String Theory paper shows interplay between math & physics

In the most recent AMS Bulletin [1], there is an interesting article titled "String theory and math: Why this marriage may last. Mathematics and dualities of quantum physic" [2] from Mina Aganagic. Aganagic is a member of both UC Berkeley's Department of Physics and Department of Math. I find it interesting because it shows the interplay between the fields of math and physics and how that interaction pushes each field. I believe that this is a reminder for us all to not shun ideas of other fields, but learn from them.. learn the similarities and differences between the field(s) we deal with and gain experience from others'. I do not claim knowledge of the details of the paper, I mostly have skimmed it to glean what I can.

I also recommend the article about the cover which is of the cover of Gauss's "Disquisitiones Arithmeticæ" [3] for the discussion on the many proofs of the Law of Quadratic Reciprocity. The perspective that there are many ways to show the same thing is interesting. What can we learn from this?

[1] http://www.ams.org/journals/bull/2016-53-01/ 
[2] http://www.ams.org/journals/bull/2016-53-01/S0273-0979-2015-01517-X/
[3] http://www.ams.org/journals/bull/2016-53-01/S0273-0979-2015-01521-1/S0273-0979-2015-01521-1.pdf

Ghost turns Zombie: Exploring the Life Cycle of Web-based Malware

from LEET 08, a paper that i found entirely disappointing. all it is is a collection of numbers without much interpretation. the field is significantly more complex than you can allow in 8 pages, but the authors make no attempt to dig into why they get the results they get.

While the web provides information and services that enrich our lives in many ways, it has also become the primary vehicle for delivering malware. Once infected with web-based malware, an unsuspecting user’s machine is converted into a productive member of the Internet underground. In this work, we explore the life cycle of web-based malware by employing light-weight responders to capture the network profile of infected machines. Our results indicate that web-based malware provides a cornerstone for large scale electronic fraud. It is used to exfiltrate address books of compromised machines creating databases of hundred millions of email addresses, to form spamming botnets responsible for a significant fraction of spam currently seen on the Internet, and also to steal login credentials that can be directly monetized or leveraged to turn more web servers into malware delivery vectors.

We support our findings by providing a broad overview of the post-infection network behavior of web-based malware, as well as in-depth examinations of the botnets and leaked information we found during the course of our study.

source: Ghost turns Zombie: Exploring the Life Cycle of Web-based Malware,Michalis Polychronakis, Panayiotis Mavrommatis, Niels Provos.

Related articles

• Botnet sics zombie soldiers on gimpy websites [via Zemanta]
• Research on Malware Distribution [via Zemanta]

Anti-Unpacker Tricks

from the CARO workshop i attended a week or so ago, this gem from Peter Ferrie. Peter's collected a lot of useful info for anyone working with Win32 protected EXEs.

Unpackers are as old as the packers themselves, but anti-unpacking tricks are a more recent development. These anti-unpacking tricks have developed quickly in number and, in some cases, complexity. In this paper, we will describe some of the most common anti-unpacking tricks, along with some countermeasures.

source: Anti-unpacker Tricks, Peter Ferrie.

Why Writing Your Own Search Engine is Hard

found this in my ACM Queue pile this morning. there's no single silver bullet here, but lots of good principles learned over a few years of working with boatloads of data. i think she's right in most cases based on my (limited) experience with piles of data i wish to search and handle.

There must be 4,000 programmers typing away in their basements trying to build the next "world's most scalable" search engine. It has been done only a few times. It has never been done by a big group; always one to four people did the core work, and the big team came on to build the elaborations and the production infrastructure. Why is it so hard? We are going to delve a bit into the various issues to consider when writing a search engine. This article is aimed at those individuals or small groups that are considering this endeavor for their Web site or intranet. It is fun, but a word of caution: not only is it difficult, but you need two commodities in short supply—time and patience.

source: Why Writing Your Own Search Engine is Hard, from Enterprise Search Vol. 2, No. 2 - April 2004. Anna Patterson, Stanford University.

Data Reduction in Intrusion Alert Correlation

been thinking a lot about data fusion and correlation for years, but a lot more lately. sadly this paper did not help. pretty weak presentation, not a very well developed approach, nor is it very novel.

Network intrusion detection sensors are usually built around low level models of network traffic. This means that their output is of a similarly low level and as a consequence, is difficult to analyze. Intrusion alert correlation is the task of automating some of this analysis by grouping related alerts together. Attack graphs provide an intuitive model for such analysis. Unfortunately alert flooding attacks can still cause a loss of service on sensors, and when performing attack graph correlation, there can be a large number of extraneous alerts included in the output graph. This obscures the fine structure of genuine attacks and makes them more difficult for human operators to discern. This paper explores modified correlation algorithms which attempt to minimize the impact of this attack.

Source: Data Reduction in Intrusion Alert Correlation, Tedesco Gianni, Aickelin Uwe.

Behind Phishing: An Examination of Phisher Modi Operandi

LEET 08 papers are now visible as the workshop is on. i went looking for a few papers in domains i study, hoping to get some more insight. sadly, this paper (the second of the bunch i read, thorsten's was first) really let me down. pretty weak data, very cursory analysis, very lame conclusions. some folks are disconnected - quite visibly disconnected - from the very real world problems they're studying.

Phishing costs Internet users billions of dollars a year. Using various data sets collected in real-time, this paper analyzes various aspects of phisher modi operandi. We examine the anatomy of phishing URLs and domains, registration of phishing domains and time to activation, and the machines used to host the phishing sites. Our findings can be used as heuristics in filtering phishing-related e-mails and in identifying suspicious domain registrations.

Source: Behind Phishing: An Examination of Phisher Modi Operandi, D. Kevin McGrath, Minaxi Gupta.

Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on StormWorm

one of the papers i read this week. i was frustrated that the authors didn't get more pages to discuss their work and instead had to fit more background material in there.

Botnets, i.e., networks of compromised machines under a common
control infrastructure, are commonly controlled by an attacker
with the help of a central server: all compromised machines
connect to the central server and wait for commands.

However, the first botnets that use peer-to-peer (P2P) networks
for remote control of the compromised machines appeared
in the wild recently. In this paper, we introduce a
methodology to analyze and mitigate P2P botnets. In a case
study, we examine in detail the Storm Worm botnet, the most
wide-spread P2P botnet currently propagating in the wild. We
were able to infiltrate and analyze in-depth the botnet, which allows
us to estimate the total number of compromised machines.
Furthermore, we present two different ways to disrupt the communication
channel between controller and compromised machines
in order to mitigate the botnet and evaluate the effectiveness
of these mechanisms.

Source: Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on StormWorm, Thorsten Holz, Moritz Steinery, Frederic Dahl, Ernst Biersacky, Felix Freiling, from a paper to appear at LEET 08.

Characterizing Residential Broadband Networks

with comcast and bittorrent shaping in the news, this study from last year's Internet Measurement Conference workshop is pretty interesting. lots of good traffic measurements about actual bandwidth, its stability, etc.

A large and rapidly growing proportion of users connect to
the Internet via residential broadband networks such as Dig-
ital Subscriber Lines (DSL) and cable. Residential networks
are often the bottleneck in the last mile of today’s Internet.
Their characteristics critically affect Internet applications,
including voice-over-IP, online games, and peer-to-peer con-
tent sharing/delivery systems. However, to date, few studies
have investigated commercial broadband deployments, and
rigorous measurement data that characterize these networks
at scale are lacking.
In this paper, we present the first large-scale measurement
study of ma jor cable and DSL providers in North America
and Europe. We describe and evaluate the measurement
tools we developed for this purpose. Our study character-
izes several properties of broadband networks, including link
capacities, packet round-trip times and jitter, packet loss
rates, queue lengths, and queue drop policies. Our analysis
reveals important ways in which residential networks differ
from how the Internet is conventionally thought to operate.
We also discuss the implications of our findings for many
emerging protocols and systems, including delay-based con-
gestion control (e.g., PCP) and network coordinate systems
(e.g., Vivaldi).

source: Characterizing Residential Broadband Networks, Marcel Dischinger, MPI for Software Systems; Andreas Haeberlen, MPI for Software Systems and Rice University; Krishna P. Gummadi, MPI for Software Systems; Stefan Saroiu, University of Toronto.