Search

Intrusion detection systems (IDS) are systems aimed at analyzing and detecting security problems. The IDS may be structured into misuse and anomaly detection. The former are often signature/rule IDS that detect malicious software by inspecting the content of packets or files looking for a 'signature' labeling malware. They are often very efficient, but their drawback stands in the weakness of the information to check (eg, the signature), which may be quickly dated, and in the computation time because each packet or file needs to be inspected. The IDS based on anomaly detection and, in particular, on statistical analysis have been originated to bypass the mentioned problems. Instead of inspecting packets, each traffic flow is observed so getting a statistical characterization, which represents the fingerprint of the flow. This paper introduces a statistical analysis based intrusion detection system, which, after extracting the statistical fingerprint, uses machine learning classifiers to decide whether a flow is affected by malware or not. A large set of tests is presented. The obtained results allow selecting the best classifiers and show the performance of a decision maker that exploits the decisions of a bank of classifiers acting in parallel. [ABSTRACT FROM AUTHOR]

The role of the Internet is continuously increasing and many technical, commercial, and business transactions are carried out by a multitude of users who exploit a set of specialized/sophisticated network applications. In this context, the task of network monitoring and surveillance is gaining great relevance and honeypots represent promising tools to get information, and understanding about the 'areas of interests' of attackers, as well as about the possible relations among 'blackhat' teams. The paper presents and discusses the results achieved by a group of honeypots deployed within the networks of the Department of Communication, Computer and System Science at the University of Genoa. The collected statistics, measured over 4-month long period, reveal that approximately 10 000 different attackers, coming from 130 different countries, have 'contacted' the honeypot system and that about 60 000 TCP distinct connections have logged in. Our high-interaction honeypot has counted more than 25 000 attempts to access a ssh server, thus permitting to trace many attempts to install rootkits. A comparison with results obtained by similar researches carried out in other laboratories is presented and commented. Copyright © 2010 John Wiley & Sons, Ltd. The paper presents a honeypot system deployed within the network of the Department of Communication, Computer and System Science at the University of Genoa, Italy, in order to trace and understand the nature and the goals of the attacks coming from the Internet. Specifically, the group of honeypots has allowed collecting 10 000 different attackers, coming from 130 different countries through an observation period of 4 months. Moreover, the high interaction honeypot has revealed more than 25000 attempts to access a ssh server, many of them aimed at installing rootkits. Finally, a comparison with the results achieved by similar researches carried out in other laboratories is presented and discussed. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

The rapid growth of network infrastructures and the large availability of instrumentation supporting remote control have encouraged the deployment of complex and sophisticated laboratories and the design of software platforms for accessing the resources present there. Although the market offers several solutions to remotely manage equipment, little attention has been paid to the hardware and software architectures devoted to control distance learning experimental environments and to manage laboratories consisting of heterogeneous devices. The paper illustrates the architectural approach adopted within the LABNET project and describes in detail the main software components of the devised platform, which allows to exploit the instrumentation via a common Web user interface, thus making the system available independent of any specific (commercial) environment or application. Specifically, attention is focused on the LABNET server (LNS), which represents the supervising central unit and, therefore, a very critical element of the system. The paper mainly points out the architecture and protocols at the basis of the LNS and discusses a set of performance tests aimed at proving the effectiveness of the system and comparing it with a well-known commercial solution. Copyright © 2007 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

The Virtual Immersive Learning (VIL) test bench implements a virtual collaborative immersive environment, capable of integrating natural contexts and typical gestures, which may occur during traditional lectures, enhanced with advanced experimental sessions. The system architecture is described, along with the motivations, and the most significant choices, both hardware and software, adopted for its implementation. The novelty of the approach essentially relies on its capability of embedding functionalities that stem from various research results (mainly carried out within the VICOM national project), and "putting the pieces together" in a well-integrated framework. These features, along with its high portability, good flexibility, and, above all, low cost, make this approach appropriate for educational and training purposes, mainly concerning measurements on telecommunication systems, at universities and research centers, as well as enterprises. Moreover, the methodology can be employed for remote access to and sharing of costly measurement equipment in many different activities. The immersive characteristics of the framework are illustrated, along with performance measurements related to a specific application. [ABSTRACT FROM AUTHOR]

The increasing interest in systems able to provide users with immersive services (e.g., domotics, context-aware applications, and immersive distance learning tools) has encouraged the development of cheap and effective platforms aimed at tracking objects and people within a certain space. In this context, wireless sensor networks (WSNs) can play a very important role, since specialized sensors can be fruitfully exploited in order to generate/receive signals by means of which theWSN can derive the position of nodes joined to the objects to be tracked. The paper presents an original localization platform that exploits a single-hop WSN, based on a Microchip MCU and a Cypress RF device, to track its moving nodes. Specifically, the nodes of the network are divided into three sets: the first set consists of anchor nodes that, according to the commands from the sink (the central node of the WSN), generate ultrasonic pulses. These pulses are received by the second set of (moving) nodes, which estimate the pulse time trip and communicate it to the sink. Finally, the last set is constituted by general purpose nodes that collect any kind of data from the surrounding field. The sink gathers all the data, computes the position of moving nodes, and transfers information to external users on the Internet. The algorithms adopted to manage the network and to localize moving nodes are discussed. A working prototype based upon the hardware platform, software, and protocol described in this paper has been deployed and tested, and some results are shown. Simulation results of the localization system are presented to show system scalability. [ABSTRACT FROM AUTHOR]