1177051
Visualization assisted detection of sybil attacks in wireless networks
In wireless networks,the authenticity and uniqueness of node identities are essential to the fundamental operations such as routing, resource allocation, and intrusion detection. In this paper, we investigate Sybil attack, an attack in which a malicious node illegitimately acquires multiple identities and performs as these nodes simultaneously. We propose an effective approach to monitoring and detecting such attacks by integrating network security and visualization methods. The security component explores the time-varying network topology and its statistical and geometry information to detect the existence of Sybil attacks. The visualization component incorporates the detection results and provides an effective mechanism to illustrate abnormal topology patterns and locate fake identities. These two components are integrated into a practical system that takes advantage of both interactive visualization and intelligent security methods. Experimental studies are conducted to investigate the impacts of the network parameters such as node connectivity on the detection capability of the proposed mechanism.
47778
Key distribution and update for secure inter-group multicast communication
Group communication has become an important component in wireless networks. In this paper, we focus on the environments in which multiple groups coexist in the system, and both intra and inter group multicast traffic must be protected by secret keys. We propose a mechanism that integrates polynomials with flat tables to achieve personal key share distribution and efficient key refreshment during group changes. The proposed mechanism distributes keys via true broadcast. The contributions of the research include: (1) By switching from asymmetric algorithms to symmetric encryption methods, the proposed mechanism avoids heavy computation, and improves the processing efficiency of multicast traffic and the power usage at the wireless nodes. The group managers do not have to generate public-private key pairs when the group member changes. (2) It becomes more difficult for an attacker to impersonate another node since personal key shares are adopted. The additional storage overhead at the wireless nodes and the increased broadcast traffic during key refreshment are justified. In addition, we describe techniques to improve the robustness of the proposed mechanism under the complicated scenarios such as collusive attacks and batch group member changes.
884789
A Fast Algorithm for Approximate Quantiles in High Speed Data Streams
We present a fast algorithm for computing approximate quantiles in high speed data streams with deterministic error bounds. For data streams of size N where N is unknown in advance, our algorithm partitions the stream into sub-streams of exponentially increasing size as they arrive. For each sub-stream which has a fixed size, we compute and maintain a multi-level summary structure using a novel algorithm. In order to achieve high speed performance, the algorithm uses simple block-wise merge and sample operations. Overall, our algorithms for fixed-size streams and arbitrary-size streams have a computational cost of O(N log(1/epsivlogepsivN)) and an average per-element update cost of O(log logN) if epsiv is fixed.
14471402
Computing quadric surface intersections based on an analysis of plane cubic curves
Computing the intersection curve of two quadrics is a fundamental problem in computer graphics and solid modeling. We present an algebraic method for classifying and parameterizing the intersection curve of two quadric surfaces. The method is based on the observation that the intersection curve of two quadrics is birationally related to a plane cubic curve. In the method this plane cubic curve is computed first and the intersection curve of the two quadrics is then found by transforming the cubic curve by a rational quadratic mapping. Topological classification and parameterization of the intersection curve are achieved by invoking results from algebraic geometry on plane cubic curves. 2003 Elsevier Science (USA). All rights reserved.
9657581
k-anycast game in selfish networks
Conventionally, the majority of network routing protocols assume that every network terminal or link forwards data for others without any deviation. However, this may not be true when the terminals or links are owned by individual selfish users, who always tries to maximize their own benefits instead of faithfully following a prescribed protocol. In this paper, we propose a new routing protocol, called k-anycast routing, that works well even if network links (or terminals or both) are selfish. In our protocol, the source node first finds a tree that spans k receivers out of a set of possible receivers and pay the relay links to compensate their costs. We prove that every relay link follows the routing protocol: it maximizes its profit when it declares its actual cost
17218997
Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data
Intrusion detection is an important technique in the defense-in-depth network security framework. In recent years, it has been a widely studied topic in computer network security. In this paper, we present two methods, namely, the Hidden Markov Models (HMM) method and the Self Organizing Maps (SOM) method, to profile normal program behavior for anomaly intrusion detection based on computer audit data. The HMM method utilizes the transition property of events while SOM method relies on the frequency property of events. Two data sets, CERT synthetic Sendmail system call data collected in the University of New Mexico (UNM) and Live FTP system call data collected in the CNSIS lab of Xi'an Jiaotong University, were used to assess the two methods. Testing results show that the HMM method using the transition property of events produces good detection performance while high computational expense is required both for training and detection. The HMM method is better than other two methods reported previously in terms of detection accuracy for the same data set. The SOM method considering the frequency property of events, on the other hand, is suitable for real-time intrusion detection because of its capability of processing a large amount of data with low computational overhead.
8102164
XR-tree: indexing XML data for efficient structural joins
XML documents are typically queried with a combination of value search and structure search. While querying by values can leverage traditional database technologies, evaluating structural relationship, specifically parent-child or ancestor-descendant relationship, between XML element sets has imposed a great challenge on efficient XML query processing. We propose XR-tree, namely, XML region tree, which is a dynamic external memory index structure specially designed for strictly nested XML data. The unique feature of XR-tree is that, for a given element, all its ancestors (or descendants) in an element set indexed by an XR-tree can be identified with optimal worst case I/O cost. We then propose a new structural join algorithm that can evaluate the structural relationship between two XR-tree indexed element sets by effectively skipping ancestors and descendants that do not participate in the join. Our extensive performance study shows that the XR-tree based join algorithm significantly outperforms previous algorithms.