Characterizing Internet worm spatial-temporal infection structures

Since the Morris worm was released in 1988, Internet worms continue to be one of top security threats. For example, the Conficker worm infected 9 to 15 million machines in early 2009 and shut down the service of some critical government and medical networks. Moreover, it constructed a massive peer-to-peer (P2P) botnet. Botnets are zombie networks controlled by attackers setting out coordinated attacks. In recent years, botnets have become the number one threat to the Internet. The objective of this research is to characterize spatial-temporal infection structures of Internet worms, and apply the observations to study P2P-based botnets formed by worm infection. First, we infer temporal characteristics of the Internet worm infection structure, i.e., the host infection time and the worm infection sequence, and thus pinpoint patient zero or initially infected hosts. Specifically, we apply statistical estimation techniques on Darknet observations. We show analytically and empirically that our proposed estimators can significantly improve the inference accuracy. Second, we reveal two key spatial characteristics of the Internet worm infection structure, i.e., the number of children and the generation of the underlying tree topology formed by worm infection. Specifically, we apply probabilistic modeling methods and a sequential growth model. We show analytically and empirically that the number of children has asymptotically a geometric distribution with parameter 0.5, and the generation follows closely a Poisson distribution. Finally, we evaluate bot detection strategies and effects of user defenses in P2P-based botnets formed by worm infection. Specifically, we apply the observations of the number of children and demonstrate analytically and empirically that targeted detection that focuses on the nodes with the largest number of children is an efficient way to expose bots. However, we also point out that future botnets may self-stop scanning to weaken targeted detection, without greatly slowing down the speed of worm infection. We then extend the worm spatial infection structure and show empirically that user defenses, e.g. , patching or cleaning, can significantly mitigate the robustness and the effectiveness of P2P-based botnets. To counterattack, we evaluate a simple measure by future botnets that enhances topology robustness through worm re-infection.

Pirates, exiles, and empire: English seamen, Atlantic expansion, and Jamaican settlement, 1558–1658

A life of piracy offered marginal men a profession with a degree of autonomy, despite the brand of "outlaw" and the fear of prosecution. At various times throughout history, governments and crowned heads suspended much of their piracy prosecution, licensing men to work as "privateers" for the state, supplementing naval forces. This practice has a long history, but in sixteenth-century England, Elizabeth I (1558-1603) significantly altered this tradition. Recognizing her own weakness in effectively prosecuting these men and the profit they could contribute to the government, Elizabeth began incorporating pirates into the English naval corps in peacetime—not just in war. This practice increased English naval resources, income, and presence in the emerging Atlantic World, but also increased conflict with the powerful Spanish empire. By 1605, making peace with Spain, James VI/I (1603-1625) retracted Elizabeth's privateering promotion, prompting an emigration of English seamen to the American outposts they had developed in the previous century. Now exiles, no longer beholden to the Crown, seamen reverted back to piracy. The Carolinas and Jamaica served as bases for these rover communities. In 1650, the revolutionary leader Oliver Cromwell (1649-1658) once again recognized the merits of such policies. Determined to demonstrate his authority and solidify his rule, Cromwell offered citizenship and state support to Caribbean exiles in exchange for their aiding of his navy in the taking of Spanish Jamaica. Official chartering of Port Royal, Jamaica served as reward for these men's efforts and as the culmination of a century-long cycle of piracy legislation, creating one of England's most lucrative colonies in the middle of a traditionally Spanish Caribbean empire. Through legal and diplomatic records, correspondence, and naval and demographic records from England and Spain, this dissertation explores early modern piracy/privateering policy and its impact on the development of the Atlantic World. European disputes and imperial competition converged in these piracy debates with significant consequences for the definitions of criminality and citizenship and for the development of Atlantic empire.

Enhanced skip -list search algorithm in 3-layer mediator framework

The Three-Layer distributed mediation architecture, designed by Secure System Architecture laboratory, employed a layered framework of presence, integration, and homogenization mediators. The architecture does not have any central component that may affect the system reliability. A distributed search technique was adapted in the system to increase its reliability. An Enhanced Chord-like algorithm (E-Chord) was designed and deployed in the integration layer. The E-Chord is a skip-list algorithm based on Distributed Hash Table (DHT) which is a distributed but structured architecture. DHT is distributed in the sense that no central unit is required to maintain indexes, and it is structured in the sense that indexes are distributed over the nodes in a systematic manner. Each node maintains three kind of routing information: a frequency list, a successor/predecessor list, and a finger table. None of the nodes in the system maintains all indexes, and each node knows about some other nodes in the system. These nodes, also called composer mediators, were connected in a P2P fashion. ^ A special composer mediator called a global mediator initiates the keyword-based matching decomposition of the request using the E-Chord. It generates an Integrated Data Structure Graph (IDSG) on the fly, creates association and dependency relations between nodes in the IDSG, and then generates a Global IDSG (GIDSG). The GIDSG graph is a plan which guides the global mediator how to integrate data. It is also used to stream data from the mediators in the homogenization layer which connected to the data sources. The connectors start sending the data to the global mediator just after the global mediator creates the GIDSG and just before the global mediator sends the answer to the presence mediator. Using the E-Chord and GIDSG made the mediation system more scalable than using a central global schema repository since all the composers in the integration layer are capable of handling and routing requests. Also, when a composer fails, it would only minimally affect the entire mediation system. ^

Pirates, Exiles, and Empire: English Seamen, Atlantic Expansion, and Jamaican Settlement, 1558-1658

A life of piracy offered marginal men a profession with a degree of autonomy, despite the brand of “outlaw” and the fear of prosecution. At various times throughout history, governments and crowned heads suspended much of their piracy prosecution, licensing men to work as “privateers” for the state, supplementing naval forces. This practice has a long history, but in sixteenth-century England, Elizabeth I (1558-1603) significantly altered this tradition. Recognizing her own weakness in effectively prosecuting these men and the profit they could contribute to the government, Elizabeth began incorporating pirates into the English naval corps in peacetime—not just in war. This practice increased English naval resources, income, and presence in the emerging Atlantic World, but also increased conflict with the powerful Spanish empire. By 1605, making peace with Spain, James VI/I (1603-1625) retracted Elizabeth’s privateering promotion, prompting an emigration of English seamen to the American outposts they had developed in the previous century. Now exiles, no longer beholden to the Crown, seamen reverted back to piracy. The Carolinas and Jamaica served as bases for these rover communities. In 1650, the revolutionary leader Oliver Cromwell (1649-1658) once again recognized the merits of such policies. Determined to demonstrate his authority and solidify his rule, Cromwell offered citizenship and state support to Caribbean exiles in exchange for their aiding of his navy in the taking of Spanish Jamaica. Official chartering of Port Royal, Jamaica served as reward for these men’s efforts and as the culmination of a century-long cycle of piracy legislation, creating one of England’s most lucrative colonies in the middle of a traditionally Spanish Caribbean empire. Through legal and diplomatic records, correspondence, and naval and demographic records from England and Spain, this dissertation explores early modern piracy/privateering policy and its impact on the development of the Atlantic World. European disputes and imperial competition converged in these piracy debates with significant consequences for the definitions of criminality and citizenship and for the development of Atlantic empire.