The microcosmic model of worm propagation

Each year, large amounts of money and labor are spent on patching the vulnerabilities in operating systems and various popular software to prevent exploitation by worms. Modeling the propagation process can help us to devise effective strategies against those worms' spreading. This paper presents a microcosmic analysis of worm propagation procedures. Our proposed model is different from traditional methods and examines deep inside the propagation procedure among nodes in the network by concentrating on the propagation probability and time delay described by a complex matrix. Moreover, since the analysis gives a microcosmic insight into a worm's propagation, the proposed model can avoid errors that are usually concealed in the traditional macroscopic analytical models. The objectives of this paper are to address three practical aspects of preventing worm propagation: (i) where do we patch? (ii) how many nodes do we need to patch? (iii) when do we patch? We implement a series of experiments to evaluate the effects of each major component in our microcosmic model. Based on the results drawn from the experiments, for high-risk vulnerabilities, it is critical that networks reduce the number of vulnerable nodes to below 80%. We believe our microcosmic model can benefit the security industry by allowing them to save significant money in the deployment of their security patching schemes.

A security framework for networked RFID

In the last decade RFID technology has become a major contender for managing large scale logistics operations and generating and distributing the massive amount of data involved in such operations. One of the main obstacles to the widespread deployment and adoption of RFID systems is the security issues inherent in them. This is compounded by a noticeable lack of literature on how to identify the vulnerabilities of a RFID system and then effectively identify and develop counter measures to combat the threats posed by those vulnerabilities. In this chapter, the authors develop a conceptual framework for analysing the threats, attacks, and security requirements pertaining to networked RFID systems. The vulnerabilities of, and the threats to, the system are identified using the threat model. The security framework itself consists of two main concepts: (1) the attack model, which identifies and classifies the possible attacks, and (2) the system model, which identifies the security requirements. The framework gives readers a method with which to analyse the threats any given system faces. Those threats can then be used to identify the attacks possible on that system and get a better understanding of those attacks. It also allows the reader to easily identify all the security requirements of that system and identify how those requirements can be met.

The probability model of peer-to-peer botnet propagation

Active Peer-to-Peer worms are great threat to the network security since they can propagate in automated ways and flood the Internet within a very short duration. Modeling a propagation process can help us to devise effective strategies against a worm's spread. This paper presents a study on modeling a worm's propagation probability in a P2P overlay network and proposes an optimized patch strategy for defenders. Firstly, we present a probability matrix model to construct the propagation of P2P worms. Our model involves three indispensible aspects for propagation: infected state, vulnerability distribution and patch strategy. Based on a fully connected graph, our comprehensive model is highly suited for real world cases like Code Red II. Finally, by inspecting the propagation procedure, we propose four basic tactics for defense of P2P botnets. The rationale is exposed by our simulated experiments and the results show these tactics are of effective and have considerable worth in being applied in real-world networks.

Polymorphic malware detection using Hierarchical Hidden Markov Model

Binary signatures have been widely used to detect malicious software on the current Internet. However, this approach is unable to achieve the accurate identification of polymorphic malware variants, which can be easily generated by the malware authors using code generation engines. Code generation engines randomly produce varying code sequences but perform the same desired malicious functions. Previous research used flow graph and signature tree to identify polymorphic malware families. The key difficulty of previous research is the generation of precisely defined state machine models from polymorphic variants. This paper proposes a novel approach, using Hierarchical Hidden Markov Model (HHMM), to provide accurate inductive inference of the malware family. This model can capture the features of self-similar and hierarchical structure of polymorphic malware family signature sequences. To demonstrate the effectiveness and efficiency of this approach, we evaluate it with real malware samples. Using more than 15,000 real malware, we find our approach can achieve high true positives, low false positives, and low computational cost.

T-OSN : a trust evaluation model in online social networks

Now days, the online social networks (OSN) have gained considerable popularity. More and more people use OSN to share their interests and make friends, also the OSN helps users overcome the geographical barriers. With the development of OSN, there is an important problem users have to face that is trust evaluation. Before user makes friends with a stranger, the user need to consider the following issues: Can a stranger be trusted? How much the stranger can be trusted? How to measure the trust of a stranger? In this paper, we take two factors, Degree and Contact Interval into consideration, which produce a new trust evaluation model (T-OSN). T-OSN is aimed to solve how to evaluate the trust value of an OSN user, also which is more efficient, more reliable and easy to implement. Base on our research, this model can be used in wide range, such as online social network (OSN) trust evaluation, mobile network message forwarding, ad hoc wireless networking, routing message on Internet and peer-to-peer file sharing network. The T-OSN model has following obvious advantages compare to other trust evaluate methods. First of all, it is not base on features of traditional social network, such as, distance and shortest path. We choose the special features of OSN to build up the model, that is including numbers of friends(Degree) and contact frequency(Contact Interval). These species features makes our model more suitable to evaluate OSN users trust value. Second, the formulations of our model are quite simple but effective. That means, to calculate the result by using our formulations will not cost too much resources. Last but not least, our model is easy to implement for an OSN website, because of the features that we used in our model, such as numbers of friends and contact frequency are easy to obtain. To sum up, our model is using a few resources to obtain a valuable trust value that can help OSN users to solve an important security problem, we believe that will be big step - or development of OSN.

Solar greenhouse technology for food security : a case study from Humla District, NW Nepal

Food security is a significant issue for many people who live in remote mountain areas around the world. Most of these people are also poor because of the lack of opportunity to earn cash. Malnutrition is common because the harsh climate restricts production and access to fresh food. Simple conventional greenhouses can provide some improvement of growing conditions, but the benefits are limited because of the high heat losses from these structures. Solar greenhouses, however, which are designed to store some of the heat generated within the structure can overcome these limitations. This article describes the experiences of a nongovernmental organization that has been introducing community and family-owned solar greenhouses into the remote villages of Humla, a mountainous district of northwest Nepal prone to food insecurity. The overall result has been positive. Family-owned greenhouses, which avoid the issues of community ownership and operation, have been more successful. A validated computer model based on the first solar greenhouse has been used to predict the thermal performance of a new family-sized design. Training and education are vital to the success of solar greenhouse technology in remote mountain areas.

An analytical model on the propagation of modern email worms

Email worms propagate across networks by taking advantage of email relationships. Modeling the propagation of email worms can help predict their potential damages and develop countermeasures. We propose a novel analytical model on the propagation process of modern reinfection email worms. It relies on probabilistic analysis, and thus can provide a steady and reliable assessment on the propagation dynamics. Additionally, by introducing virtual users to represent the repetitious spreading process, the proposed model overcomes the computational challenge caused by reinfection processes. To demonstrate the benefits of our model, we conduct a series of experimental evaluation. The results show that our novel approach achieves a greater accuracy and is more suitable for modeling modern email worms than previous models.

Securing recommendations in grouped P2P e-commerce trust model

In dynamic peer to peer (P2P) e-commerce, it is an important and difficult problem to promote online businesses without sacrificing the desired trust to secure transactions. In this paper, we address malicious threats in order to guarantee secrecy and integrity of recommendations exchanged among peers in P2P e-commerce. In addition to trust, secret keys are required to be established between each peer and its neighbors. Further, we propose a key management approach gkeying to generate six types of keys. Our work mainly focuses on key generation for securing recommendations, and ensuring the integrity of recommendations. The proposed approach presented with a security and performance analysis, is more secure and more efficient in terms of communication cost, computation cost, storage cost, and feasibility. © 2012 IEEE.

Down under and in between : Australian security perspectives in the 'Asian Century'

This chapter will provide an overview of Australian perspectives on the US alliance in light of ongoing and emerging challenges in the Asia-Pacific region. After a brief discussion of the motivations behind the signing of the ANZUS treaty, the first part of the chapter examines the historical context of the alliance, with a particular focus on the longstanding and ongoing tussle in Australia between independence in foreign policy making vis-à-vis broader structural constraints. While this debate has been a constant feature of the political scene in Australia, it has come into particular focus since the US withdrawal from Vietnam, which marked a turning point in Australian perspectives with regard to its own role in Asia. The collision of ideas surrounding Australian identity and Australian national interest has been reflected in policy approaches as successive governments have sought to strike a balance between the two exigencies and thus, most optimally ensure Australia’s strategic future. The chapter concludes by examining current perspectives through the lens of an ongoing debate taking place in Australian academic circles about what the rise of China means for Australia and its commitment to the US alliance, and considers options for caucus-style cooperation with fellow US allies beyond the hub-and-spokes model.

Should we refinance unfunded social security?

Within a continuous-time overlapping generations model, featuring endogenous intensive margin of the labour supply and retirement decision, we analyse the issue of passing the burden of payroll revenues onto consumption or capital. We find that large long-run welfare gains occur when pension benefits are refinanced by consumption taxes. However, the transition to the new steady state is very painful for a large fraction of existing cohorts. On the other hand, the capital base is too small to sustain pension benefits but could be made larger if capital taxes are raised. Yet that would entail significant welfare losses.

Water security through scarcity pricing and reverse osmosis: a system dynamics approach

Water supply and demand planning is often conducted independently of social and economic strategies. There are presently no comprehensive life-cycle approaches to modelling urban water balances that incorporate economic feedbacks, such as tariff adjustment, which can in turn create a financing capacity for investment responses to low reservoir levels. This paper addresses this gap, and presents a system dynamics model that augments the usual water utility representation of the physical linkages of water grids, by adding inter-connected feedback loops in tariff structures, demand levels and financing capacity. The model, applied in the south-east Queensland region in Australia, enables simulation of alternatives and analysis of stocks and flows around a grid or portfolio of bulk supplies including an increasing proportion of rain-independent desalination plants. Such rain-independent water production plants complement the rain-dependent sources in the region and can potentially offer indefinite water security at a price. The study also shows how an alternative temporary drought pricing regime not only defers costly bulk supply infrastructure but actually generates greater price stability than traditional pricing approaches. The model has implications for water supply planners seeking to pro-actively plan, justify and finance portfolios of rain-dependent and rain-independent bulk water supply infrastructure. Interestingly, the modelling showed that a temporary drought pricing regime not only lowers the frequency and severity of water insecurity events but also reduces the long-run marginal cost of water supply for the region when compared to traditional reactive planning approaches that focus on restrictions to affect demand in scarcity periods.

Spam Trapping System: Novel security framework to fight against spam botnets

In this paper, we inspire from two analogies: the warfare kill zone and the airport check-in system, to tackle the issue of spam botnet detection. We add a new line of defense to the defense-in-depth model called the third line. This line is represented by a security framework, named the Spam Trapping System (STS) and adopts the prevent-then-detect approach to fight against spam botnets. The framework exploits the application sandboxing principle to prevent the spam from going out of the host and detect the corresponding malware bot. We show that the proposed framework can ensure better security against malware bots. In addition, an analytical study demonstrates that the framework offers optimal performance in terms of detection time and computational cost in comparison to intrusion detection systems based on static and dynamic analysis. © 2014 IEEE.

Capturing security requirements using essential use cases (EUCs)

Capturing security requirements is a complex process, but it is crucial to the success of a secure software product. Hence, requirements engineers need to have security knowledge when eliciting and analyzing the security requirements from business requirements. However, the majority of requirements engineers lack such knowledge and skills, and they face difficulties to capture and understand many security terms and issues. This results in capturing inaccurate, inconsistent and incomplete security requirements that in turn may lead to insecure software systems. In this paper, we describe a new approach of capturing security requirements using an extended Essential Use Cases (EUCs) model. This approach enhances the process of capturing and analyzing security requirements to produce accurate and complete requirements. We have evaluated our prototype tool using usability testing and assessment of the quality of our generated EUC security patterns by security engineering experts.

The effect of social security, demography and technology on retirement

This article investigates the causes in the reduction of labor force participation of the old. We argue that the changes in social security policy, in technology and in demography may account for most of the changes in retirement over the second part of the last century in the U.S. economy. We develop a dynamic general equilibrium model with endogenous retirement that embeds social security legislation. The model is able to match very closely the increase in the retirement rate of males aged 65 and older. It also quanti es the isolated impact on retirement and on the solvency of the social security system of the di¤erent factors. The model suggests that technological and demographic changes had a strong in uence on retirement, so that it would have increased signi cantly even if the social security rules had not changed. However, as the latter became much more generous in the past, changes in social security policy can account not only for a sizeable part of the expansion of retirement, but also for the most of the observed increase in the social security expenses as a share of GDP.

The effect of social security, demography and technology on retirement

This article investigates the causes in the reduction of labor force participation of the old. We argue that the changes in social security policy, in technology and in demography may account for most of the changes in retirement over the second part of the last century in the U.S. economy. We develop a dynamic general equilibrium model with endogenous retirement that embeds social security legislation. The model is able to match very closely the increase in the retirement rate of males aged 65 and older. It also quanti es the isolated impact on retirement and on the solvency of the social security system of the di¤erent factors. The model suggests that technological and demographic changes had a strong in uence on retirement, so that it would have increased signi cantly even if the social security rules had not changed. However, as the latter became much more generous in the past, changes in social security policy can account not only for a sizeable part of the expansion of retirement, but also for the most of the observed increase in the social security expenses as a share of GDP.