Hung Q. Ngo

Towards a theory of insider threat assessment

Insider attacks are a well-known problem acknowledged as a threat as early as 1980s. The threat is attributed to legitimate users who abuse their privileges, and given their familiarity and proximity to the computational environment, can easily cause significant damage or losses. Due to the lack of tools and techniques, security analysts do not correctly perceive the threat, and hence consider the attacks as unpreventable. In this paper, we present a theory of insider threat assessment. First, we describe a modeling methodology which captures several aspects of insider threat, and subsequently, show threat assessment methodologies to reveal possible attack strategies of an insider.

New constructions of non-adaptive and error-tolerance pooling designs

Abstract We propose two new classes of non-adaptive pooling designs. The first one is guaranteed to be d -error-detecting and thus ⌊d/2⌋ -error-correcting, where d , a positive integer, is the maximum number of defectives (or positives). Hence, the number of errors which can be detected grows linearly with the number of positives. Also, this construction induces a construction of a binary code with minimum Hamming distance of at least 2d+2 . The second design is the q -analogue of a known construction on d -disjunct matrices.

Skew strikes back: new developments in the theory of join algorithms

Evaluating the relational join is one of the central algorithmic and most well-studied problems in database systems. A staggering number of variants have been considered including Block-Nested loop join, Hash-Join, Grace, Sort-merge (see Grafe [17] for a survey, and [4, 7, 24] for discussions of more modern issues). Commercial database engines use finely tuned join heuristics that take into account a wide variety of factors including the selectivity of various predicates, memory, IO, etc. This study of join queries notwithstanding, the textbook description of join processing is suboptimal. This survey describes recent results on join algorithms that have provable worst-case optimality runtime guarantees. We survey recent work and provide a simpler and unified description of these algorithms that we hope is useful for theory-minded readers, algorithm designers, and systems implementors. Much of this progress can be understood by thinking about a simple join evaluation problem that we illustrate with the so-called triangle query, a query that has become increasingly popular in the last decade with the advent of social networks, biological motifs, and graph databases [36, 37]

CQMP: a mesh-based multicast routing protocol with consolidated query packets

We propose a mesh-based multicast routing protocol for wireless ad hoc networks. The protocol retains all of the advantages of the on-demand multicast routing protocol (ODMRP) such as high packet delivery ratio under high mobility, high throughput. Moreover, the protocol significantly reduces control overhead, one of the main weaknesses of ODMRP, under the presence of multiple sources. This feature is a crucial contributing factor to the scalability of multicast routing for mobile ad hoc networks. The results are experimentally verified. It is shown that in the presence of high number of sources, our protocol reduces the control packet load by up to 30 percent, increases the multicast efficiency by 10 to 20 percent and improves the data delivery ratio of ODMRP.

On the effectiveness of structural detection and defense against P2P-based botnets

Recently, peer-to-peer (P2P) networks have emerged as a covert communication platform for malicious programs known as bots. As popular distributed systems, they allow bots to communicate easily while protecting the botmaster from being discovered. Existing work on P2P-based botnets mainly focuses on measurement-based studies of botnet behaviors. In this work, through simulation, we study extensively the structure of P2P networks running Kademlia, one of a few widely used P2P protocols in practice. Our simulation testbed not only incorporates the actual code of a real Kademlia client software to achieve high realism, but also applies distributed event-driven simulation techniques to achieve high scalability. Using this testbed, we analyze the scaling, clustering, reachability, and various centrality properties of P2P-based botnets from a graph-theoretical perspective. We further demonstrate experimentally and theoretically that monitoring bot activities in a P2P network is difficult, suggesting that the P2P mechanism indeed helps botnets hide their communication effectively. Finally, we evaluate the effectiveness of some potential mitigation techniques, such as content poisoning, sybil-based and eclipse-based mitigation. Conclusions drawn from this work shed light on the structure of P2P botnets, how to monitor bot activities in P2P networks, and how to mitigate botnet operations effectively.

Constructions and analyses of nonblocking WDM switches based on arrayed waveguide grating and limited wavelength conversion

Constructing fast wavelength division multiplexing switches with cheap, integratable components, less power consumption and noise accumulation, and low complexity is an important problem in optical networking. Typically, there are two request models widely considered. In one model, a connection request asks to go from a wavelength on an input fiber of the WDM switch to a particular wavelength on an output fiber. In the other, a connection only needs to get to a particular output fiber, irrespective of what wavelength it will be on. In this paper, we give novel constructions of strictly nonblocking and rearrangeably nonblocking WDM switches for both request models using limited range wavelength converters and arrayed waveguide grating routers. We fully analyze their blocking characteristics. Our designs are all relatively simple and easy to be laid out, consume little power, do not accumulate much noise, and are useful for both optical circuit-switching and optical packet/burst switching. As far as we know, these are the first of such constructions.

Nonblocking WDM switches based on arrayed waveguide grating and limited wavelength conversion

Constructing fast wavelength division multiplexing switches with cheap, integratable components, less power consumption and noise accumulation, and low complexity is an important problem in optical networking. Typically, there are two request models widely considered. In one model, a connection request asks to go from a wavelength on an input fiber of the WDM switch to a particular wavelength on an output fiber. In the other, a connection only needs to get to a particular output fiber, irrespective of what wavelength it will be on. In this paper, we give novel constructions of strictly nonblocking and rearrangeably nonblocking WDM switches for both request models using limited range wavelength converters and arrayed waveguide grating routers. We fully analyze their blocking characteristics. Our designs are all relatively simple and easy to be laid out, consume little power, do not accumulate much noise, and are useful for both optical circuit-switching and optical packet/burst switching. As far as we know, these are the first of such constructions.

Optical switching networks with minimum number of limited-range wavelength converters

We study the problem of determining the minimum number of limited-range wavelength converters needed to construct strictly, wide-sense, and rearrangeably nonblocking optical cross-connects for both unicast and multicast traffic patterns. We give the exact formula to compute this number for rearrangeably and wide-sense nonblocking cross-connects under both the unicast and multicast cases. We also give optimal cross-connect constructions with respect to the number of limited-range wavelength converters.

Insider Threat Analysis Using Information-Centric Modeling

Capability acquisition graphs (CAGs) provide a powerful framework for modeling insider threats, network attacks and system vulnerabilities. However, CAG-based security modeling systems have yet to be deployed in practice. This paper demonstrates the feasibility of applying CAGs to insider threat analysis. In particular, it describes the design and operation of an information-centric, graphics-oriented tool called ICMAP. ICMAP enables an analyst without any theoretical background to apply CAGs to answer security questions about vulnerabilities and likely attack scenarios, as well as to monitor network nodes. This functionality makes the tool very useful for attack attribution and forensics.

New bounds on a hypercube coloring problem

In studying the scalability of optical networks, one problem which arises involves coloring the vertices of the n-cube with as few colors as possible such that any two vertices whose Hamming distance is at most k are colored differently. Determining the exact value of χ??(n), the minimum number of colors needed, appears to be a difficult problem. In this note, we improve the known lower and upper bounds of χ??(n) and indicate the connection of this coloring problem to linear codes.