Browsing by Author "Wang, Fu-Yu"

Now showing 1 - 4 of 4

Active versus Passive Malware Collection
(2014-04-01)
Lin, Ying-Dar
;
Lee, Chia-Yin
;
Wu, Yu-Sung
;
Ho, Pei-Hsiu
;
Wang, Fu-Yu
An exploration of active and passive malware honeypots reveals that the two systems yield vastly different malware collections and that peer-to-peer file sharing is an important, but often overlooked, malware source.
NAT-Compatibility Testbed: An Environment to Automatically Verify Direct Connection Rate
(2011-01-01)
Ho, Cheng-Yuan
;
Wang, Fu-Yu
;
Tseng, Chien-Chao
;
Lin, Ying-Dar
;
資訊工程學系
In this article, an NAT-compatibility testbed is designed to automatically conduct the repeated experiments, collect the test results, and verify the direct connection rate (DCR) of any NAT traversal programs. Achieving a high DCR is important because using relays may unnecessarily increase the bandwidth cost, processing load of the relay servers, and the end-to-end packet delay. The NAT-compatibility testbed is constructed with 4 components: two peers, an automatic execution mechanism, NAT devices, and signaling/intermediate servers such as STUN, TURN, and SIP. It is also called the fully meshed testbed because the test result of all NAT combinations is a square. It measures the DCR of ICE, KeyStone, and PJNATH as 53.7%, 59.87%, and 50.93%, respectively. Experimental results show that asymmetric and unexpected direct connectivity check results occur in the real Internet. In order to enhance NAT traversal capability, the findings, like "port prediction" and "call-role sensitivity problem," are also described in the experimental results.
Statistical Analysis of False Positives and False Negatives from Real Traffic with Intrusion Detection/Prevention Systems
(2012-03-01)
Ho, Cheng-Yuan
;
Lai, Yuan-Cheng
;
Chen, I-Wei
;
Wang, Fu-Yu
;
Tai, Wei-Hsuan
False positives and false negatives happen to every intrusion detection and intrusion prevention system. This work proposes a mechanism for false positive/negative assessment with multiple IDSs/IPSs to collect FP and FN cases from real-world traffic and statistically analyze these cases. Over a period of 16 months, more than 2000 FPs and FNs have been collected and analyzed. From the statistical analysis results, we obtain three interesting findings. First, more than 92.85 percent of false cases are FPs even if the numbers of attack types for FP and FN are similar. That is mainly because the behavior of applications or the format of the application content is self-defined; that is, there is not complete conformance to the specifications of RFCs. Accordingly, when this application meets an IDS/IPS with strict detection rules, its traffic will be regarded as malicious traffic, resulting in a lot of FPs. Second, about 91 percent of FP alerts, equal to about 85 percent of false cases, are not related to security issues, but to management policy. For example, some companies and campuses limit or forbid their employees and students from using peer-to-peer applications; therefore, in order to easily detect P2P traffic, an IDS/IPS is configured to be sensitive to it. Hence, this causes alerts to be triggered easily regardless of whether the P2P application has malicious traffic or not. The last finding shows that buffer overflow, SQL server attacks, and worm slammer attacks account for 93 percent of FNs, even though they are aged attacks. This indicates that these attacks always have new variations to evade IDS/IPS detection.
To Call or To Be Called Behind NATs is Sensitive in Solving the Direct Connection Problem
(2011-01-01)
Ho, Cheng-Yuan
;
Tseng, Chien-Chao
;
Wang, Fu-Yu
;
Wang, Jui-Tang
;
Lin, Ying-Dar
In this article, we first depict the call-role sensitivity problem in Network Address Translation (NAT) traversal, and then propose an approach to resolving the problem. The problem is whether a direct connection can be found between two peers across NATs mainly depends on the NAT type at the caller's side. We propose the extra-candidate connectivity check where both peers initiate a direct connectivity check to eliminate the effect of the call role. We have implemented the extra-candidate connectivity check and conducted experiments with 18 different NATs. Experimental results show that our approach can indeed resolve the call-role sensitivity problem, and maximize the direct connectivity rate (DCR) which is improved by 18.71% from the original scheme.