Bingchiang Jeng

Ant-based IP traceback

The denial-of-service (DoS) attacks with the source IP address spoofing techniques has become a major threat to the Internet. An intrusion detection system is often used to detect DoS attacks and to coordinate with the firewall to block them. However, DoS attack packets consume and may exhaust all the resources, causing degrading network performance or, even worse, network breakdown. A proactive approach to DoS attacks is allocating the original attack host(s) issuing the attacks and stopping the malicious traffic, instead of wasting resources on the attack traffic. In this paper, an ant-based traceback approach is proposed to identify the DoS attack origin. Instead of creating a new type or function or processing a high volume of fine-grained data used by previous research, the proposed traceback approach uses flow level information to identify the origin of a DoS attack. Two characteristics of ant algorithm, quick convergence and heuristic, are adopted in the proposed approach on finding the DoS attack path. Quick convergence efficiently finds out the origin of a DoS attack; heuristic gives the solution even though partial flow information is provided by the network. The proposed method is evaluated through simulation on various network environments and two simulated real networks, NSFNET and DFN. The simulation results show that the proposed method can successfully and efficiently find the DoS attack path in various simulated network environments, with full and partial flow information provided by the networks.

An optimal new-node placement to enhance the coverage of wireless sensor networks

Wireless sensor networks provide a wide range of applications, such as environment surveillance, hazard monitoring, traffic control, and other commercial or military applications. The quality of service provided by a sensor network relies on its coverage, i.e., how well an event can be tracked by sensors. This paper studies how to optimally deploy new sensors in order to improve the coverage of an existing network. The best- and worst-case coverage problems that are related to the observability of a path are addressed and formulated into computational geometry problems. We prove that there exists a duality between the two coverage problems, and then solve the two problems together. The presented placement algorithm is shown to deploy new nodes optimally in polynomial time.

An Alliance-Based Anti-spam Approach

The growing problem of spam mails has generated a need for reliable anti-spam filters. Much work has been done to improve specific algorithms for the task of detecting spam, but less work has been report on leveraging multiple algorithms in spam mails analysis. We presents an alliance-based approach to classify, discovery and exchange interesting information on spam mails. The spam filter is built based on the mixture of rough set theory, genetic algorithm and XCS classifier system. The filtering results of spam mails by alliance-based approach are evaluated with several metrics, the performance is great. Two main conclusions can be drawn from this paper: (1). The rules exchanged from other mail servers indeed help the spam filter blocking more spam mails than before. (2). A combination of several algorithms improves accuracy and reduces false positives for the problem of spam detection.

Node placement for optimal coverage in sensor networks

Wireless sensor networks provide an alternative way of improving our environments, such as environment surveillance, hazard monitoring, and other customized environmental applications. Good coverage of service in a sensor network is an essential issue to ensure the service of quality. This paper studies the deployment of new sensor nodes so that the improvement of coverage is optimized. We propose an optimal polynomial time algorithm for this problem. Based on computational geometry and graph theory, we show the properties of such a deployment and the correctness of its optimality

Malicious Webpage Detection by Semantics-Aware Reasoning

The evolutional development of dynamic HTML techniques empowers attackers a new and powerful tool to compromise machines. A malicious DHTML code disguises itself as a normal Webpage. The malicious Webpage infects the victim when a user browses it. Furthermore, such DHTML code can disguise easily through obfuscation or transformation, which makes detection even harder. Anti-virus software packages commonly use signature-based approaches which might not be able to efficiently identify camouflage malicious HTML code. In this paper, we propose a novel semantics-aware reasoning detection algorithm (SeAR) using the techniques of semantic modeling and memory-based reasoning for malicious Webpage detection. SeAR is resilient to code obfuscations and is able to detect malicious Webpage correctly. The experiments demonstrate that our detection algorithm can effectively detect variants of malicious HTML code with a low false rate.

Applying data mining to learn system dynamics in a biological model

Data mining consists of a set of powerful methods that have been successfully applied to many different application domains, including business, engineering, and bioinformatics. In this paper, we propose an innovative approach that uses genetic algorithms to mine a set of temporal behavior data output by a biological system in order to determine the kinetic parameters of the system. Analyzing the behavior of a biological network is a complicated task. In our approach, the machine learning method is integrated with the framework of system dynamics so that its findings are expressed in a form of system dynamics model. An application of the method to the cell division cycle model has shown that the method can discover approximate parametric values of the system and reproduce the input behavior.

Interactive Induction of Expert Knowledge

Abstract The process of extracting, structuring and organizing elicited knowledge (called knowledge acquisition) is a bottleneck in developing knowledge-based systems. A manual approach that elicits domain knowledge by interviewing human experts typically has problems, because the experts are often unable to articulate their reasoning rules. An automatic approach that induces knowledge from a set of training cases also suffers from the unavailability of sufficient training cases. We present an integrated approach that combines the strengths of both methods to compensate for their weaknesses. In this approach, human experts are responsible for solving problems, whereas an inductive learning algorithm is responsible for reasoning and consistency checking.

Optimal coverage deployment for wireless sensor networks

Wireless sensor networks provide an alternative way of improving our environments, such as environment surveillance, hazard monitoring, and other customized environmental applications. Good coverage of service in a sensor network is an essential issue to ensure the quality of service. This paper studies the deployment of new sensor nodes such that the improvement of the coverage is optimized. Based on computational geometry and graph theory, we propose an optimal polynomial time algorithm for sensor node deployment. We also prove the properties of such deployment and the correctness of the optimal solution

Exploiting knowledge ontology and software agents for PPI network analysis

One major goal of functional genomics has been to identify and analyze molecular interactions in a cellular context to better understand the underlying design principles and mechanisms. To investigate into a PPI network from both topological and functional points of view, this work proposes a methodology that exploits ontology-based biological knowledge for network analysis. To speed up the procedure, an agent-based framework is also presented for supporting distributed computing. The preliminary results show that through the knowledge obtained from gene ontology, our work in analyzing building blocks of PPI networks can give a higher resolution than that of previous ones. Also our agent-based framework can successfully speed up the task of network analysis in an adaptive manner.

Information Exchange Mechanism Based on Reputation in Mobile P2P Networks

A wireless P2P network could be formed by a number of wireless devices without a central server. Evaluating the trustfulness of other peers is an important issue in such a distributed wireless P2P environment. A trustfulness evaluation mechanism is proposed, based on the feedback from a peer who has exchanged information. A receiving peer could evaluate the reputation of the peer which provides information after information sharing is complete. Such evaluation is a reference for the future receiving peers when choosing the information exchangers. If the received information is useful and trustful, the receiving peer gives positive feedback to the providing peer. Gradually, the providing peer gets higher reputation and will have greater chance to be chosen. Based on the experiments, trustful information is more like to be exchanged and kept in the system. Peers have more chance to receive reliable information.