Conference Papers
Permanent URI for this collectionhttps://idr.nitk.ac.in/handle/123456789/28506
Browse
39 results
Search Results
Item An applicability of AODV and OLSR protocols on IEEE 802. 11p for city road in VANET(Springer Verlag service@springer.de, 2015) Jaiswal, R.K.; Jaidhar, C.D.Vehicular Ad-hoc Network (VANET) improves, makes more safe and comfortable road transportation by using vehicular communication and the Internet. VANET is the subset of Mobile Ad-hoc Network (MANET). Thus, due to their similar characteristics, MANET routing protocols may also be applicable into VANET. Hence, the performance of MANET routing protocols should be evaluated only on IEEE 802. 11p communication standard, which is specifically designed for VANET communication, with urban and non-urban vehicular traffic. This work compares the performance of Ad-hoc On-Demand Distance Vector (AODV) routing protocol with Optimized Link State Routing protocol (OLSR) on two different road network scenarios, particularly a complex road network, which represents the city road network, having multiple crossroad and an intersection of two roads. We used two distinct simulators such as Vehicular Ad-hoc Networks Mobility Simulator (VANETMOBISIM), to simulate the city road network and vehicular traffic in an area of 700mx700m and NS-2. 35 network simulator to simulate the communication network. AODV and OLSR performances are assessed on different transmission range, i. e. 250m and 500m with four different data generation rate of 512, 1024, 1536 and 2048 Kbps. The primary goal of this work is to do an assessment to scrutinize the applicability of AODV and OLSR protocols in VANET with different traffic scenario and transmission ranges of IEEE 802. 11p standard. © Springer International Publishing Switzerland 2015.Item Virtual machine introspection based spurious process detection in virtualized cloud computing environment(Institute of Electrical and Electronics Engineers Inc., 2015) M.a, M.A.; Jaidhar, C.D.Virtual Machines are prime target for adversary to take control by exploiting the identified vulnerability present in it. Due to increasing number of Advanced Persistent Attacks such as malware, rootkit, spyware etc., virtual machine protection is highly challenging task. The key element of Advanced Persistent Threat is rootkit that provides stealthy control of underlining Operating System (kernel). Protecting individual guest operating system by using antivirus and commercial security defense mechanism is cost effective and ineffective for virtualized environment. To solve this problem, Virtual Machine Introspection has emerged as one of the promising approaches to secure the state of the virtual machine. Virtual Machine Introspection inspects the state of multiple virtual machines by operating outside the virtual machine i.e. at hypervisor level. In this work, Virtual Machine Introspection based malicious process detection approach is proposed. It extracts the high level information such as system call details, opened known backdoor ports from introspected memory to identify the spurious process. It triggers an alert in response to detected intrusion. © 2015 IEEE.Item Comparative study of Principal Component Analysis based Intrusion Detection approach using machine learning algorithms(Institute of Electrical and Electronics Engineers Inc., 2015) Chabathula, K.J.; Jaidhar, C.D.; M.a, M.A.This paper induces the prominence of variegated machine learning techniques adapted so far for the identifying different network attacks and suggests a preferable Intrusion Detection System (IDS) with the available system resources while optimizing the speed and accuracy. With booming number of intruders and hackers in todays vast and sophisticated computerized world, it is unceasingly challenging to identify unknown attacks in promising time with no false positive and no false negative. Principal Component Analysis (PCA) curtails the amount of data to be compared by reducing their dimensions prior to classification that results in reduction of detection time. In this paper, PCA is adopted to reduce higher dimension dataset to lower dimension dataset. It is accomplished by converting network packet header fields into a vector then PCA applied over high dimensional dataset to reduce the dimension. The reduced dimension dataset is tested with Support Vector Machines (SVM), K-Nearest Neighbors (KNN), J48 Tree algorithm, Random Forest Tree classification algorithm, Adaboost algorihm, Nearest Neighbors generalized Exemplars algorithm, Navebayes probabilistic classifier and Voting Features Interval classification algorithm. Obtained results demonstrates detection accuracy, computational efficiency with minimal false alarms, less system resources utilization. Experimental results are compared with respect to detection rate and detection time and found that TREE classification algorithms achieved superior results over other algorithms. The whole experiment is conducted by using KDD99 data set. © 2015 IEEE.Item Hypervisor and virtual machine dependent Intrusion Detection and Prevention System for virtualized cloud environment(Institute of Electrical and Electronics Engineers Inc., 2015) M.a, M.A.; Jaidhar, C.D.Cloud Computing enabled by virtualization technology exhibits revolutionary change in IT Infrastructure. Hypervisor is a pillar of virtualization and it allows sharing of resources to virtual machines. Vulnerabilities present in virtual machine leveraged by an attacker to launch the advanced persistent attacks such as stealthy rootkit, Trojan, Denial of Service (DoS) and Distributed Denial of Service (DDoS) attack etc. Virtual Machines are prime target for malignant cloud user or an attacker to launch attacks as they are easily available for rent from Cloud Service Provider (CSP). Attacks on virtual machine can disrupt the normal operation of cloud infrastructure. In order to secure the virtual environment, defence mechanism is highly imperative at each virtual machine to identify the attacks occurring at virtual machine in timely manner. This work proposes In-and-Out-of-the-Box Virtual Machine and Hypervisor based Intrusion Detection and Prevention System for virtualized environment to ensure robust state of the virtual machine by detecting followed by eradicating rootkits as well as other attacks. We conducted experiments using popular open source Host based Intrusion Detection System (HIDS) called Open Source SECurity Event Correlator (OSSEC). Both Linux and windows based rootkits, DoS attack, Files integrity verification test are conducted and they are successfully detected by OSSEC. © 2015 IEEE.Item VMI based automated real-time malware detector for virtualized cloud environment(Springer Verlag service@springer.de, 2016) M.a, M.A.; Jaidhar, C.D.The Virtual Machine Introspection (VMI) has evolved as a promising future security solution to performs an indirect investigation of the untrustworthy Guest Virtual Machine (GVM) in real-time by operating at the hypervisor in a virtualized cloud environment. The existing VMI techniques are not intelligent enough to read precisely the manipulated semantic information on their reconstructed high-level semantic view of the live GVM. In this paper, a VMI-based Automated-Internal- External (A-IntExt) system is presented that seamlessly introspects the untrustworthy Windows GVM internal semantic view (i.e. Processes) to detect the hidden, dead, and malicious processes. Further, it checks the detected, hidden as well as running processes (not hidden) as benign or malicious. The prime component of the A-IntExt is the Intelligent Cross- View Analyzer (ICV A), which is responsible for detecting hidden-state information from internally and externally gathered state information of the Monitored Virtual Machine (Med−VM). The A-IntExt is designed, implemented, and evaluated by using publicly available malware and Windows real-world rootkits to measure detection proficiency as well as execution speed. The experimental results demonstrate that A-IntExt is effective in detecting malicious and hidden-state information rapidly with maximum performance overhead of 7.2 %. © Springer International Publishing AG 2016.Item Execution time measurement of virtual machine volatile artifacts analyzers(IEEE Computer Society help@computer.org, 2016) M.a, M.A.A.; Jaidhar, C.D.Due to a rapid revaluation in a virtualization environment, Virtual Machines (VMs) are target point for an attacker to gain privileged access of the virtual infrastructure. The Advanced Persistent Threats (APTs) such as malware, rootkit, spyware, etc. are more potent to bypass the existing defense mechanisms designed for VM. To address this issue, Virtual Machine Introspection (VMI) emerged as a promising approach that monitors run state of the VM externally from hypervisor. However, limitation of VMI lies with semantic gap. An open source tool called LibVMI address the semantic gap. Memory Forensic Analysis (MFA) tool such as Volatility can also be used to address the semantic gap. But, it needs to capture a memory dump (RAM) as input. Memory dump acquires time and its analysis time is highly crucial if Intrusion Detection System IDS (IDS) depends on the data supplied by FAM or VMI tool. In this work, live virtual machine RAM dump acquire time of LibVMI is measured. In addition, captured memory dump analysis time consumed by Volatility is measured and compared with other memory analyzer such as Rekall. It is observed through experimental results that, Rekall takes more execution time as compared to Volatility for most of the plugins. Further, Volatility and Rekall are compared with LibVMI. It is noticed that examining the volatile data through LibVMI is faster as it eliminates memory dump acquire time. © 2015 IEEE.Item Image segmentation using encoder-decoder architecture and region consistency activation(Institute of Electrical and Electronics Engineers Inc., 2016) Naik, D.; Jaidhar, C.D.An Encoder-Decoder Neural Network Architecture is combined with a novel strategy to improve global label consistency, to come with an improved image segmentation model. Label Distribution predictions extracted from the SegNet Network is investigated and used in the project for image labeling. An algorithm called Region Consistency Activation (RCA) to improve the global label consistency is implemented. RCA is based on a novel transformation between Ultra metric Contour Map (UCM) and the Probability of Regions Consistency (PRC). These algorithms were rigorously tested on the CamVid dataset. Superior performances were achieved compared with the state-of-the-art methods on this dataset. © 2016 IEEE.Item Windows malware detection based on cuckoo sandbox generated report using machine learning algorithm(Institute of Electrical and Electronics Engineers Inc., 2016) Shiva Darshan, S.L.S.; M.a, M.A.A.; Jaidhar, C.D.Malicious software or malware has grown rapidly and many anti-malware defensive solutions have failed to detect the unknown malware since most of them rely on signature-based technique. This technique can detect a malware based on a pre-defined signature, which achieves poor performance when attempting to classify unseen malware with the capability to evade detection using various code obfuscation techniques. This growing evasion capability of new and unknown malwares needs to be countered by analyzing the malware dynamically in a sandbox environment, since the sandbox provides an isolated environment for analyzing the behavior of the malware. In this paper, the malware is executed on to the cuckoo sandbox to obtain its run-time behavior. At the end of the execution, the cuckoo sandbox reports the system calls invoked by the malware during execution. However, this report is in JSON format and has to be converted to MIST format to extract the system calls. The collected system calls are structured in the form of N-Grams, which help to build the classifier by using the Information Gain (IG) as a feature selection technique. A comprehensive experiment was conducted to perceive the best fit classifier among the chosen classifiers, including the Bayesian-Logistic-Regression, SPegasos, IB1, Bagging, Part, and J48 defined within the WEKA tool. From the experimental results, the overall best performance for all the selected top N-Grams such as 200, 400, and 600 goes to SPegasos with the highest accuracy, highest True Positive Rate (TPR), and lowest False Positive Rate (FPR). © 2016 IEEE.Item EDAGF: Estimation & direction aware greedy forwarding for urban scenario in vehicular ad-hoc network(Institute of Electrical and Electronics Engineers Inc., 2016) Jaiswal, R.K.; Jaidhar, C.D.Vehicular Ad-hoc Network (VANET) is the prime requirement to mitigate the traffic and accident on urban and highway road network. In VANET, routing plays a crucial role to send and receive packets in time. Position based routing protocols are compatible with VANET communication rather than topology based routing protocols. However, their performances are computed without considering location error and delay generated by the Global Positioning System (GPS) device. To minimize delay and location error, Estimation & Direction Aware Greedy Forwarding protocol is proposed in this work. In this protocol, primarily Roadside Unit (RSU) is used as most preferred forwarding node over the vehicles. In addition, direction of the moving vehicle is also considered to decide the next forwarding node if RSUs are located at farther distance. When a vehicle does not find any forwarding node, then it buffers the packets and carries until next forwarding node is identified. Node and RSU estimate the next probable location of the destination vehicle using previously recorded location using Kalman filter. © 2015 IEEE.Item PPRP: Predicted Position based routing protocol using Kalman Filter for Vehicular Ad-hoc Network(Association for Computing Machinery acmhelp@acm.org, 2017) Jaiswal, R.K.; Jaidhar, C.D.New edition vehicles are equipped with Global Positioning System (GPS) device which provides the vehicle position in the form of latitude and longitude, this position is used as a location id of the vehicle at time t during routing in Vehicular Ad-hoc Network (VANET). The location ids are susceptible to have an error in position due to several factors such as line-of-sight, signal fading and tunnels just for an instance. Thus, Position based routing protocol experiences poor performance. To minimize the effect of position error, this work proposes a Predicted Position Based Routing Protocol (PPRP) for VANET. PPRP predicts the vehicle location based on previous and current location using Kalman Filter (KF) to improve the Packet Delivery Ratio (PDR), average delay and throughput. Before applying KF into routing its effectiveness is verified and found satisfactory results which advocate KF, to be used in routing. The proposed routing protocol is simulated on NS-3.23 simulator. VANETMOBISIM is used to get the vehicular mobility of 25, 50, 75 and 100 vehicles running on a city road network of 1000 ∗ 1000 m2 area. The performance of the proposed routing protocol is evaluated and compared with other prediction based routing protocol. Simulation is conducted for 250m and 500m transmission range using Winner-II and Two-ray ground propagation model with IEEE 802.11p standard. © 2017 ACM.