學術出版;;Publications

Permanent URI for this communityhdl:11536/1

收集所有交通大學研究人員與學生個人或團體所發表之各項學術著作，涵蓋期刊論文、教師專書、學位論文等項。;;Collections of Publications of NCTU Researchers and Students Like Journal Papers and Thesis.

Browse

🏛️國立陽明交通大學機構典藏

Search Results

Now showing 1 - 10 of 67

Secure and transparent network traffic replay, redirect, and relay in a dynamic malware analysis environment
(2014-03-01)
Lin, Ying-Dar
;
Shih, Tzung-Bi
;
Wu, Yu-Sung
;
Lai, Yuan-Cheng
;
資訊工程學系
Application Performance Profiling in Android Dalvik Virtual Machines
(2016-05-01)
Chang, Hung-Cheng
;
Chang, Kuei-Chung
;
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
資訊工程學系
Most Android applications are written in JAVA and run on a Dalvik virtual machine. For smartphone vendors and users who wish to know the performance of an application on a particular smartphone but cannot obtain the source code, we propose a new technique, Dalvik Profiler for Applications (DPA), to profile an Android application on a Dalvik virtual machine without the support of source code. Within a Dalvik virtual machine, we determine the entry and exit locations of a method, log its execution time, and analyze the log to determine the performance of the application. Our experimental results show an error ratio of less than 5% from the baseline tool Traceview which instruments source code. The results also show some interesting behaviors of applications and smartphones: the performance of some smartphones with higher hardware specifications is 1.5 times less than the phones with lower specifications. DPA is now publicly available as an open source tool.
Behavior-based botnet detection in parallel
(2014-11-01)
Wang, Kuochen
;
Huang, Chun-Ying
;
Tsai, Li-Yang
;
Lin, Ying-Dar
;
資訊工程學系
Botnet has become one major Internet security issue in recent years. Although signature-based solutions are accurate, it is not possible to detect bot variants in real-time. In this paper, we propose behavior-based botnet detection in parallel (BBDP). BBDP adopts a fuzzy pattern recognition approach to detect bots. It detects a bot based on anomaly behavior in domain name service (DNS) queries and transmission control protocol (TCP) requests. With the design objectives of being efficient and accurate, a bot is detected using the proposed five-stage process, including: (i) traffic reduction, which shrinks an input trace by deleting unnecessary packets; (ii) feature extraction, which extracts features from a shrunk trace; (iii) data partitioning, which divides features into smaller pieces; (iv) DNS detection phase, which detects bots based on DNS features; and (v) TCP detection phase, which detects bots based on TCP features. The detection phases, which consume approximately 90% of the total detection time, can be dispatched to multiple servers in parallel and make detection in real-time. The large scale experiments with the Windows Azure cloud service show that BBDP achieves a high true positive rate (95%+) and a low false positive rate (approximate to 3%). Meanwhile, experiments also show that the performance of BBDP can scale up linearly with the number of servers used to detect bots. Copyright (c) 2013 John Wiley & Sons, Ltd.
Three-phase behavior-based detection and classification of known and unknown malware
(2015-07-25)
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
Lu, Chun-Nan
;
Hsu, Peng-Kai
;
Lee, Chia-Yin
To improve both accuracy and efficiency in detecting known and even unknown malware, we propose a three-phase behavior-based malware detection and classification approach, with a faster detector in the first phase to filter most samples, a slower detector in the second phase to observe remaining ambiguous samples, and then a classifier in the third phase to recognize their malware type. The faster detector executes programs in a sandbox to extract representative behaviors fed into a trained artificial neural network to evaluate their maliciousness, whereas the slower detector extracts and matches the LCSs of system call sequences fed into a trained Bayesian model to calculate their maliciousness. In the third phase, we define malware behavior vectors and calculate the cosine similarity to classify the malware. The experimental results show that the hybrid two-phase detection scheme outperforms the one-phase schemes and achieves 3.6% in false negative and 6.8% in false positive. The third-phase classifier also distinguishes the known-type malware with an accuracy of 85.8%. Copyright (c) 2015 John Wiley & Sons, Ltd.
Stateful traffic replay for web application proxies
(2015-04-01)
Huang, Chun-Ying
;
Lin, Ying-Dar
;
Liao, Peng-Yu
;
Lai, Yuan-Cheng
;
資訊工程學系
It is a common practice to test a network device by replaying network traffic onto it and observe its reactions. Many replay tools support Transmission Control Protocol/Internet Protocol stateful traffic replay and hence can be used to test switches, routers, and gateway devices. However, they often fail if the device under test (DUT) is an application level proxy. In this paper, we design and implement ProxyReplay to replay application-layer traffic for network proxies. As many application proxies have built-in security functions, the main purpose of this tool is to evaluate the security functionalities of DUTs using payloads constructed from real network traces. ProxyReplay modifies requests and responses and maintains queues for request-response pairs to resolve the issues of protocol dependency, functional dependency, concurrent replay, and error resistance. The solution provides two replay modes, that is, the preprocess mode and the concurrent mode. Depending on the benchmark scenario, we show that the preprocess mode is better for benchmarking the performance capability of a DUT. In contrast, the concurrent mode is used when the replayed trace file is extremely large. Our experiments show 99% accuracy. In addition, the replay performance exceeds 320 Mbps by running the benchmark with an off-the-shelf personal computer in the preprocess mode. Copyright (C) 2014 John Wiley & Sons, Ltd.
Coded and Scalar Prefix Trees: Prefix Matching Using the Novel Idea of Double Relation Chains
(2011-06-01)
Behdadfar, Mohammad
;
Saidi, Hossein
;
Hashemi, Massoud Reza
;
Lin, Ying-Dar
;
資訊工程學系
In this paper, a model is introduced named double relation chains (DRC) based on ordered sets. It is proved that using DRC and special relationships among the members of an alphabet, vectors of this alphabet can be stored and searched in a tree. This idea is general; however, one special application of DRC is the longest prefix matching (LPM) problem in an IP network Applying the idea of DRC to the LPM problem makes the prefixes comparable like numbers using a pair of w-bit vectors to store at least one and at most w prefixes, where w is the IP address length. This leads to good compression performance. Based on this, two recently introduced structures called coded prefix trees and scalar prefix trees are shown to be specific applications of DRC. They are implementhble on balanced trees which cause the node access complexity for prefix search and update procedures to be O(log n) where n is the number of prefixes. As another advantage, the number of node accesses for these procedures does not depend on w. Additionally, they need fewer number of node accesses compared to recent range-based solutions. These structures are applicable on both IPv4 and IPv6, and can be implemented in software or hardware.
Software-Defined Networking: Standardization for Cloud Computing\'s Second Wave
(2014-11-01)
Lin, Ying-Dar
;
Pitt, Dan
;
Hausheer, David
;
Johnson, Erica
;
Lin, Yi-Bing
As cloud computing\'s second wave begins to transform the networking industry, a snapshot of developments in software-defined networking standardization suggests how its components-devices, controllers, applications, service chains, network function virtualization, and interfaces-are maturing.
MULTIHOP CELLULAR: FROM RESEARCH TO SYSTEMS, STANDARDS, AND APPLICATIONS
(2014-10-01)
Lin, Ying-Dar
;
Hsu, Yu-Ching
;
Chattterjee, Mainak
;
Kunz, Thomas
;
交大名義發表
Reducing power consumption in LTE data scheduling with the constraints of channel condition and QoS
(2014-12-24)
Tung, Li-Ping
;
Lin, Ying-Dar
;
Kuo, Yu-Hsien
;
Lai, Yuan-Cheng
;
Sivalingam, Krishna M.
3GPP has developed the Discontinuous Reception (DRX) power saving mechanism, which periodically turns off the radio interface to reduce the power consumption. However, packets cannot be received during the turn-off duration, as a result that the Quality of Services (QoS) may be violated. Therefore, optimal DRX parameters should be configured to satisfy QoS and minimize power consumption. In addition, channel condition may be unstable during the transmission, so the DRX parameters should also be dynamically adjusted. In this paper, we propose the Dynamic Scheduling with Extensible Allocation and Dispersed Offsets (DXD) scheme, which is composed of two algorithms, DRX parameters decision, to determine DRX period by considering channel condition and QoS constraints, and DRX-aware scheduling, to determine whether to extend the on duration so that QoS would not be affected by DRX. Simulation results demonstrate that the proposed DXD approach can reduce power consumption up to 96.7% compared to No-DRX scheme and guarantee QoS as good as No-DRX scheme. In addition, the power consumption can be reduced by 70.1% and 45.7% compared to the Fixed-DRX (100 ms), start-offset scheme and IS scheme in good channel condition. Our approach effectively reduces power consumption in varied channel conditions and high loading system and still achieves better delay satisfaction ratio than others. (C) 2014 Elsevier B.V. All rights reserved.
Deep Packet Inspection: Algorithms, Hardware, and Applications
(2014-10-01)
Lin, Ying-Dar
;
Lin, Po-Ching
;
Prasanna, Viktor K.
;
Chao, H. Jonathan
;
Lockwood, John W.

學術出版;;Publications

Browse

Filters

Settings

Sort By

Results per page

🏛️國立陽明交通大學機構典藏

Search Results