A widely used defense practice against malicious traffic on the Internet is through blacklists: lists of prolific attack sources are compiled and shared. The goal of blacklists is to predict and block future attack sources. Existing blacklisting techniques have focused on the most prolific attack sources and, more recently, on collaborative blacklisting. In this paper, we formulate the problem of forecasting attack sources (also referred to as "predictive blacklisting") based on shared attack logs as an implicit recommendation system. We compare the performance of existing approaches against the upper bound for prediction, and we demonstrate that there is much room for improvement. Inspired by the recent Netflix competition, we propose a multilevel prediction model that is adjusted and tuned specifically for the attack forecasting problem. Our model captures and combines various factors, namely: attacker-victim history (using time-series) and attackers and/or victims interactions (using neighborhood models). We evaluate our combined method on one month of logs from Dshield.org and demonstrate that it improves significantly the state-of-the-art.

No abstract

In this paper we propose PiggyCode, a networkcoding based scheme specifically designed to enhance TCP performance over IEEE 802.11 multi-hop wireless networks. The root of this approach is a network coding module operating between the Network and the MAC layer. Each node running PiggyCode encodes, whenever it is possible, TCP-DATA and TCP-ACK packets belonging to the same information flow. The coding approach is conceptually analogous to piggyback the TCP-ACK packet within the TCP-DATA packet, with the substantial difference that, by performing network coding operations, the actual packet size remains unchanged. The proposed scheme is simple and effective. It leverages the benefits of network coding in the wireless environment, to jointly reduce the overall number of transmissions on the channel and speed up the delivery process of TCP-ACK packets, thus achieving significant improvements in terms of TCP performance 1 .

No abstract

Abstract-Network coding, the notion of performing coding operations on the contents of packets while in transit through the network, was originally developed for wired networks; recently, however, it has been also applied with success also to wireless ad hoc networks. In fact, it has been shown that network coding can yield substantial performance gains, e.g., reduced energy consumption, in ad hoc networks. In this paper, we compare, using linear programming formulations, the maximum throughput that a multicast application can achieve with and without network coding in unreliable ad hoc networks; we show that network coding achieves 65% higher throughput than conventional multicast in a typical ad hoc network scenario. The superiority of network coding, already established by the analytic results, is confirmed by simulation experiments.