Network theory

About: Network theory is a research topic. Over the lifetime, 2257 publications have been published within this topic receiving 109864 citations.

Detecting Stealthy Malware Using Behavioral Features in Network Traffic

Abstract: It is clearly in the interest of network administrators to detect hosts within their networks that are infiltrated by stealthy malware. Infected hosts (also called bots) can exfiltrate sensitive data to adversaries, or lie in wait for commands from a bot-master to forward spam, launch denial-of-service attacks, or host phishing sites, for example. Unfortunately, it is difficult to detect such hosts, since their activities are subtle and do not disrupt the network. In this thesis, we hypothesize that malware-infected hosts share characteristics in their network behaviors, which are distinct from those of benign hosts. Our approach works by aggregating “similar” network traffic involving multiple hosts. We identify key characteristics that capture basic properties of botnet operation, and that can be observed even within coarse network traffic summaries, i.e., flow records. Using network traffic collected at the edge routers of the Carnegie Mellon University campus network, and network traffic generated from real bot instances in virtual machines and honeynets running in the wild, we demonstrate that this approach can reliably detect infected hosts with very few false positives. In addition to identifying relevant behavioral features within hosts’ network activities, another contribution of this thesis is in developing efficient algorithms for analyzing network traffic. Our algorithms utilize methods from diverse areas, including statistics, data mining, machine learning, and metric embeddings. We also introduce a technique to passively infer the application implementation on a host given only anonymized traffic summaries. This technique enables us to detect malware that is browser-dependent, and can also be applied to improve the accuracy of traffic deanonymization, i.e., identifying the web sites in anonymized flow records. To complement empirical analyses, we apply analytical models from network theory to study peer-topeer botnets. We focus on a structural property of networks, which characterizes the tendency for edges to exist between “similar” nodes, and examine its effect on network resiliency and the network’s ability to recover after a fraction of the nodes are removed. We show that previous works may have over-estimated the power of certain botnet takedown strategies, and identify an alternative strategy that is more effective than those explored previously.

The global network of biofuel sustainability standards-setters

Abstract: The role of network structure in shaping the regulatory scope and content of sustainability standards for biofuels is examined. A critical review of the literature on hybrid governance networks suggests the need to bring in network theory. Through a specific network analysis of the standards-setters, it is shown that not only does the institutional hybridity of the standards boards influence the regulatory scope of the standards, but the network centrality and specific topology in which standards-setters are embedded are equally important structural features of hybrid governance. These findings foreground the relevance of incorporating in the current attributional conception of hybridity a network element, taking seriously the role of network structure in shaping regulatory fields. Social Network Analysis as an analytical tool holds great potential for further research into the structural features of hybrid governance.

Emergent Leadership Structures in Informal Groups: A Dynamic, Cognitively Informed Network Model

Abstract: This paper advances novel theory and evidence on the emergence of informal leadership networks in groups that feature no formally designated leaders or authority hierarchies. We integrate insights from relational schema and network theory to develop and empirically test a three-step process model. The model’s first hypothesis is that people use a “linear ordering schema” to process information about leadership relations. The second hypothesis argues that when an individual experiences a particular leadership attribution to be inconsistent with the linear ordering schema, that individual will tend to reduce the ensuing cognitive inconsistency by modifying that leadership attribution. Finally, the third hypothesis builds on this inconsistency-reduction mechanism to derive implications about a set of network structural features (asymmetry, acyclicity, transitivity, popularity, and inverse popularity) that are predicted to emerge endogenously as a group’s informal leadership network evolves. We find broad sup...

Equational Reasoning on Mobile Ad Hoc Networks

Abstract: We provide an equational theory for Restricted Broadcast Process Theory to reason about ad hoc networks. We exploit an extended algebra called Computed Network Theory to axiomatize restricted broadcast. It allows one to define the behavior of an ad hoc network with respect to the underlying topologies. We give a sound and ground-complete axiomatization for CNT terms with finite-state behavior, modulo what we call rooted branching computed network bisimilarity.