Shou-Hsuan Stephen Huang

This project addresses the issue of detecting intruders from hiding behind privacy-protecting anonymity networks. The freely available Tor and the SOCKS proxy services have been popular tools that provide circuit-based anonymous connections to network users. However, recent security breaches reveal that SSH and HTTPS have been used to launch attacks by malicious users by taking advantage of these services to hide their identities. This paper investigates strategies to detect SSH and HTTPS connections via the circuit-based anonymity networks, to help servers and websites defend against anonymous intruders. We evaluate our approaches with SSH and HTTPS connections and show that they achieve high performance for both applications. Our detection algorithms are based on the extra latency delays introduced by the presence of the anonymity networks. Since the latency disparity is sensitive to the location of the anonymity network, our algorithms must be evaluated in the most challenging scenarios. The detection rates for all four combinations of SSH/HTTPS applications via Tor/SOCKS networks were very high, with a low false-positive rate. To demonstrate the robustness of our approach in the Tor case, we tested our method in multiple Tor circuit node selection strategies. The approach can be applied to other applications meeting the same criteria.

Flow cytometry has been widely used for the diagnosis of various hematopoietic diseases. Although there have been advances in the number of biomarkers that can be analyzed simultaneously and technologies that enable fast performance, the diagnostic data are still interpreted by a manual gating strategy. The process is labor-intensive, time-consuming, and subject to human error.

Network intruders often launch attacks through a long connection chain via intermediary hosts, called stepping- stones in order to evade detection. An effective method to detect such intrusion is to estimate the number of stepping-stones. Artificial neural networks provide the potential to identify and classify network activities. In this paper, we proposed an approach that utilized the analytical strengths of neural networks to detect stepping-stone intrusion. Using collected packet variables, a scheme was developed for neural network investigation and the performance of neural networks was critically examined. It was found that neural networks were able to predict the number of stepping-stones for incoming packets by our method by monitoring a connection chain in a small time interval. Various transfer functions and learning rules were studied and it was determined that Sigmoid transfer function and Delta learning rule generally gave better predictions.