學術出版;;Publications

Permanent URI for this communityhdl:11536/1

收集所有交通大學研究人員與學生個人或團體所發表之各項學術著作，涵蓋期刊論文、教師專書、學位論文等項。;;Collections of Publications of NCTU Researchers and Students Like Journal Papers and Thesis.

Browse

🏛️國立陽明交通大學機構典藏

Search Results

Now showing 1 - 10 of 42

Secure and transparent network traffic replay, redirect, and relay in a dynamic malware analysis environment
(2014-03-01)
Lin, Ying-Dar
;
Shih, Tzung-Bi
;
Wu, Yu-Sung
;
Lai, Yuan-Cheng
;
資訊工程學系
Application Performance Profiling in Android Dalvik Virtual Machines
(2016-05-01)
Chang, Hung-Cheng
;
Chang, Kuei-Chung
;
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
資訊工程學系
Most Android applications are written in JAVA and run on a Dalvik virtual machine. For smartphone vendors and users who wish to know the performance of an application on a particular smartphone but cannot obtain the source code, we propose a new technique, Dalvik Profiler for Applications (DPA), to profile an Android application on a Dalvik virtual machine without the support of source code. Within a Dalvik virtual machine, we determine the entry and exit locations of a method, log its execution time, and analyze the log to determine the performance of the application. Our experimental results show an error ratio of less than 5% from the baseline tool Traceview which instruments source code. The results also show some interesting behaviors of applications and smartphones: the performance of some smartphones with higher hardware specifications is 1.5 times less than the phones with lower specifications. DPA is now publicly available as an open source tool.
Three-phase behavior-based detection and classification of known and unknown malware
(2015-07-25)
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
Lu, Chun-Nan
;
Hsu, Peng-Kai
;
Lee, Chia-Yin
To improve both accuracy and efficiency in detecting known and even unknown malware, we propose a three-phase behavior-based malware detection and classification approach, with a faster detector in the first phase to filter most samples, a slower detector in the second phase to observe remaining ambiguous samples, and then a classifier in the third phase to recognize their malware type. The faster detector executes programs in a sandbox to extract representative behaviors fed into a trained artificial neural network to evaluate their maliciousness, whereas the slower detector extracts and matches the LCSs of system call sequences fed into a trained Bayesian model to calculate their maliciousness. In the third phase, we define malware behavior vectors and calculate the cosine similarity to classify the malware. The experimental results show that the hybrid two-phase detection scheme outperforms the one-phase schemes and achieves 3.6% in false negative and 6.8% in false positive. The third-phase classifier also distinguishes the known-type malware with an accuracy of 85.8%. Copyright (c) 2015 John Wiley & Sons, Ltd.
Stateful traffic replay for web application proxies
(2015-04-01)
Huang, Chun-Ying
;
Lin, Ying-Dar
;
Liao, Peng-Yu
;
Lai, Yuan-Cheng
;
資訊工程學系
It is a common practice to test a network device by replaying network traffic onto it and observe its reactions. Many replay tools support Transmission Control Protocol/Internet Protocol stateful traffic replay and hence can be used to test switches, routers, and gateway devices. However, they often fail if the device under test (DUT) is an application level proxy. In this paper, we design and implement ProxyReplay to replay application-layer traffic for network proxies. As many application proxies have built-in security functions, the main purpose of this tool is to evaluate the security functionalities of DUTs using payloads constructed from real network traces. ProxyReplay modifies requests and responses and maintains queues for request-response pairs to resolve the issues of protocol dependency, functional dependency, concurrent replay, and error resistance. The solution provides two replay modes, that is, the preprocess mode and the concurrent mode. Depending on the benchmark scenario, we show that the preprocess mode is better for benchmarking the performance capability of a DUT. In contrast, the concurrent mode is used when the replayed trace file is extremely large. Our experiments show 99% accuracy. In addition, the replay performance exceeds 320 Mbps by running the benchmark with an off-the-shelf personal computer in the preprocess mode. Copyright (C) 2014 John Wiley & Sons, Ltd.
Reducing power consumption in LTE data scheduling with the constraints of channel condition and QoS
(2014-12-24)
Tung, Li-Ping
;
Lin, Ying-Dar
;
Kuo, Yu-Hsien
;
Lai, Yuan-Cheng
;
Sivalingam, Krishna M.
3GPP has developed the Discontinuous Reception (DRX) power saving mechanism, which periodically turns off the radio interface to reduce the power consumption. However, packets cannot be received during the turn-off duration, as a result that the Quality of Services (QoS) may be violated. Therefore, optimal DRX parameters should be configured to satisfy QoS and minimize power consumption. In addition, channel condition may be unstable during the transmission, so the DRX parameters should also be dynamically adjusted. In this paper, we propose the Dynamic Scheduling with Extensible Allocation and Dispersed Offsets (DXD) scheme, which is composed of two algorithms, DRX parameters decision, to determine DRX period by considering channel condition and QoS constraints, and DRX-aware scheduling, to determine whether to extend the on duration so that QoS would not be affected by DRX. Simulation results demonstrate that the proposed DXD approach can reduce power consumption up to 96.7% compared to No-DRX scheme and guarantee QoS as good as No-DRX scheme. In addition, the power consumption can be reduced by 70.1% and 45.7% compared to the Fixed-DRX (100 ms), start-offset scheme and IS scheme in good channel condition. Our approach effectively reduces power consumption in varied channel conditions and high loading system and still achieves better delay satisfaction ratio than others. (C) 2014 Elsevier B.V. All rights reserved.
Apparatus, system and method for stream-based data filtering
(2008-01-03)
Lin, Po-Ching
;
Lin, Ying-Dar
;
Chen, Szu-Hao
;
Lai, Yuan-Cheng
An apparatus, a system and a method for stream-based data filtering are disclosed. The apparatus is for filtering data transmitted from a sending end. The data is transmitted one by one by using a plurality of data segments. The data filtering apparatus includes a receiving module, a processing module and a transmission module. The receiving module is for receiving the data segments transmitted from the sending end. The processing module implements virus scanning for the data segments one by one. The transmission module then transmits the data segments which have passed through the virus scanning to a receiving end.
String Matching System and Method Using Bloom Filters to Achieve Sub-Linear Computation Time
(2008-05-15)
Lin, Po-Ching
;
Lin, Ying-Dar
;
Zheng, Yi-Jun
;
Lai, Yuan-Cheng
A string matching system includes a text string, a plurality of patterns, an m-byte search window and a plurality of Bloom filters, wherein the m-byte search window stands for an m-byte sub-string in the text string under inspection. Every Bloom filter comprises sub-strings of a plurality of patterns. These Bloom filters are queried for membership of the rightmost block in the search window to determine the shift length. The acceleration efficiency of matching many bytes can be achieved simultaneously by shifting the search window for many bytes. Meanwhile, the patterns are stored into an embedded memory through a memory-efficient mechanism-the Bloom filter.
IDENTIFICATION AND ADMINISTRATION SYSTEM APPLIED TO PEER-TO-PEER GATEWAY AND METHOD FOR THE SAME
(2008-06-12)
LIN, Po-Ching
;
Tsai, Meng-Fu
;
Chang, Tsao-Jiang
;
Lin, Ying-Dar
;
Lai, Yuan-Cheng
An identification and administration system applied to P2P gateway and a method for the same are proposed. The system is installed in a kernel space, and a plug-in kernel module is in the kernel space to finish preprocessing and application processing of packets on the kernel space without the need of copying data to the user space for processing. Moreover, a connection cache is provided in the kernel space to process source/destination IP addresses, connection ports and protocol identifiers of all packets to recognize and then block identical request packets in reconnections. Therefore, the throughput of content-level security gateway can be increased, and the processing efficiency of packets can also be enhanced.
Utilizing Multiple Channels With Fewer Radios in Wireless Mesh Networks
(2011-01-01)
Ku, Chia-Yu
;
Lin, Ying-Dar
;
Tsao, Shiao-Li (Charles)
;
Lai, Yuan-Cheng
;
交大名義發表
Wireless mesh networking (WMN) is regarded as a low-cost technology for rapid wireless network deployment. However, in a single-channel WMN, the overlapped transmission ranges between relaying mesh points could introduce serious interference. Using multiple radios over multiple channels can decrease the interference and improve the capacity of a WMN, but it increases the cost of a mesh point. One possible solution to balance between interference, hence performance, and cost is utilizing fewer radios that switch among multiple channels instead of using per-channel radios. In this paper, we propose a channel-switching method, called the traffic-aware switching scheme (TRASS), for a mesh point with a limited number of radios. TRASS utilizes the existing IEEE 802.11 mechanisms, i.e., hybrid-coordination-function-controlled channel access and power saving, to avoid packet loss during channel switching. A TRASS mesh point monitors the occupied channel time to schedule radios that switch among channels. The implemented TRASS demonstrates 75% throughput improvement by (2, 1), i.e., two-channel single-radio, over (1, 1). (3, 2) and (3, 1) achieve 69.8% and 39.7%, respectively, of the throughput of (3, 3) in the simulated TRASS.
Calibrating parameters and formulas for process-level energy consumption profiling in smartphones
(2014-09-01)
Lin, Ying-Dar
;
Rattagan, Ekarat
;
Lai, Yuan-Cheng
;
Chang, Li-Pin
;
Yo, Yun-Chien
Battery-powered mobile devices substantially constrain energy resources. Process-level energy profiling tools can identify the most energy-consuming process and detail the energy usage of hardware components. With the help of energy profiling tools, programmers can fine-tune the energy consumption of processes to extend battery lifetime. However, profiling tools are highly dependent on hardware and must be calibrated for each hardware platform. Furthermore, for any new hardware components, new energy estimation formulas must be created. To solve these two problems regarding off-the-shelf products, this work proposes a two-phase calibrating approach. The first phase reconstructs the power table with a power meter, while the second creates new energy estimation formulas using linear regression analysis. The accuracy of the calibrated tool was evaluated in five scenarios and its error ratio is proven to be below 10%, occasionally less than 5%. Hence, this proposed approach to energy consumption profiling represents a major step in off-the-shelf devices. (C) 2014 Elsevier Ltd. All rights reserved.

學術出版;;Publications

Browse

Filters

Settings

Sort By

Results per page

🏛️國立陽明交通大學機構典藏

Search Results