A composite-metric based path selection technique for the Tor anonymity network

Milajerdi, Sadegh M.; Kharrazi, Mehdi

doi:10.1016/j.jss.2015.01.002

Cited by 8 publications

(4 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are many studies that evaluate the anonymity of systems from various perspectives, but ultimately combine with information entropy to obtain anonymity. For example, Piotrowska et al (2017) Milajerdi and Kharrazi (2015) calculated the entropy value representing the system's anonymity level by statistically computing the proportion of node combinations in the path as the probability of identifying the path. Xia et al ( 2021) utilized information entropy to evaluate the anonymity of the T-hybrid network, considering network attributes including the proportion of compromised nodes, the size of anonymous sets, and path length.…”

Section: Combined With Information Entropymentioning

confidence: 99%

“…Through experiment when the anonymity system is in normal operation, we compared our anonymity evaluation method with existing methods that only rely on a single indicator. Typical applications include evaluating information entropy anonymity based on the distribution of star-end-combs during path construction (Milajerdi and Kharrazi 2015) and calculating Gini coefficient anonymity based on the frequency of node selection (Snader and Borisov 2008), thus testing the dynamics and applicability of our anonymity evaluation method in normal operation.…”

Section: Normal Operation Comparisonmentioning

confidence: 99%

See 1 more Smart Citation

Tor network anonymity evaluation based on node anonymity

Cui,

Huang,

Meng

et al. 2023

Cybersecurity

View full text Add to dashboard Cite

In order to address the shortcomings of traditional anonymity network anonymity evaluation methods, which only analyze from the perspective of the overall network and ignore the attributes of individual nodes, we proposes a dynamic anonymity model based on a self-built anonymous system that combines node attributes, network behavior, and program security monitoring. The anonymity of evaluation nodes is assessed based on stable intervals and behavior baselines defined according to their normal operating status. The anonymity of the network is evaluated using an improved normalized information entropy method that refines anonymity evaluation to the anonymity of each node and expands the dimensionality of evaluation features. This paper compares the effectiveness of our proposed method with static framework information entropy and single indicator methods by evaluating the degree of anonymity provided by a self-built Tor anonymous network under multiple operating scenarios including normal and under attack. Our approach utilizes dynamically changing network anonymity based on multiple anonymous attributes and better reflects the degree of anonymity in anonymous systems.

show abstract

Section: Combined With Information Entropymentioning

confidence: 99%

Section: Normal Operation Comparisonmentioning

confidence: 99%

Tor network anonymity evaluation based on node anonymity

Cui,

Huang,

Meng

et al. 2023

Cybersecurity

View full text Add to dashboard Cite

show abstract

“…However, these suspicious actions do not directly reveal the user’s type because a legitimate user may also take them. For example, both the Tor network connection [ 104 ] and the code obfuscation [ 74 ] can be used legitimately or illegally. Similarly, a defender can also be classified into different types θ 1 based on factors such as their level of security awareness, detection techniques they have adopted, and the completeness of their virus signature database.…”

Section: Recent Advancesmentioning

confidence: 99%

Dynamic games for secure and resilient control system design

Huang

Chen

Huang

et al. 2020

National Science Review

View full text Add to dashboard Cite

Modern control systems are featured by their hierarchical structure composing of cyber, physical, and human layers. The intricate dependencies among multiple layers and units of modern control systems require an integrated framework to address cross-layer design issues related to security and resilience challenges. To this end, game theory provides a bottom-up modeling paradigm to capture the strategic interactions among multiple components of the complex system and enables a holistic view to understand and design cyber-physical-human control systems. In this review, we first provide a multi-layer perspective toward increasingly complex and integrated control systems and then introduce several variants of dynamic games for modeling different layers of control systems. We present game-theoretic methods for understanding the fundamental tradeoffs of robustness, security, and resilience and developing a cross-layer approach to enhance the system performance in various adversarial environments. This review also includes three quintessential research problems that represent three research directions where dynamic game approaches can bridge between multiple research areas and make significant contributions to the design of modern control systems. The paper is concluded with a discussion on emerging areas of research that crosscut dynamic games and control systems.

show abstract

“…For example, domain flux, port scanning and malicious C&C communications, used in the APT attack, can be also used for botnet attacks [33]. Moreover, Tor network connection, used for data exfiltration in the APT attack, can also be used legally to protect the confidentiality of a user traffic [34]. Thus, individually these…”

Section: Apt Detector Description Limitationsmentioning

confidence: 99%

Detection of advanced persistent threat using machine-learning correlation analysis

Ghafir

Hammoudeh

Přenosil

et al. 2018

Future Generation Computer Systems

231

107

View full text Add to dashboard Cite

Item Type Article Authors Ghafir, Ibrahim; Hammoudeh, M.; Prenosil, V.; Han, L.; Hegarty, R.; Rabie, K.; Aparicio-Navarro, F.J. Citation Ghafir I, Hammoudeh M, Prenosil V (et al) Detection of advanced persistent threat using machine-learning correlation analysis. Future Generation Computer Systems. 89: 349-359. Rights Citation: Ghafir I, Hammoudeh M, Prenosil V (et al) Detection of advanced persistent threat using machine-learning correlation analysis. Future Generation Computer Systems. 89: 349-359. AbstractAs one of the most serious types of cyber attack, Advanced Persistent Threats (APT) have caused major concerns on a global scale. APT refers to a persistent, multi-stage attack with the intention to compromise the system and gain information from the targeted system, which has the potential to cause significant damage and substantial financial loss. The accurate detection and prediction of APT is an ongoing challenge. This work proposes a novel machine learning-based system entitled MLAPT, which can accurately and rapidly detect and predict APT attacks in a systematic way. The MLAPT runs through three main phases: (1) Threat detection, in which eight methods have been developed to detect different techniques used during the various APT steps. The implementation and validation of these methods with real traffic is a significant contribution to the current body of research; (2) Alert correlation, in which a correlation framework is designed to link the outputs of the detection methods, aims to identify alerts that could be related and belong to a single APT scenario; and (3) Attack prediction, in which a machine learning-based prediction module is proposed based on the correlation framework output, to be used by the network security team to determine the probability of the early alerts to develop a complete APT attack. MLAPT is experimentally evaluated and the presented system is able to predict APT in its early steps with a prediction accuracy of 84.8%.to a technical report by Trend Micro [11], this assumption is no longer valid with the rise of targeted attacks, Advanced Persistent Threats (APTs), in which both cyber-criminals and hackers are targeting selected organizations and persisting until they achieve their goals.The APT attack is a persistent, targeted attack on a specific organisation 20 and is performed through several steps [12]. The main aim of APT is espionage and then data exfiltration. Therefore, APT is considered as a new and more complex version of multi-step attack. These APTs present a challenge for current detection methods as they use advanced techniques and make use of unknown vulnerabilities. Moreover, the economic damage due to a successful 25 APT attack significant. The potential cost of attacks is the major motivation for the investments in intrusion detection and prevention systems [13]. APTs are currently one of the most serious threats to companies and governments [14].Most of the research in the area of APT detection, has focused on analysing already identified APTs [15][16][17][...

show abstract

A composite-metric based path selection technique for the Tor anonymity network

Cited by 8 publications

References 27 publications

Tor network anonymity evaluation based on node anonymity

Tor network anonymity evaluation based on node anonymity

Dynamic games for secure and resilient control system design

Detection of advanced persistent threat using machine-learning correlation analysis

Contact Info

Product

Resources

About