Browsing behavior mimicking attacks on popular web sites for large botnets

With the significant growth of botnets, application layer DDoS attacks are much easier to launch using large botnet, and false negative is always a problem for intrusion detection systems in real practice. In this paper, we propose a novel application layer DDoS attack tool, which mimics human browsing behavior following three statistical distributions, the Zipf-like distribution for web page popularity, the Pareto distribution for page request time interval for an individual browser, and the inverse Gaussian distribution for length of browsing path. A Markov model is established for individual bot to generate attack request traffic. Our experiments indicated that the attack traffic that generated by the proposed tool is pretty similar to the real traffic. As a result, the current statistics based detection algorithms will result high false negative rate in general. In order to counter this kind of attacks, we discussed a few preliminary solutions at the end of this paper.

Detection on application layer DDoS using random walk model

Application Layer Distributed Denial of Service (ALDDoS) attacks have been increasing rapidly with the growth of Botnets and Ubiquitous computing. Differentiate to the former DDoS attacks, ALDDoS attacks cannot be efficiently detected, as attackers always adopt legitimate requests with real IP address, and the traffic has high similarity to legitimate traffic. In spite of that, we think, the attackers' browsing behavior will have great disparity from that of the legitimate users'. In this paper, we put forward a novel user behavior-based method to detect the application layer asymmetric DDoS attack. We introduce an extended random walk model to describe user browsing behavior and establish the legitimate pattern of browsing sequences. For each incoming browser, we observe his page request sequence and predict subsequent page request sequence based on random walk model. The similarity between the predicted and the observed page request sequence is used as a criterion to measure the legality of the user, and then attacker would be detected based on it. Evaluation results based on real collected data set has demonstrated that our method is very effective in detecting asymmetric ALDDoS attacks. © 2014 IEEE.

Fool me if you can: mimicking attacks and anti-attacks in cyberspace

Botnets have become major engines for malicious activities in cyberspace nowadays. To sustain their botnets and disguise their malicious actions, botnet owners are mimicking legitimate cyber behavior to fly under the radar. This poses a critical challenge in anomaly detection. In this paper, we use web browsing on popular web sites as an example to tackle this problem. First of all, we establish a semi-Markov model for browsing behavior. Based on this model, we find that it is impossible to detect mimicking attacks based on statistics if the number of active bots of the attacking botnet is sufficiently large (no less than the number of active legitimate users). However, we also find it is hard for botnet owners to satisfy the condition to carry out a mimicking attack most of the time. With this new finding, we conclude that mimicking attacks can be discriminated from genuine flash crowds using second order statistical metrics. We define a new fine correntropy metrics and show its effectiveness compared to others. Our real world data set experiments and simulations confirm our theoretical claims. Furthermore, the findings can be widely applied to similar situations in other research fields.

Understanding student information behavior in relation to electronic information services: lessons from longitudinal monitoring and evaluation Part 1

Rowley, J.& Urquhart, C. (2007). Understanding student information behavior in relation to electronic information services: lessons from longitudinal monitoring and evaluation Part 1. Journal of the American Society for Information Science and Technology, 58(8), 1162-1174. Sponsorship: JISC

Disentangle contextual and permanent individual motivations:an application to shopping behavior

Past studies resulted in conflicting definitions of consumer motivation. On the one hand, motivations are seen as the consumer’s characteristics that shape her general behavior (motivational trait). On the other hand, they are seen as contextual variables representing the reason why the individual is behaving specific to today’s context (motivational state). The objective of this research is to stress the difference between these two concepts and to understand the impact of each on consumer behavior. We applied our empirical study to shopping motivations; our results show a strong interaction between motivational trait and motivational state. Problem and Hypothesis On the one hand, Westbrook and Black (1985) consider shopping motivations as individual permanent characteristics. This concept is shared by other researchers (Rohm and Swaminathan 2004), which show that some shoppers are functional (they shop for convenience, information seeking, and time saving) while some others are hedonic (they shop for social interaction, bargain hunting and browsing). On the other hand, Kaltcheva and Weitz (2006) define motivations as a contextual orientation changing over time, depending on the situation, and show that contextual shopping motivations have a strong impact on shopping behavior. From our knowledge, no research specifically examined the respective impact of both these shopping motivation types. To deal with this issue, we used the notions of “traits” and “states” that have been largely used in marketing research to designate respectively a permanent characteristic of the individual and a temporary orientation of the consumer (Mowen 2000). The reversal theory (Apter 2001) suggests that two opposite states exist: the telic and the paratelic states. In the telic state, individuals set goals for themselves, must be disciplined to reach these goals, and do not behave in accordance with their personal trait. In the paratelic state, individuals are seeking arousal and enjoyment, do not set rules, and one could postulate that they act in accordance with their natural tendencies. Based on these considerations, we hypothesize the following process: in situations involving paratelic states, hedonic as well as functional individuals should behave according to their natural traits, whereas in situations involving telic states, hedonic people should inhibit their natural propensity to enjoy shopping and behave similarly to functional people. Hence, we postulate the following: Hypothesis: Compared to shoppers with functional motivational trait, shoppers with hedonic motivational trait will a) significantly display more hedonic shopping behavior intentions in a condition of paratelic motivational state, and b) not display more hedonic shopping behavior intentions in a condition a telic motivational state Empirical Research First, 108 participants were asked to fill a multi-items scale about their shopping habits, which actually measured their shopping motivational traits. This questionnaire allowed us to highlight four different dimensions in shopping motivational traits: social interaction, novelty/utility seeking, bargain hunting, and browsing. According to their scores on different items, participants were classified as functional or as hedonic on each of these four dimensions (a single individual may be hedonic on some dimensions and functional on others). Then, participants were then induced to adopt either a telic or a paratelic shopping motivational state while reading an appropriate scenario. Finally, participants were asked for their shopping behavior intentions in response to the shopping context. Four items were developed, corresponding to the four shopping motivational trait dimensions we found with our factor analysis. Results As we found four dimensions in shopping motivational trait, we set up four quasi-experimental designs to capture the entire phenomenon: for each dimension, a 2 (motivational trait) x 2 (motivational state) design was built, where the dependant variable was the shopping behavior element corresponding to the studied dimension. Four 2 x 2 Anovas were performed to assess the interaction between motivational trait and motivational state. Concerning the three dimensions - browsing, novelty/utility seeking, and bargain hunting- , in the paratelic state scenario participants with hedonic motivational trait displayed significantly more hedonic shopping behavior intentions than participants with a functional motivational trait (resp. F = 9.701, p = .003; F = 4.979, p = .03; F = 5.757, p = .02); and in the telic state scenario, there was no significant difference in behavior intentions between participants with hedonic or functional motivation trait. Each time, the interaction effect between motivational state and motivational trait was significant (resp. F = 4.859, p = .03; F = 3.314, p = .07; F = 2.98, p = .08). Concerning the fourth dimension, social interaction, shopping behavior intentions of participants with hedonic and with functional motivational traits were significantly different in the paratelic state scenario (F = 29.898, p <.000) as well as in the telic state scenario (F = 9.559, p = .003). However, the interaction effect showed that this behavioral difference was significantly stronger in the paratelic scenario. All these results support our research hypothesis. Discussion and Implications Our study provides consistent support for our hypotheses saying that there is an interaction effect between shopping motivational states and shopping motivational traits. The generalization of the results is strengthened by the study of four different shopping traits: social interaction, novelty/utility seeking, bargain hunting and browsing. As we proposed, when shopping in a goal-oriented state (telic state), behaviors of hedonic and functional shoppers do not differ significantly. Conversely, when shopping for a recreational reason (paratelic state), hedonic and functional shoppers behave significantly different. These results could explain why some previous studies concluded that shopping motivational traits had no impact on shopping behavior: they did not take into consideration the interaction between motivational trait and motivational state. Moreover, our study shows that marketing surveys performed by store managers to draw the personal profile of their customers must be crossed with contextual motivations in order to accurately forecast shopper behavior. Future Developments Our results can be explained by the self-control process, which pushes hedonic-trait shoppers to behave in a rather functional way in utilitarian situations. However, to be certain that this is the very process that occurs, we plan to add self-control perception scales to our existing measures. This is obviously the next step of this research.

The Behavior of Hydroxyl Units of Synthetic Goethite and its Dehydroxylated Product Hematite

The behavior of the hydroxyl units of synthetic goethite and its dehydroxylated product hematite was characterized using a combination of Fourier transform infrared (FTIR) spectroscopy and X-ray diffraction (XRD) during the thermal transformation over a temperature range of 180-270 degrees C. Hematite was detected at temperatures above 200 degrees C by XRD while goethite was not observed above 230 degrees C. Five intense OH vibrations at 3212-3194, 1687-1674, 1643-1640, 888-884 and 800-798 cm(-1), and a H2O vibration at 3450-3445 cm(-1) were observed for goethite. The intensity of hydroxyl stretching and bending vibrations decreased with the extent of dehydroxylation of goethite. Infrared absorption bands clearly show the phase transformation between goethite and hematite: in particular. the migration of excess hydroxyl units from goethite to hematite. Two bands at 536-533 and 454-452 cm(-1) are the low wavenumber vibrations of Fe-O in the hematite structure. Band component analysis data of FTIR spectra support the fact that the hydroxyl units mainly affect the a plane in goethite and the equivalent c plane in hematite.

Let's Dance: A Language for Service Behavior Modeling

In Service-Oriented Architectures (SOAs), software systems are decomposed into independent units, namely services, that interact with one another through message exchanges. To promote reuse and evolvability, these interactions are explicitly described right from the early phases of the development lifecycle. Up to now, emphasis has been placed on capturing structural aspects of service interactions. Gradually though, the description of behavioral dependencies between service interactions is gaining increasing attention as a means to push forward the SOA vision. This paper deals with the description of these behavioral dependencies during the analysis and design phases. The paper outlines a set of requirements that a language for modeling service interactions at this level should fulfill, and proposes a language whose design is driven by these requirements.

Multiple-choice versus short-response items: Differences in omit behavior

The overall rate of omission of items for 28,331 17 year old Australian students on a high stakes test of achievement in the common elements or cognitive skills of the senior school curriculum is reported for a subtest in multiple choice format and a subtest in short response format. For the former, the omit rates were minuscule and there was no significant difference by gender or by type of school attended. For the latter, where an item can be 'worth' up to five times that of a single multiple choice item, the omit rates were between 10 and 20 times that for multiple choice and the difference between male and female omit rate was significant as was the difference between students from government and non-government schools. For both formats, females from single sex schools omitted significantly fewer items than did females from co-educational schools. Some possible explanations of omit behaviour are alluded to.

Examining the antecedents and consequences of ritualized fan behavior [Abstract]

One of the features of the sporting industry is the ritualized way in which it is consumed across the world. Fans of every sport have rituals and superstitions to help them enjoy the spectacle, socialize with other like-minded fans, and reduce some of the anxiety of watching their team play. These rituals include dress, barracking styles and pre and post match behaviors. What is not known are the factors that lead fans to engage in ritual behaviors and what relationship rituals have with desirable outcomes such as increased attendance, attitudinal loyalty or satisfaction. Given that some ritual behaviors are clearly undesirable, (e.g., hooliganism), understanding these relationships is important to managers who may be questioning whether rituals should be encouraged. Although ritualized behavior amongst fans is clearly visible, the symbolic and emotional nature of ritual poses challenges to researchers. Most previous ritual research is exploratory and qualitative in nature. This study, however, uses a behavior-based scale to measure fan ritual and relates it to desirable outcomes such as commitment and attendance. Over 2,000 season ticket holders of a football (soccer) team in Australia’s professional A-League competition were surveyed to investigate the antecedents and consequences of fan ritual behavior. Cluster analysis was used to explore the characteristics of respondents, and it revealed that those fans that engage in ritual behavior also differed on many other demographic and attitudinal dimensions. The associations between ritual and psychological commitment, and ritual and attendance are positive and significant. When used in conjunction with other constructs, fan ritual also improves the explanation of attendance behavior. The findings support previous research that found a significant and positive relationship between team identification, involvement and attendance, and extend previous research by finding a significant and positive relationship between rituals and attendance. For sports marketing practitioners, the results indicate the importance of developing and managing consumption rituals tied to game day attendance, with a view to generating uncommon loyalty.

Sharing knowledge at work : macro, social and relational individual influences on individual behavior

The impact of relations between an organization and its workers and the relations among workers on individual knowledge generation and sharing practices has not, to date, been addressed in an integrated way. This paper discusses the findings of a study analyzing issues at macro, locally-constructed and micro levels in a public sector organization, to identify and integrate the complex sets of mediators. Key factors were found to include (a) the contested nature of the process of knowledge construction, (b) the worker’s experience of the organization’s internal environment, (c) how the organization is understood to value knowledge sharing, (d) relations with colleagues, and (e) the perceived outcomes of knowledge sharing behaviors. Implications for practice are discussed.

Interpersonal pattern dynamics and adaptive behavior in multiagent neurobiological systems : conceptual model and data

Ecological dynamics characterizes adaptive behavior as an emergent, self-organizing property of interpersonal interactions in complex social systems. The authors conceptualize and investigate constraints on dynamics of decisions and actions in the multiagent system of team sports. They studied coadaptive interpersonal dynamics in rugby union to model potential control parameter and collective variable relations in attacker–defender dyads. A videogrammetry analysis revealed how some agents generated fluctuations by adapting displacement velocity to create phase transitions and destabilize dyadic subsystems near the try line. Agent interpersonal dynamics exhibited characteristics of chaotic attractors and informational constraints of rugby union boxed dyadic systems into a low dimensional attractor. Data suggests that decisions and actions of agents in sports teams may be characterized as emergent, self-organizing properties, governed by laws of dynamical systems at the ecological scale. Further research needs to generalize this conceptual model of adaptive behavior in performance to other multiagent populations.

Adaptive and phase transition behavior in performance of discrete multi-articular actions by degenerate neurobiological systems

The identification of attractors is one of the key tasks in studies of neurobiological coordination from a dynamical systems perspective, with a considerable body of literature resulting from this task. However, with regards to typical movement models investigated, the overwhelming majority of actions studied previously belong to the class of continuous, rhythmical movements. In contrast, very few studies have investigated coordination of discrete movements, particularly multi-articular discrete movements. In the present study, we investigated phase transition behavior in a basketball throwing task where participants were instructed to shoot at the basket from different distances. Adopting the ubiquitous scaling paradigm, throwing distance was manipulated as a candidate control parameter. Using a cluster analysis approach, clear phase transitions between different movement patterns were observed in performance of only two of eight participants. The remaining participants used a single movement pattern and varied it according to throwing distance, thereby exhibiting hysteresis effects. Results suggested that, in movement models involving many biomechanical degrees of freedom in degenerate systems, greater movement variation across individuals is available for exploitation. This observation stands in contrast to movement variation typically observed in studies using more constrained bi-manual movement models. This degenerate system behavior provides new insights and poses fresh challenges to the dynamical systems theoretical approach, requiring further research beyond conventional movement models.

Analyzing web multimedia query reformulation behavior

Current multimedia Web search engines still use keywords as the primary means to search. Due to the richness in multimedia contents, general users constantly experience some difficulties in formulating textual queries that are representative enough for their needs. As a result, query reformulation becomes part of an inevitable process in most multimedia searches. Previous Web query formulation studies did not investigate the modification sequences and thus can only report limited findings on the reformulation behavior. In this study, we propose an automatic approach to examine multimedia query reformulation using large-scale transaction logs. The key findings show that search term replacement is the most dominant type of modifications in visual searches but less important in audio searches. Image search users prefer the specified search strategy more than video and audio users. There is also a clear tendency to replace terms with synonyms or associated terms in visual queries. The analysis of the search strategies in different types of multimedia searching provides some insights into user’s searching behavior, which can contribute to the design of future query formulation assistance for keyword-based Web multimedia retrieval systems.