to predict fraudulent activity.

Fraud detection based on efficient frequent-behavior sorted lists

A system and method of detecting command and control behavior of malware on a client computer is disclosed. One or more DNS messages are monitored from one or more client computers to a DNS server to determine a risk that one or more client computers is communicating with a botnet. Real-time entity profiles are generated for at least one of each of the one or more client computers, DNS domain query names, resolved IP addresses of query domain names, client computer-query domain name pairs, pairs of query domain name and corresponding resolved IP address, or query domain name-IP address cliques based on each of the one or more DNS messages. Using the real-time entity profiles, a risk that any of the one or more client computers is infected by malware that utilizes DNS messages for command and control or illegitimate data transmission purposes is determined. One or more scores are generated representing probabilities that one or more client computers is infected by malware.

Cyber security adaptive analytics threat monitoring system and method

The current subject matter describes scoring of transactions associated with a profiling entity so as to determine risk associated with the transactions. Data characterizing at least one new transaction can be received. A latent dirichlet allocation (LDA) model trained on historical data can be obtained. Based on new words in the received data, the LDA model can update a topic probability mixture vector. Based on the updated topic probability mixture vector, numerical values of one or more predictive features can be calculated. Based on the numerical values of the one or more predicted features, the at least one transaction in the received data can be scored. Related apparatus, systems, techniques and articles are also described.

Transaction Risk Detection

In this paper we review a particular connection between information theory and group theory. We formalize the notions of information elements and information lattices, first proposed by Shannon. Exploiting this formalization, we expose a comprehensive parallelism between information lattices and subgroup lattices. Qualitatively, isomorphisms between information lattices and subgroup lattices are demonstrated. Quantitatively, a decisive approximation relation between the entropy structures of information lattices and the log-index structures of the corresponding subgroup lattices, first discovered by Chan and Yeung, is highlighted. This approximation, addressing both joint and common entropies, extends the work of Chan and Yeung on joint entropy. A consequence of this approximation result is that any continuous law holds in general for the entropies of information elements if and only if the same law holds in general for the log-indices of subgroups. As an application, by constructing subgroup counterexamples, we find surprisingly that common information, unlike joint information, obeys neither the submodularity nor the supermodularity law. We emphasize that the notion of information elements is conceptually significant—formalizing it helps to reveal the deep connection between information theory and group theory. The parallelism established in this paper admits an appealing group-action explanation and provides useful insights into the intrinsic structure among information elements from a group-theoretic perspective.

https://www.mdpi.com/1099-4300/13/3/683/pdf

On a Connection between Information and Group Lattices

Scheduling resources on Grids is a well-known problem. The extension of Grids to LambdaGrids requires the scheduling of lambdas, i.e., end-to-end high-speed circuits. In this paper, we propose a scheduling heuristic for such lambdas in support of large-scale scientific applications that require high-throughput transfers of large files. We refer to this heuristic as ‘Varying-Bandwidth List Scheduling’ (VBLS) because the scheduler returns a TimeRange-Capacity (TRC) allocation vector with varying bandwidth levels assigned for different time ranges within the duration of a transfer. The advantage of VBLS over a fixed-bandwidth allocation scheme is that it allows the scheduler to backfill any holes left in resource allocations. Enabling VBLS requires end host applications to specify the file size in their transfer requests. To characterize VBLS, we ran simulation experiments that show that VBLS performance approaches packet-switching performance. This result means that file transfers can take advantage of bandwidth that becomes available subsequent to the start of transfers, a current and critical drawback of typical fixed-bandwidth allocation schemes in circuit-switched networks. Next, we identify the key features needed in a transport protocol that works in conjunction with VBLS and develop the ‘Varying Bandwidth Transport Protocol’ (VBTP). VBTP is a rate based flow control scheme that is coupled with Selective-ARQ based error control. Finally, the paper concludes with a discussion on the impact of transport problems on VBLS scheduling.

/pdf/scheduling-and-transport-for-file-transfers-on-high-speed-2l3fkk2yr6.pdf

Hua Li

Papers

Fraud detection based on efficient frequent-behavior sorted lists

Cyber security adaptive analytics threat monitoring system and method

Transaction Risk Detection

On a Connection between Information and Group Lattices

Scheduling and Transport for File Transfers on High-Speed Optical Circuits