Search

Enterprise security is increasingly being threatened by social engineering attacks, such as phishing, which deceive employees into giving access to enterprise data. To protect both the users themselves and enterprise data, more and more organizations provide cyber security training that seeks to teach employees/customers to identify and report suspicious content. By its very nature, such training seeks to focus on signals that are likely to persist across a wide range of attacks. Further, it expects the user to apply the learnings from these training on e-mail messages that were not filtered by existing, automatic enterprise security (e.g., spam filters and commercial phishing detection software). However, relying on such training now shifts the detection of phishing from an automatic process to a human driven one which is fallible especially when a user errs due to distraction, forgetfulness, etc. In this work we explore treating this type of detection as a natural language processing task and modifying training pipelines accordingly. We present a dataset with annotated labels where these labels are created from the classes of signals that users are typically asked to identify in such training. We also present baseline classifier models trained on these classes of labels. With a comparative analysis of performance between human annotators and the models on these labels, we provide insights which can contribute to the improvement of the respective curricula for both machine and human training., Comment: 10 pages, 2 Tables, 1 figure

The Domain Name System (DNS) is part of critical internet infrastructure, as DNS is invoked whenever a remote server is accessed (an URL is visited, an API request is made, etc.) by any application. DNS queries are served in hierarchical manner, with most queries served locally from cached data, and a small fraction propagating to the top of the hierarchy - DNS root name servers. Our research aims to provide a comprehensive, longitudinal characterization of DNS queries received at B-Root over ten years. We sampled and analyzed a 28-billion-query large dataset from the ten annual Day in the Life of the Internet (DITL) experiments from 2013 through 2022. We sought to identify and quantify unexpected DNS queries, establish longitudinal trends, and compare our findings with published results of others. We found that unexpected query traffic increased from 39.57% in 2013 to 67.91% in 2022, with 36.55% of queries being priming queries. We also observed growth and decline of Chromium-initiated, random DNS queries. Finally, we analyzed the largest DNS query senders and established that most of their traffic consists of unexpected queries., Comment: 20 pages with 18 figures and 1 table. Published and presented at the 2022 IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT)

Network operators and system administrators are increasingly overwhelmed with incessant cyber-security threats ranging from malicious network reconnaissance to attacks such as distributed denial of service and data breaches. A large number of these attacks could be prevented if the network operators were better equipped with threat intelligence information that would allow them to block or throttle nefarious scanning activities. Network telescopes or "darknets" offer a unique window into observing Internet-wide scanners and other malicious entities, and they could offer early warning signals to operators that would be critical for infrastructure protection and/or attack mitigation. A network telescope consists of unused or "dark" IP spaces that serve no users, and solely passively observes any Internet traffic destined to the "telescope sensor" in an attempt to record ubiquitous network scanners, malware that forage for vulnerable devices, and other dubious activities. Hence, monitoring network telescopes for timely detection of coordinated and heavy scanning activities is an important, albeit challenging, task. The challenges mainly arise due to the non-stationarity and the dynamic nature of Internet traffic and, more importantly, the fact that one needs to monitor high-dimensional signals (e.g., all TCP/UDP ports) to search for "sparse" anomalies. We propose statistical methods to address both challenges in an efficient and "online" manner; our work is validated both with synthetic data as well as real-world data from a large network telescope.

YouTube is a popular video platform for sharing creative content and ideas, targeting different demographics. Adults, older children, and young children are all avid viewers of YouTube videos. Meanwhile, countless young-kid-oriented channels have produced numerous instructional and age appropriate videos for young children. However, inappropriate content for young children, such as violent or sexually suggestive content, still exists. And children lack the ability to decide whether a video is appropriate for them or not, which then causes a huge risk to children's mental health. Prior works have focused on identifying YouTube videos that are inappropriate for children. However, these works ignore that not only the actual video content influences children, but also the advertisements that are shown with those videos. In this paper, we quantify the influence of inappropriate advertisements on YouTube videos that are appropriate for young children to watch. We analyze the advertising patterns of 24.6 K diverse YouTube videos appropriate for young children. We find that 9.9% of the 4.6 K unique advertisements shown on these 24.6 K videos contain inappropriate content for young children. Moreover, we observe that 26.9% of all the 24.6 K appropriate videos include at least one ad that is inappropriate for young children. Additionally, we publicly release our datasets and provide recommendations about how to address this issue., Comment: In Proceedings of KDD Undergraduate Consortium (KDD-UC 2022)

Distributed Denial-of-Service (DDoS) attacks exhaust resources, leaving a server unavailable to legitimate clients. The Domain Name System (DNS) is a frequent target of DDoS attacks. Since DNS is a critical infrastructure service, protecting it from DoS is imperative. Many prior approaches have focused on specific filters or anti-spoofing techniques to protect generic services. DNS root nameservers are more challenging to protect, since they use fixed IP addresses, serve very diverse clients and requests, receive predominantly UDP traffic that can be spoofed, and must guarantee high quality of service. In this paper we propose a layered DDoS defense for DNS root nameservers. Our defense uses a library of defensive filters, which can be optimized for different attack types, with different levels of selectivity. We further propose a method that automatically and continuously evaluates and selects the best combination of filters throughout the attack. We show that this layered defense approach provides exceptional protection against all attack types using traces of ten real attacks from a DNS root nameserver. Our automated system can select the best defense within seconds and quickly reduces traffic to the server within a manageable range, while keeping collateral damage lower than 2%. We can handle millions of filtering rules without noticeable operational overhead., Comment: 9 pages, 3 figures

During the 2020 pandemic caused by the COVID-19 virus, many countries implemented stay-at-home measures, which led to many businesses and schools moving from in-person to online mode of operation. We analyze sampled Netflow records at a medium-sized US Regional Optical Network to quantify the changes in the network traffic due to stay-at-home measures in that region. We find that human-driven traffic in the network decreases to around 70%, and mostly shifts to local ISPs, while VPN and online meeting traffic increases up to 5 times. We also find that networks adopt a variety of online meeting solutions and favor one but continue using a few others. We find that educational and government institutions experience large traffic changes, but aim to keep their productivity via increased online meetings. Some scientific traffic also reduces possibly leading to loss of research productivity. Businesses mostly lose their traffic and few show VPN or online meeting activity. Most network prefixes experience large loss of live addresses but a handful increase their liveness. We also find increased incidence of network attacks. Our findings can help plan network provisioning and management to prepare for future possible infection outbreaks and natural disasters.

A central question surrounding possible human exploration of Mars is whether crewed missions can be supported by available technologies using in situ resources. Here, we show that photovoltaics-based power systems would be adequate and practical to sustain a crewed outpost for an extended period over a large fraction of the planet's surface. Climate data were integrated into a radiative transfer model to predict spectrally-resolved solar flux across the Martian surface. This informed detailed balance calculations for solar cell devices that identified optimal bandgap combinations for maximizing production capacity over a Martian year. We then quantified power systems, manufacturing, and agricultural demands for a six-person mission, which revealed that photovoltaics-based power generation would require <10 t of carry-along mass, outperforming alternatives over ~50% of Mars' surface., Comment: 5 pages, 4 figures, supplementary information

{\bf Purpose}: To develop a first principle and multi-scale model for normal tissue complication probability (NTCP) as a function of dose and LET for proton and in general for particle therapy with a goal of incorporating nano-scale radio-chemical to macro-scale cell biological pathways, spanning from initial DNA damage to tissue late effects. {\bf Methods}: The method is combination of analytical and multi-scale computational steps including (1) derivation of functional dependencies of NTCP on DNA driven cell lethality in nanometer and mapping to dose and LET in millimeter, and (2) 3D-surface fitting to Monte Carlo data set generated based on post radiation image change and gathered for a cohort of 14 pediatric patients treated by scanning beam of protons for ependymoma. We categorize voxel-based dose and LET associated with development of necrosis in NTCP. {\bf Result}: Our model fits well the clinical data, generated for post radiation tissue toxicity and necrosis. The fitting procedure results in extraction of in-{\it vivo} radio-biological $\alpha$-$\beta$ indices and their numerical values. {\bf Discussion and conclusion}: The NTCP model, explored in this work, allows to correlate the tissue toxicities to DNA initial damage, cell lethality and the properties and qualities of radiation, dose and LET., Comment: Accepted for publication in Medical Physics

In type A we find equivalences of geometries arising in three settings: Nakajima's (``framed'') quiver varieties, conjugacy classes of matrices and loop Grassmannians. These are now all given by explicit formulas. As an application we provide a geometric version of symmetric and skew $(GL(m), GL(n))$ dualities., Comment: Some of the results of this paper have appeared in arXiv:0712.4160. The new results are the explicit isomorphism of quiver varieties and loop Grassmannians and a much better understanding of the relation of loop Grassmannians and nilpotent cones. The paper has also been extensively rewritten

We have fundamentally corrected the proofs of the theorems from our paper [9] by giving an entirely different approach, using quite a simple method based on applications of some elementary inequalities, well-known H\"older's inequality, and the Gauchman $q$-restricted integral.

We construct for each choice of a quiver $Q$, a cohomology theory $A$ and a poset $P$ a "loop Grassmannian" $\mathcal{G}^P(Q,A)$. This generalizes loop Grassmannians of semisimple groups and the loop Grassmannians of based quadratic forms. The addition of a dilation torus $\mathcal{D}\subset\mathbb{G}_m^2$ gives a quantization $\mathcal{G}^P_\mathcal{D}(Q,A)$. The construction is motivated by the program of introducing an inner cohomology theory in algebraic geometry adequate for the Geometric Langlands program ['Some extensions of the notion of loop Grassmannians', Rad Hrvat. Akad. Znan. Umjet. Mat. Znan., the Mardesic issue. No. 532, (2017) 53--74.] and on the construction of affine quantum groups from generalized cohomologies ArXiv: 1708.01418., Comment: v2: 32 pages, an error in Section 3.5 corrected, more details added throughout