Sudip Saha

DNS for Massive-Scale Command and Control

Attackers, in particular botnet controllers, use stealthy messaging systems to set up large-scale command and control. To systematically understand the potential capability of attackers, we investigate the feasibility of using domain name service (DNS) as a stealthy botnet command-and-control channel. We describe and quantitatively analyze several techniques that can be used to effectively hide malicious DNS activities at the network level. Our experimental evaluation makes use of a two-month-long 4.6-GB campus network data set and 1 million domain names obtained from >alexa.com. We conclude that the DNS-based stealthy command-and-control channel (in particular, the codeword mode) can be very powerful for attackers, showing the need for further research by defenders in this direction. The statistical analysis of DNS payload as a countermeasure has practical limitations inhibiting its large-scale deployment.

Modeling the interaction between emergency communications and behavior in the aftermath of a disaster

We describe results from a computer simulation-based study of a large-scale, human-initiated crisis in a densely populated urban setting. We focus on the interaction between human behavior and the communication infrastructure in the aftermath of the crisis. We study the effects of sending emergency broadcasts immediately after the event, advising people to shelter in place, and show that this relatively mild intervention can have a large beneficial impact.

Integrated Multi-Network Modeling Environment for Spectrum Management

We describe a first principles based integrated modeling environment to study urban socio-communication networks which represent not just the physical cellular communication network, but also urban populations carrying digital devices interacting with the cellular network. The modeling environment is designed specifically to understand spectrum demand and dynamic cellular network traffic. One of its key features is its ability to support individual-based models at highly resolved spatial and temporal scales. We have instantiated the modeling environment by developing detailed models of population mobility, device ownership, calling patterns and call network. By composing these models using an appropriate in-built workflow, we obtain an integrated model that represents a dynamic socio-communication network for an entire urban region. In contrast with earlier papers that typically use proprietary data, these models use open source and commercial data sets. The dynamic model represents for a normative day, every individual in an entire region, with detailed demographics, a minute-by-minute schedule of each persons activities, the locations where these activities take place, and calling behavior of every individual. As an illustration of the applicability of the modeling environment, we have developed such a dynamic model for Portland, Oregon comprising of approximately 1.6 million individuals. We highlight the unique features of the models and the modeling environment by describing three realistic case studies.

Human Initiated Cascading Failures in Societal Infrastructures

In this paper, we conduct a systematic study of human-initiated cascading failures in three critical inter-dependent societal infrastructures due to behavioral adaptations in response to a crisis. We focus on three closely coupled socio-technical networks here: (i) cellular and mesh networks, (ii) transportation networks and (iii) mobile call networks. In crises, changes in individual behaviors lead to altered travel, activity and calling patterns, which influence the transport network and the loads on wireless networks. The interaction between these systems and their co-evolution poses significant technical challenges for representing and reasoning about these systems. In contrast to system dynamics models for studying these interacting infrastructures, we develop interaction-based models in which individuals and infrastructure elements are represented in detail and are placed in a common geographic coordinate system. Using the detailed representation, we study the impact of a chemical plume that has been released in a densely populated urban region. Authorities order evacuation of the affected area, and this leads to individual behavioral adaptation wherein individuals drop their scheduled activities and drive to home or pre-specified evacuation shelters as appropriate. They also revise their calling behavior to communicate and coordinate among family members. These two behavioral adaptations cause flash-congestion in the urban transport network and the wireless network. The problem is exacerbated with a few, already occurring, road closures. We analyze how extended periods of unanticipated road congestion can result in failure of infrastructures, starting with the servicing base stations in the congested area. A sensitivity analysis on the compliance rate of evacuees shows non-intuitive effect on the spatial distribution of people and on the loading of the base stations. For example, an evacuation compliance rate of 70% results in higher number of overloaded base stations than the evacuation compliance rate of 90%.

Near-Optimal Algorithms for Controlling Propagation at Group Scale on Networks

Given a network with groups, such as a contact-network grouped by ages, which are the best groups to immunize to control the epidemic? Equivalently, how to choose best communities in social media like Facebook to stop rumors from spreading? Immunization is an important problem in multiple different domains like epidemiology, public health, cyber security, and social media. Additionally, clearly immunization at group scale (like schools and communities) is more realistic due to constraints in implementations and compliance (e.g., it is hard to ensure specific individuals take the adequate vaccine). Hence, efficient algorithms for such a “group-based” problem can help public-health experts take more practical decisions. However, most prior work has looked into individual-scale immunization. In this paper, we study the problem of controlling propagation at group scale. We formulate a set of novel Group Immunization problems for multiple natural settings (for both threshold and cascade-based contagion models under both node-level and edge-level interventions) and develop multiple efficient algorithms, including provably approximate solutions. Finally, we show the effectiveness of our methods via extensive experiments on real and synthetic datasets.

Planning and response in the aftermath of a large crisis: an agent-based informatics framework

We present a synthetic information and modeling environment that can allow policy makers to study various counter-factual experiments in the event of a large human-initiated crisis. The specific scenario we consider is a ground detonation caused by an improvised nuclear device in a large urban region. In contrast to earlier work in this area that focuses largely on the prompt effects on human health and injury, we focus on co-evolution of individual and collective behavior and its interaction with the differentially damaged infrastructure. This allows us to study short term secondary and tertiary effects. The present environment is suitable for studying the dynamical outcomes over a two week period after the initial blast. A novel computing and data processing architecture is described; the architecture allows us to represent multiple co-evolving infrastructures and social networks at a highly resolved temporal, spatial, and individual scale. The representation allows us to study the emergent behavior of individuals as well as specific strategies to reduce casualties and injuries that exploit the spatial and temporal nature of the secondary and tertiary effects. A number of important conclusions are obtained using the modeling environment. For example, the studies decisively show that deploying ad hoc communication networks to reach individuals in the affected area is likely to have a significant impact on the overall casualties and injuries.

Modeling cellular network traffic with mobile call graph constraints

The design, analysis and evaluation of protocols in cellular and hybrid networks requires realistic traffic modeling, since the underlying mobility and traffic model has a significant impact on the performance. We present a unified framework involving constrained temporal graphs that incorporate a variety of spatial, homophily and call-graph constraints into the network traffic model. The specific classes of constraints include bounds on the number of calls in given spatial regions, specific homophily relations between callers and callees, and the indegree and outdegree distributions of the call graph, for the whole time duration and intervals. Our framework allows us to capture a variety of complex behavioral adaptations and study their impacts on the network traffic. We illustrate this by a case study showing the impact of different homophily relations on the spatial and temporal characteristics of network traffic as well as the structure of the call graphs.

Impact of geographic complementarity in dynamic spectrum access

This research examines the impact of demand bids which account for geographic complementarity in spectrum demand, on the allocation and pricing of wireless spectrum licenses. Using an individual based simulation environment and a model of spectrum demand for the region of Portland, OR, we study a primary market to allocate spectrum licenses to wireless service providers. A truthful and efficient market clearing mechanism is used to sell the available licenses. A demand estimation model creates spatial and temporal demand estimates for each of the service providers. A valuation system determines the marginal value of each license which is further used in the bidding process. Three different scenarios are considered. First, the entire city of Portland is considered as one region and the estimated demand for this region is used to construct bids. The auction determines the clearing price for each license and the winner of the licenses based on the marginal valuations. After the market clearing is done and license allocations are made, we measure the total cost of licenses to the providers, the amount of unused capacity, and the number of unserved calls. In the second scenario, the city is divided into 2 regions in such a way that the number of call pairs are minimized across regions. Each region is auctioned separately. The providers can now decide their valuations sequentially for each region, so that they can use information on the allocations of the first region to optimally bid in the second region. The same set of measurements are taken again to understand the social impact of this scenario in comparison to the fist one. Finally a third scenario is run which is just like the second scenario but the city is now split into 2 regions in such a way that the call density and population is split evenly between regions. Results from the three scenarios are compared and analyzed to determine the impact of geographically complementary demand bids on the social cost and capacity used.

Analysis of policy instruments for enhanced competition in spectrum auction

Market based spectrum allocation should be competitive and economically efficient to effectively use the spectrum. Yet infrastructure markets have a tendency to become natural monopolies or oligopoly due to the high fixed costs and inherent economies of scale. Instruments such as set-asides, bidding credits, spectrum caps, band plan and auction designs are some of the market-based solutions that can enhance competition by incentivizing new entrants in these types of markets. In this paper, we focus on the “set-aside” instrument and study its role as a policy instrument to promote competition and encourage entry of new enterprenuers. The experimental results show that “set-aside” can be a powerful instrument and its impact depends upon the number of licenses that are set-aside versus the number of new entrants in the market as well as the level of competitiveness of the new entrants. We use a three factorial experimental design and find that contrary to our expectation, the total revenue generated by FCC does not necessarily decrease by having set-asides. As the number of new entrants increase and the set-asides decrease, the average total revenue raised through the sale of licenses can be more than the base case.

Quantifying mixed uncertainties in cyber attacker payoffs

Representation and propagation of uncertainty in cyber attacker payoffs is a key aspect of security games. Past research has primarily focused on representing the defenders beliefs about attacker payoffs as point utility estimates. More recently, within the physical security domain, attacker payoff uncertainties have been represented as Uniform and Gaussian probability distributions, and intervals. Within cyber-settings, continuous probability distributions may still be appropriate for addressing statistical (aleatory) uncertainties where the defender may assume that the attackers payoffs differ over time. However, systematic (epistemic) uncertainties may exist, where the defender may not have sufficient knowledge or there is insufficient information about the attackers payoff generation mechanism. Such epistemic uncertainties are more suitably represented as probability boxes with intervals. In this study, we explore the mathematical treatment of such mixed payoff uncertainties.