The Transmission Control Protocol.

IEEE transactions on computer-aided design of integrated circuits and systems : a publication of the IEEE Circuits and Systems Society

The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way mapping between domain names and their numerical identifiers. Given its fundamental role, it is not surprising that a wide variety of malicious activities involve the domain name service in one way or another. For example, bots resolve DNS names to locate their command and control servers, and spam mails contain URLs that link to domains that resolve to scam servers. Thus, it seems beneficial to monitor the use of the DNS system for signs that indicate that a certain name is used as part of a malicious operation. In this paper, we introduce EXPOSURE, a system that employs large-scale, passive DNS analysis techniques to detect domains that are involved in malicious activity. We use 15 features that we extract from the DNS traffic that allow us to characterize different properties of DNS names and the ways that they are queried. Our experiments with a large, real-world data set consisting of 100 billion DNS requests, and a real-life deployment for two weeks in an ISP show that our approach is scalable and that we are able to automatically identify unknown malicious domains that are misused in a variety of malicious activity (such as for botnet command and control, spamming, and phishing).

/pdf/exposure-finding-malicious-domains-using-passive-dns-1t5cgsu9q0.pdf

EXPOSURE : Finding malicious domains using passive DNS analysis

Computer communications

This paper describes a new approach to online forecasting of power production from PV systems. The method is suited to online forecasting in many applications and in this paper it is used to predict hourly values of solar power for horizons of up to 36 h. The data used is 15-min observations of solar power from 21 PV systems located on rooftops in a small village in Denmark. The suggested method is a two-stage method where first a statistical normalization of the solar power is obtained using a clear sky model. The clear sky model is found using statistical smoothing techniques. Then forecasts of the normalized solar power are calculated using adaptive linear time series models. Both autoregressive (AR) and AR with exogenous input (ARX) models are evaluated, where the latter takes numerical weather predictions (NWPs) as input. The results indicate that for forecasts up to 2 h ahead the most important input is the available observations of solar power, while for longer horizons NWPs are the most important input. A root mean square error improvement of around 35% is achieved by the ARX model compared to a proposed reference model.

/pdf/online-short-term-solar-power-forecasting-1ljgpbshkb.pdf

Online Short-term Solar Power Forecasting

Recent malicious attempts are intended to get financial benefits through a large pool of compromised hosts, which are called software robots or simply "bots." A group of bots, referred to as a botnet, is remotely controllable by a server and can be used for sending spam mails, stealing personal information, and launching DDoS attacks. Growing popularity of botnets compels to find proper countermeasures but existing defense mechanisms hardly catch up with the speed of botnet technologies. In this paper, we propose a botnet detection mechanism by monitoring DNS traffic to detect botnets, which form a group activity in DNS queries simultaneously sent by distributed bots. A few works have been proposed based on particular DNS information generated by a botnet, but they are easily evaded by changing bot programs. Our anomaly-based botnet detection mechanism is more robust than the previous approaches so that the variants of bots can be detectable by looking at their group activities in DNS traffic. From the experiments on a campus network, it is shown that the proposed mechanism can detect botnets effectively while bots are connecting to their server or migrating to another server.

Botnet Detection by Monitoring Group Activities in DNS Traffic

Recent malicious attempts are intended to obtain financial benefits using a botnet which has become one of the major Internet security problems. Botnets can cause severe Internet threats such as DDoS attacks, identity theft, spamming, click fraud. In this paper, we define a group activity as an inherent property of the botnet. Based on the group activity model and metric, we develop a botnet detection mechanism, called BotGAD (Botnet Group Activity Detector). BotGAD enables to detect unknown botnets from large scale networks in real-time. Botnets frequently use DNS to rally infected hosts, launch attacks and update their codes. We implemented BotGAD using DNS traffic and showed the effectiveness by experiments on real-life network traces. BotGAD captured 20 unknown and 10 known botnets from two day campus network traces.

/pdf/botgad-detecting-botnets-by-capturing-group-activities-in-h5qibnbsmr.pdf

BotGAD: detecting botnets by capturing group activities in network traffic

It was recently shown that 802.11b MAC has an "anomaly" that the throughput of high bit-rate terminals in good channel condition is down-equalized to that of the lowest bit-rate peer in the network. In this letter, we analytically prove that the phenomenon can be cleanly resolved through configuring the initial contention window size inversely proportional to the bit-rate. Although contention window size variation has been used to induce throughput differentiation among equal bit-rate terminals, our work is the first to apply the technique to different bit-rate terminals.

/pdf/resolving-802-11-performance-anomalies-through-qos-56coxb8qjh.pdf

Resolving 802.11 performance anomalies through QoS differentiation

http://widen.korea.ac.kr/publication/CoSe09.pdf

Fast detection and visualization of network attacks on parallel coordinates

The IEEE 802.15.4 MAC (Medium Access Control) is a protocol used in many applications including the wireless sensor network. Yet the IEEE 802.15.4 MAC layer cannot support different throughput performance for individual nodes with the current specifications. However, if certain nodes are sending data more frequently compared to others, with the standard MAC, it is hard to achieve network efficiency. Therefore, we modified the IEEE 802.15.4 MAC and additionally proposed a new State Transition Scheme. By adjusting the minBE value of some nodes to a smaller value and by dynamically changing the value depending on the transmission conditions, we shortened the backoff delay of nodes with frequent transmission. It was observed through our simulations that the throughput of the node with a lower minBE value increased significantly, compared to nodes with the original BE range of 3 to 5. Also by the use of the State Transition Scheme the total network efficiency increased leading to increase in throughput performance.

/pdf/performance-evaluation-of-ieee-802-15-4-mac-with-different-s8dnmn0mb4.pdf

Hyogon Kim

Papers

Botnet Detection by Monitoring Group Activities in DNS Traffic

BotGAD: detecting botnets by capturing group activities in network traffic

Resolving 802.11 performance anomalies through QoS differentiation

Fast detection and visualization of network attacks on parallel coordinates

Performance Evaluation of IEEE 802.15.4 MAC with Different Backoff Ranges in Wireless Sensor Networks