Distributed denial of service (DDoS) detection by traffic pattern analysis

In this paper, we propose a behavior-based detection that can discriminate Distributed Denial of Service (DDoS) attack traffic from legitimated traffic regardless to various types of the attack packets and methods. Current DDoS attacks are carried out by attack tools, worms and botnets using different packet-transmission rates and packet forms to beat defense systems. These various attack strategies lead to defense systems requiring various detection methods in order to identify the attacks. Moreover, DDoS attacks can craft the traffics like flash crowd events and fly under the radar through the victim. We notice that DDoS attacks have features of repeatable patterns which are different from legitimate flash crowd traffics. In this paper, we propose a comparable detection methods based on the Pearson’s correlation coefficient. Our methods can extract the repeatable features from the packet arrivals in the DDoS traffics but not in flash crowd traffics. The extensive simulations were tested for the optimization of the detection methods. We then performed experiments with several datasets and our results affirm that the proposed methods can differentiate DDoS attacks from legitimate traffics.

Google hacking defence based on honey pages

 Many web servers contain some dangerous pages (we name them eigenpages) that can indicate their vulnerabilities. Therefore, some worms such as Santy locate their targets by searching for these eigenpages in search engines with well-crafted queries. In this paper, we focus on the modeling and containment of these special worms targeting web applications. We propose a containment system based on honey pots. We make search engines randomly insert a few honey pages that will induce visitors to the pre-established honey pots among the search results for the arriving queries. And then infectious can be detected and reported to the search engines when their malicious scans hit the honey pots. We find that the Santy worm can be well stopped by inserting no more than two honey pages in every one hundred search results. We also solve the challenging issue to dynamically generate matching honey pages for those dynamically arriving queries. Finally, a prototype is implemented to prove the technical feasibility of this system. © 2013 by CESER Publications.

Synthesis and mechanistic insights of macromolecular assemblies from ABA triblock copolymer blends

Macromolecular assembly of block copolymers into numerous nanostructures resembles self-organization of proteins and cellular components found in nature. In order to mimic nature’s assemblies either to cure a disease or construct functional devices, the organization principles underpinning the emergence of complex shapes need to be understood. In the same vein, this study aimed at understanding morphology evolution in a triblock copolymer blend in aqueous solution. An ABA type amphiphilic triblock copolymer (polystyrene-b-polyethylene oxide-b-polystyrene, PS-b-PEO-b-PS) was synthesized at different compositions via atom transfer radical polymerization (ATRP) and self-assembly behavior of a binary mixture in aqueous solution was studied. Block copolymers that form worms and vesicles in its pristine state was shown to form complex morphologies such as fused rings, “jellyfish”, toroid vesicles, large compound vesicles and large lamellae after blending. The tendency of vesicle-forming block copolymer to form bilayers may be responsible for triggering complex morphologies when mixed with a worm or micelle-forming polymer. In other words, the interplay between curvature effects produced by two distinct polymers with different hydrophobic block lengths results in complex morphologies due to chain segregation within the nanostructure.

Modeling and analysis on the propagation dynamics of modern email malware

Due to the critical security threats imposed by email-based malware in recent years, modeling the propagation dynamics of email malware becomes a fundamental technique for predicting its potential damages and developing effective countermeasures. Compared to earlier versions of email malware, modern email malware exhibits two new features, reinfection and self-start. Reinfection refers to the malware behavior that modern email malware sends out malware copies whenever any healthy or infected recipients open the malicious attachment. Self-start refers to the behavior that malware starts to spread whenever compromised computers restart or certain files are visited. In the literature, several models are proposed for email malware propagation, but they did not take into account the above two features and cannot accurately model the propagation dynamics of modern email malware. To address this problem, we derive a novel difference equation based analytical model by introducing a new concept of virtual infected user. The proposed model can precisely present the repetitious spreading process caused by reinfection and self-start and effectively overcome the associated computational challenges. We perform comprehensive empirical and theoretical study to validate the proposed analytical model. The results show our model greatly outperforms previous models in terms of estimation accuracy. © 2013 IEEE.

Smartphone malware and its propagation modeling : A survey

Smartphones are pervasively used in society, and have been both the target and victim of malware writers. Motivated by the significant threat that presents to legitimate users, we survey the current smartphone malware status and their propagation models. The content of this paper is presented in two parts. In the first part, we review the short history of mobile malware evolution since 2004, and then list the classes of mobile malware and their infection vectors. At the end of the first part, we enumerate the possible damage caused by smartphone malware. In the second part, we focus on smartphone malware propagation modeling. In order to understand the propagation behavior of smartphone malware, we recall generic epidemic models as a foundation for further exploration. We then extensively survey the smartphone malware propagation models. At the end of this paper, we highlight issues of the current smartphone malware propagation models and discuss possible future trends based on our understanding of this topic. © © 2014 IEEE.

A sword with two edges: propagation studies on both positive and negative information in online social networks

Online social networks (OSN) have become one of the major platforms for people to exchange information. Both positive information (e.g., ideas, news and opinions) and negative information (e.g., rumors and gossips) spreading in social media can greatly influence our lives. Previously, researchers have proposed models to understand their propagation dynamics. However, those were merely simulations in nature and only focused on the spread of one type of information. Due to the human-related factors involved, simultaneous spread of negative and positive information cannot be thought of the superposition of two independent propagations. In order to fix these deficiencies, we propose an analytical model which is built stochastically from a node level up. It can present the temporal dynamics of spread such as the time people check newly arrived messages or forward them. Moreover, it is capable of capturing people's behavioral differences in preferring what to believe or disbelieve. We studied the social parameters impact on propagation using this model. We found that some factors such as people's preference and the injection time of the opposing information are critical to the propagation but some others such as the hearsay forwarding intention have little impact on it. The extensive simulations conducted on the real topologies confirm the high accuracy of our model.

Malware propagation in large-scale networks

Malware is pervasive in networks, and poses a critical threat to network security. However, we have very limited understanding of malware behavior in networks to date. In this paper, we investigate how malware propagates in networks from a global perspective. We formulate the problem, and establish a rigorous two layer epidemic model for malware propagation from network to network. Based on the proposed model, our analysis indicates that the distribution of a given malware follows exponential distribution, power law distribution with a short exponential tail, and power law distribution at its early, late and final stages, respectively. Extensive experiments have been performed through two real-world global scale malware data sets, and the results confirm our theoretical findings.

Avaliação do processo de compostagem de resíduos sólidos urbanos

A crescente produção de resíduos sólidos urbanos e a escassez de áreas para uma destinação final tecnicamente adequada, via implantação de aterros sanitários, faz com que tome importância a técnica de tratamento de resíduos sólidos orgânicos através das compostagem/vermicompostagem. Nesta pesquisa, foi realizada a avaliação destes processos, tendo sido observadas principalmente a influência da aeração e da umidade no desempenho destas técnicas de tratamento, em leiras de pequenos e grandes volumes. Nos experimentos, com leiras de pequenos volumes, realizados no IPH (Instituto de Pesquisas Hidráulicas) da UFRGS, utilizou-se resíduos sólidos de poda (resíduos verdes, com alta concentração de carbono) codispostos (misturados em peso) com resíduos vegetais da CEASA (Companhia Estadual de Abastecimento Sociedade Anônima) e lodos provenientes de estações de tratamento de esgotos sanitários. Nos experimentos, com leiras de grandes volumes, realizados na UTC – Unidade de Triagem e Compostagem de Porto Alegre, utilizou-se resíduos orgânicos domiciliares codispostos com os mesmos resíduos utilizados nos primeiros experimentos. Paralelamente aos experimentos de compostagem, avaliou-se os lixiviados produzidos nos sistemas. Na compostagem de grandes volumes, também foi observado o desempenho de banhados construídos de fluxo subsuperficial para o tratamento desses efluentes líquidos. com teores de resíduos verdes menores que 35 %, o que se justifica pela maior concentração de resíduos de característica facilmente biodegradável e de maior palatabilidade para os vermes. Em todos os experimentos de compostagem, verificou-se que o controle efetivo do processo pode ser realizado através da avaliação sistemática das temperatura e umidade das leiras. Evidenciou-se também que para regiões de clima similar ao de Porto Alegre, com elevadas precipitações principalmente no inverno, é necessário adotar dimensões adequadas ao sistema de compostagem “windrow” para áreas descobertas. Comprovou-se também a necessidade de manutenção da umidade na faixa entre 50% e 70 %, inclusive com reposição desta, mesmo na situação de inverno. A avaliação dos lixiviados da compostagem demonstrou que, com os substratos utilizados nos experimentos, as concentrações de DBO5, DQO e de outras variáveis são elevadas ao início do processo de decomposição, devido à solubilização dos compostos orgânicos e inorgânicos presentes na matéria orgânica. Os lixiviados da compostagem possuem baixas concentrações de condutividade, DBO5, NH4 +, entre outros, quando comparados aos lixiviados de aterros sanitários. tratamento destes efluentes. Os resultados obtidos nos banhados construídos para baixas cargas hidráulicas (1cm/d) e concentrações de DBO5 do afluente abaixo de 150 mg/L apontaram uma eficiência média de remoção de 52,02%. No que se refere a nitrogênio (todas as formas), fósforo, metais, potencial redox e sólidos totais, as eficiências foram variáveis, com melhores resultados para nitrogênio amoniacal e fósforo. A compostagem pode ser considerada uma alternativa viável de tratamento de resíduos orgânicos, utilizando-se o processo “windrow” com revolvimento mecânico, mesmo em pátios descobertos em climas subtropicais. Neste caso, sugere-se que os lixiviados gerados nos primeiros dias de compostagem (30 dias aproximandamente) sejam recirculados e o excedente tratado em ETE. Pode-se, também, utilizar o sistema de banhados construídos como complementação, principalmente para a remoção de nitrogênio e fósforo.

Susceptibility of mosquito vectors to Dirofilaria immitis on Madeira Island, Portugal

Dirofilaria immitis (Leidy, 1856), an agent of heartworm disease, is an important parasite from both the veterinary standpoint and as a model to study human filariasis. It is a mosquito-borne filarial nematode which inhabits the right ventricle and pulmonary arteries of dogs. D. immitis is an important disease agent on Madeira Island with about 30% of dogs testing positive for this worm. Nevertheless, the vectors of this parasite in Madeira have never been studied, nor has the interaction between pathogen and vector, or the environmental variables that might influence heartworm transmission. Innate susceptibility to infection is only one component of vector competence, and field isolation of naturally infected mosquitoes has shown the capability of D. immitis to exploit a great diversity of vector species under natural conditions. The purpose of this work was to determine which mosquitoes are vectors of heartworm disease, the relation between population density and environment, and the association between immune response of the vector to the filarial parasite. Seasonal abundance of Culex theileri and Culex pipiens molestus was studied. Correlation and canonical correspondence analysis were performed using abundance data of these two species with selected weather variables, including mean temperature, relative humidity and accumulated precipitation. The most important factor determining Cx. theileri abundance was accumulated precipitation, while Cx. pipiens molestus abundance did not have any relationship with weather variables. Field studies were performed to verify whether Cx. theileri Theobald functions as a natural vector of D. immitis on Madeira Island, Portugal. Cx. theileri tested positive for D. immitis for the first time. The same study was made regarding Cx. p. molestus. Two abnormal L2 stage filarial worms were found in Malpighian tubules in field caught Cx. p. molestus. In the laboratory, two strains of Cx. p. molestus were studied for their susceptibility to D. immitis. None presented infective-stage larvae. Finally, because Cx. p. molestus is an autogenous mosquito, we evaluated the reproductive costs when this mosquito mounts an immune response against D. immitis in the absence of a blood meal. This mosquito showed an active immune response when inoculated intrathoracically with microfilariae (mf) of the heartworm. The ovaries from mosquitoes undergoing melanotic encapsulation developed more eggs than those which could not melanize the mf. This fact is contradictory with some previous studies of reproductive costs in Armigeres subalbatus and Ochlerotatus trivittatus, and it was the first time that an autogenous mosquito was used to study this subject.

Improvement of the oral praziquantel anthelmintic effect by cyclodextrin complexation

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)

Estudo epidemiológico das parasitoses oculares na população de escolares da cidade de Natal-RN, Brasil

The objective of this study is to estimate the prevalence of Ocular Toxocariasis, Diffuse Unilateral Subacute Neuroretinitis (DUSN), Toxoplasma gondii infection and Ocular Toxoplasmosis in a student population in Natal-RN/Brazil and relate it to demographic, epidemiologic and socio-economic risk factors. The incidence of DUSN was observed in patients at the Federal University of Rio Grande do Norte Ophthalmology Service and the Prontoclinica de Olhos Ophthalmology clinic in Natal. In cases where a worm was found in the subretinal space, the result of treatment with photocoagulation using Green Laser (Eye Light ALCON) was evaluated in relation to final visual result. The sample was randomly selected among the schools of the four districts of Natal, according to the type of institution (public or private), its level (elementary or secondary), and study period (morning, afternoon or evening). The school population was studied from March to May, 2001. Initially, the students answered a questionnaire to evaluate demographic, epidemiologic and socio-economic risk factors. Afterwards, the following procedures were carried out: blood samples were taken for Toxoplasmosis (IgG, IgM) serology, hemogram, ophthalmological examination, consisting of clinical history, measurement of visual acuity, refraction under cycloplegia, biomicroscopy of the anterior segment and annexa, funduscopy and examination of extrinsic motility. The prevalence of Toxocariasis was 0.2% or 2 per one thousand students. The sample was insufficient to estimate the prevalence of DUSN. Seventy patients with DUSN diagnosis were examined from January, 2001 to January, 2003. A live worm was found in the subretinal space of all four patients in the acute phase, and these were treated with laser photocoagulation. After follow-up (average = 11.5 months), visual acuity improved in three eyes and remained unaltered in one eye. Worms were found in 22 of the 66 patients in the chronic phase, and these also were treated with laser photocoagulation. After a follow-up period of 13.1 months, on average, visual acuity improved in two of the patients, remained unchanged in 19 and worsened in one. The comparison of visual result before and after treatment was not statistically significant (p = 0.302). The diagnosis of DUSN in the acute phase, followed by prompt localization and destruction of the worm by photocoagulation, can improve the patient s vision. However, destruction of the worm by laser photocoagulation in eyes with DUSN in the chronic phase does not improve visual acuity. Seroprevalence for IgG was 46% (Confidence Interval CI 95%-42.9-49.2%) and for IgM it was 1.4% (CI 95% = 0.8-2.4%). The prevalence of ocular lesion was 1.15% (CI 95% = 0.6 - 2.0%). Socio-economic conditions were determinants in the prevalence of Systemic and Ocular Toxoplasmosis in the bivaried analysis and confirmed in the multivaried analysis (mother s scholarity illiterate/ OR = 2.9 and p < 0.001). The T. gondii infection prevalence, although high, was less than that found in studies performed in the South and Southeast of Brazil and that of Ocular Toxoplasmosis was completely discrepant, varying from 5 to 17 times less. Although important epidemiological variables such as owning a cat, drinking unfiltered water, and coming into contact with rivers or lakes showed an association in the preliminary analysis, they lost their influence when included in the logistic model. Future studies are scheduled to begin in March, 2004, in collaboration with other Brazilian and American universities in an attempt to discover the reason for these findings, as well as identifying the different strains of Toxoplasma gondii, and studying the sources of water utilized by the population of Natal Brazil

Growth, fat content and fatty acid profile of South American catfish, surubim (Pseudoplatystoma fasciatum) juveniles fed live, commercial and formulated diets

Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq)

Tamanho da amostra para quantificação do diâmetro de lesões de cancro cítrico

A estimativa do diâmetro de lesões de cancro cítrico é uma das principais técnicas usadas na avaliação da interação entre isolados x genótipos, na avaliação da resistência varietal e no estudo de aspectos epidemiológicos. No entanto, inexistem informações a respeito do tamanho da amostra para uma adequada quantificação da doença, considerando o diâmetro de lesões. Nesse sentido, o presente trabalho teve como objetivo a determinação do número de amostras para mensurar o diâmetro médio de lesões de cancro cítrico. Foram considerados como fontes de variação três genótipos do hospedeiro, dois métodos de inoculação de Xanthomonas citri subsp. citri e dois avaliadores. As avaliações dos diâmetros foram realizadas considerando ou não o halo amarelo ao redor do tecido necrosado, quando presente. Estimativas do diâmetro de lesões com erros na média inferiores a 3% são impraticáveis em razão do tamanho excessivo da amostra (mais que quarenta lesões/planta). Menores erros na média ocorreram nas estimativas considerando somente o tecido necrosado. Estimativas precisas do diâmetro de lesões, com erros na média inferiores a 10%, podem ser obtidas com tamanhos de amostras entre cinco e quinze lesões/planta, independentemente do genótipo e da idade das lesões.