Sulaiman Mohd Nor

Performance of CSMA-CA MAC protocol for distributed radio local area networks

Carrier sense multiple access with collision avoidance (CSMA-CA) will be used as the basic medium access control (MAC) protocol for wireless LANs. Wireless LAN will be supporting two types of services, time bounded and asynchronous data transmission. In this paper we present simulation results for throughput and delays for a distributed radio LAN for different values of inter frame spacing periods, transmission speeds and number of nodes. Depending on the application, the results obtained suggest that proper inter frame space values have to be chosen for optimal network performance.

Detecting Worms Using Data Mining Techniques: Learning in the Presence of Class Noise

Worms are self-contained programs that spread over the Internet. Worms cause problems such as lost of information, information theft and denial-of-service attacks. The first part of the paper evaluates the detection of worms based on content classification by using all machine learning techniques available in WEKA data mining tools. Four most accurate and quite fast classifiers are identified for further analysis–Naive Bayes, J48, SMO and Winnow. Results show that classification using machine learning techniques could classify worms to 99% accuracy. From the accuracy perspective, J48 performs better than other algorithms meanwhile Naive Bayes and Winnow show the best performances in terms of speed. The second part of the paper analyzes the accuracy these four classifiers under the presence of class noise in learning corpora. By injecting class noise ranging between 0% and 50% into positive and negative corpora, results from the simulation show gradual decrease in accuracy and increase in false positive and false negative for all analyzed techniques. The presence of the classes noise affects false positive more significantly compared to false negative. The results show that worm detection with classification algorithms could not tolerate the presence of classes noise in learning corpora.

A Discrete Firefly Algorithm for Scheduling Jobs on Computational Grid

Computational grid emerged as a large scale distributed system to offer dynamic coordinated resources sharing and high performance computing. Due to the heterogeneity of grid resources scheduling jobs on computational grids is identified as NP-hard problem. This chapter introduces a job scheduling mechanism based on Discrete Firefly Algorithm (DFA) to map the grid jobs to available resources in order to finish the submitted jobs within a minimum makespan time. The proposed scheduling mechanism uses population based candidate solutions rather than single path solution as in traditional scheduling mechanism such as tabu search and hill climbing, which help avoids trapping in local optimum. We used simulation and real workload traces to evaluate the proposed scheduling mechanism. The simulation results of the proposed DFA scheduling mechanism are compared with Genetic Algorithm and Tabu Search scheduling mechanisms. The obtained results demonstrated that, the proposed DFA can avoid trapping in local optimal solutions and it could be efficiently utilized for scheduling jobs on computational grids. Furthermore, the results have shown that DFA outperforms the other scheduling mechanisms in the case of typical and heavy loads.

Stateless malware packet detection by incorporating naive bayes with known malware signatures

Malware detection done at the network infrastructure level is still an open research problem ,considering the evolution of malwares and high detection accuracy needed to detect these threats. Content based classification techniques have been proven capable of detecting malware without matching for malware signatures. However, the performance of the classification techniques depends on observed training samples. In this paper, a new detection method that incorporates Snort malware signatures into Naive Bayes model training is proposed. Through experimental work, we prove that the proposed work results in low features search space for effective detection at the packet level. This paper also demonstrates the viability of detecting malware at the stateless level (using packets) as well as at the stateful level (using TCP byte stream). The result shows that it is feasible to detect malware at the stateless level with similar accuracy to the stateful level, thus requiring minimal resource for implementation on middleboxes. Stateless detection can give a better protection to end users by detecting malware on middleboxes without having to reconstruct stateful sessions and before malwares reach the end users.

Optimizing job scheduling for computational grid based on firefly algorithm

Resources in grid systems are heterogeneous, geographically distributed, belong to different administrative domains and apply different management policies. The roles of job scheduling mechanisms are to identify, select and allocate the most suitable resources for a given set of jobs. This paper presents an intelligent metaheuristics method based on firefly algorithm, for scheduling jobs on grid computing. The proposed method is to dynamically create an optimal schedule to complete the jobs within minimum makespan. The simulation results illustrate that the proposed mechanism performed better than other scheduling mechanisms.

Network Worm Propagation Model Based on a Campus Network Topology

Propagating malwares have drawn significant attention as a result of their serious impact on the internet and the network security. Although the development of stochastic models of worm propagation has been on, but the real internet prevention mechanism have not been deployed in the network simulations. The real worm propagation cycle identifies the ways and means the worms exploit to spread themselves, it provides for real parameter modeling based on the campus environment topology. The paper considers some common practices and typical worm propagation and tries to analytically provide mathematical model based on improved SIR Two-Factor model for worm propagation on the campus network environment that will help in predicting and forecasting the trend.

Scheduling jobs on grid computing using firefly algorithm

Scheduling jobs on computational grids is identified as NP-complete problem due to the heterogeneity of resources; the resources belong to different administrative domains and apply different management policies. This paper presents a novel metaheuristics method based on Firefly Algorithm (FA) for scheduling jobs on grid computing. The proposed method is to dynamically create an optimal schedule to complete the jobs within minimum makespan. The proposed method is compared with other heuristic methods using simple and different simulation scenarios. Each firefly represents a candidate solution of the grid scheduling problem in a vector form, with n elements; where n is the number of jobs to be scheduled. Firefly[i] specifies the resource to which the job number i is allocated. Therefore, the vector values are natural numbers. Also we note that the vector values are the resource IDs and hence the resource ID may appear more than one time in the firefly vector. This comes about because more than one job may be allocated to the same resource. To evaluate the effectiveness and the efficiency of job scheduling algorithms on computational grid, it is difficult and impractical to achieve performance assessment experimentally in such large scale heterogeneous system and to repeat and control the experiments to perform different scenarios. To encounter this limitation this research used mathematical modeling and simulation to model and evaluate the proposed mechanism. The results demonstrated that, the firefly scheduling mechanism achieved less makespan time than Min-Min and Max- Min heuristics in several scheduling scenarios. The results in this paper showed that the FA is promising method that can be used to optimize scheduling jobs on grid computing.

Kohonen self organizing maps and expert system for blood classification

Information gathering in medicine generally follows a set of sequence: an interview with the patient, an examination, and one or more laboratory tests to support the working diagnosis. Building a knowledge base from observing a medical examination, however, is risky. Medical decision-making relies on imprecise information gathered in a variety of ways and interpreted in a largely intuitive fashion. This paper proposes a novel method that integrates neural network and expert system paradigms to produce an automated knowledge acquisition system. This system will produce symbolic knowledge from medical data automatically.

Incorporating known malware signatures to classify new malware variants in network traffic

Summary Content-based malware classification technique using n-gram features required high computational overhead because of the size of feature space. This paper proposes the augmentation of domain knowledge in the form of known Snort malware signatures to machine learning techniques to reduce resources (in terms of the time to generate machine learning model and the memory usage to store generative model). Although current malware can be encrypted or mutated, these malware still exhibit prevalent contents or payloads as their predecessors. Using a dataset of traffic captured from a campus network, our approach is able to reduce initial generated million n-gram features to only around 90000 features, which significantly reduces processing time to generate naive Bayes model by 95%. The generated model that has been trained by the most descriptive features (4-gram Snort signatures with high information gain) produces lower false negative, about 2% compared with other models. Moreover, the proposed method is capable of detecting 10 new malware variants with 0% false negative. The findings from this paper can be the basis for improving malware classification based on content classification to detect known and new malware. Copyright

Malware detection using augmented naive Bayes with domain knowledge and under presence of class noise

Malicious software (malware) attacks on the internet are on the rise in frequency and sophistication. Malware detection based on its content can detect malware more accurate because it relies on screening the payload for known malware signatures. New malware variants still exhibit prevalent contents that can be detected by looking at fixed substrings especially when using n-grams and machine learning technique. This paper focuses on detecting malware based on content classification technique that is augmented with domain knowledge (Snort signatures) to abridge features set and improve detection accuracy. Using 15 days dataset, the generated naive Bayes model with domain knowledge using the most descriptive 91,127 features shows the lowest false negative (around 2%). However, the presence of class noise has a significant impact on the results, even for machine learning technique augmented with domain knowledge.