Nahur Fonseca -

A very nice [[survey|http://www.cc.gatech.edu/~wenke/ids-readings.html]] on intrusion detection methods, systems and evaluation was made by Wenke Lee.

<<tabs tabsClass\nPapers "Papers survey" [[AnDetPapers]]\nGroups "Other groups" [[AnDetGroups]]\nConferences "Conferences in the area" [[AnDetConferences]]\nProjects "My projects" [[AnDetProjects]]\nPresentations "My presentations" [[AnDetPresentations]]\n>>

My CV\nto be continued.

!Main Classes\n* "Applied For"\n## Characterization\n## Similarity / Difference Measure\n## Network Coding\n* "Applied On"\n** Data Sets\n### Stream\n### Static\n** Object\n### Link\n### Flow\n### Packet\n### Path\n### Network\n### others\n** Domain\n### Discrete\n### Continuous\n** Features\n### Flow size (# packets)\n### Flow identifier (5-tuple header)\n### Packet/Byte count in a interval\n### Queue delay\n* "Applied In"\n## Intrusion Detection Systems\n## Change Detection\n## Network Monitoring\n## Trace Compression\n## Network Management\n## Criptography (???)\n## Image Registration\n## Multicast\n\n!Aspects to Evaluate in Each Class\n* Instance of Application\n** Intrusion Detection Systems\n** Change Detection in Streams\n** Network Monitoring\n** Trace Compression\n** Network Management\n* Contributions\n** Framework for specific applications\n** Data structures for efficient computation\n** Principled approach for better understanding of the problem\n** Bounds\n* Open Problems\n** high dimensionality\n** time correlation\n** statistical significance or confidence intervals\n* Assumptions\n** i.i.d. sequences\n** others\n* Metric / Concept Used\n** (Shannon/Hill/??) Entropy\n** Mutual information\n** Conditional Entropy\n** Relative Entropy

* [[E-mail]]\n* [[Addresses]]\n* [[PGP]] [[download file|nahur_bucs_pk.txt]] (Fingerprint: {{{1E76 0C23 615F 8CA3 7755 34CE F5EF C339 341B DA97}}})

[[Home]]

* [[nahur@cs.bu.edu|mailto:nahur@cs.bu.edu]]

Welcome to my web site.\n\nI'm currently in my last year of graduate studies at [[Boston University|http://www.bu.edu]], working in the [[Computer Science Department|http://www.cs.bu.edu]] under the supervision of professor [[Mark Crovella|http://www.cs.bu.edu/~crovella]].\n\nMy research area of interest is the application of statistical methods in network security. The types of problems that I have been working on are [[Anomaly detection in networks]] and classification, characterization of normal and abnormal network features, use of sketchy representation of traffic data and characterization of malicious activity in networks.\n\n [img[images/openarms.gif]]

It is believed that HTTP is very verbose. But it has not been quantified yet.\n\n# Collect the dump of HTTP connections in front of a web server.\n# Measure the entropy of that trace using different levels of granularity:\n## character / byte code\n## token (using some HTTP parser)\n## conversation\n## full session\n# Using an efficient coding, what is the savings in messages size, exchanged by the HTTP protocol?

* |[[IEEE Information Theory Society|http://www.itsoc.org/]]\n** [[All conferences|http://www.itsoc.org/society/conferences.html]]\n* [[2007 IEEE International Symposium on Information Theory|http://www.isit2007.org/]], Nice, France\n** Conf: June 24 – 29 ------ Sub: ??\n* [[2006 International Symposium on Information Theory and its Applications (ISITA2006)|http://www.isita2006.org/]], Seoul, Korea\n** Conf: Oct 29 – Nov 1 ------ Sub: Apr 3

* ''Georgia Tech''. [[Wenke Lee|http://www.cc.gatech.edu/~wenke/]] leads a research group that is developing "an information-theoretic framework for evaluating and optimizing intrusion detection performance, funded by Army Research Office".

<html><div style="font-size: 12pt">Anomaly detection</div></html>\n* Wenke Lee and Dong Xiang, ''//Information-theoretic measures for anomaly detection//'', In Proceedings of The 2001 IEEE Symposium on Security and Privacy, Oakland, CA, May 2001. [[.pdf|papers/infotheory/lee2001infomeasures.pdf]] [[abstract|abstracts/infotheory/leexiang2001infotheo.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=leexiang2001infotheo]]\n\n* Guofei Gu, Prahlad Fogla, David Dagon and Boris Skoric, ''//Measuring Intrusion Detection Capability: An ~Information-Theoretic Approach//'', In Proceedings of ACM Symposium on ~InformAction, Computer and Communications Security (ASIACCS'06), Taipei, Taiwan, March 2006. [[.pdf|papers/infotheory/Gu_asiaccs06_cid.pdf]] [[abstract|abstracts/infotheory/gu2006measuringids.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=gu2006measuringids]]\n\n* Tamraparni Dasu, Shankar Krishnan, Suresh Venkatasubramanian, and Ke Yi, ''//An ~Information-Theoretic Approach to Detecting Changes in ~Multi-Dimensional Data Streams//'', In Proceedings of Interface 2006, 38th Symposium on the interface of statistics, computing science, and applications. [[.pdf|papers/infotheory/dasu2006datadiff.pdf]] [[abstract|abstracts/infotheory/dasu2006datadiff.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=dasu2006datadiff]]\n\n* Yu Gu, Andrew ~McCallum, Don Towsley, ''//Detecting Anomalies in Network Traffic Using Maximum Entropy Estimation//'', In Proceedings of IMC '05, 2005. [[.pdf|papers/infotheory/gu2005maximumentropy.pdf]] [[abstract|abstracts/infotheory/gu2005maximumentropy.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=gu2005maximumentropy]]\n\n* Anukool Lakhina, Mark Crovella and Christophe Diot, ''//Mining Anomalies Using Traffic Feature Distributions//'', In Proceedings of SIGCOMM 2005. [[.pdf|papers/infotheory/lakhina2005mining.pdf]] [[abstract|abstracts/infotheory/lakhina2005mining.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=lakhina2005mining]]\n\n----\n\n* Juan M. ~Estévez-Tapiador, Pedro ~García-Teodoro and Jesús E. ~Díaz-Verdejo, ''//Measuring normality in HTTP traffic for anomaly-based intrusion detection//'', Computer Networks, Volume 45, Issue 2, 5 June 2004, Pages 175-193. [[.pdf|papers/infotheory/tapiador2004httpnormality.pdf]] [[abstract|abstracts/infotheory/tapiador2004httpnormality]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=tapiador2004httpnormality]]\n\n* Daniel Kifer, Shai ~Ben-David, and Johannes Gehrke, ''//Detecting Change in Data Streams//'', In Proc. VLDB 2004. [[.pdf|papers/infotheory/kifer04detecting.pdf]] [[abstract|abstract/kifer2004detecting.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=kifer2004detecting]]\n\n* Deepak Agarwal, Jeff Phillips, Suresh Venkatasubramanian, ''//The Hunting of the Bump: On Maximizing Statistical Discrepancy//'', In Proceedings of 17th ~ACM-SIAM Symposium on Discrete Algorithms, 2006.[[.pdf|papers/infotheory/disc.pdf]] [[abstract|abstracts/infotheory/agarwal2006bump.txt]]\n\n* Sudipto Guha, Andrew, and Suresh Venkatasubramanian, ''//Streaming and Sublinear Approximation of Entropy and Information Distances//'', In Proceedings of 17th ~ACM-SIAM Symposium on Discrete Algorithms, 2006. [[.pdf|papers/infotheory/jstest.pdf]] [[abstract|abstracts/infotheory/guha2006streaming.txt]]\n\n\n<html><div style="font-size: 12pt">Measurements/Characterization</div></html>\n* Yong Liu, Don Towsley, Tao Ye and Jean Bolot, ''//An Information-theoretic Approach to Network Monitoring and Measurement//'', In Proceedings of IMC'05. [[.pdf|papers/infotheory/liu_yong.pdf]] [[abstract|abstracts/infotheory/liuEA2005infotheo.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=liuEA2005infotheo]]\n\n* Yin Zhang, Matthew Roughan, Carsten Lund and David Donoho, ''//An information-theoretic approach to traffic matrix estimation//'', In Proceedings of SIGCOMM 2003. [[.pdf|papers/infotheory/mmi-sig03.pdf]] [[abstract|abstracts/infotheory/zhangEA2003infotheo.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=zhang03infothryapproach]]\n\n* Balachander Krishnamurthy, Suresh Venkatasubramanian, Harsha V. Madhyastha, ''//On stationarity in Internet measurements through an information-theoretic lens//'', In Proceedings of ICDE'05,April 2005. [[.pdf|papers/infotheory/station.pdf]] [[abstract|abstracts/infotheory/krishnamurthy2005changedet.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=krishnamurthy2005changedet]]\n\n* N. G. Duffield, J. T. Lewis, Neil O'Connell, Raymond Russell and Fergal Toomey, ''//Entropy Of ATM Traffic Streams: A Tool For Estimating ~QoS Parameters//'', IEEE Journal of Selected Areas in Communications [[.pdf|papers/infotheory/duffield95entropy.pdf]]\n\n* N. T. Plotkin and C. Roche, ''//The Entropy of Cell Streams as a Traffic Descriptor in ATM Networks//'', IFIP Performance of Communication Networks, October 1995. [[.pdf|papers/infotheory/the-entropy-of-cell.pdf]] [[abstract|abstracts/infotheory/plotkin1995entropy.txt]]\n\n<html><div style="font-size: 12pt">Wireless networks</div></html>\n* Thomas M. Cover, ''//Broadcast Channels//'', IEEE Transactions on Information Theory, 1972. [[pdf|papers/infotheory/cover1972broadcast.pdf]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=cover1972broadcast]]\n\n* ~Liang-Liang Xie and P. R. Kumar, ''//A Network Information Theory for Wireless Communication: Scaling Laws and Optimal Operation//'', IEEE Transactions on Information Theory 2004. [[pdf|papers/infotheory/xie2004inftheorywireless.pdf]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=xie2004inftheorywireless]]\n\n* Xin Liu and R. Srikant, ''//An ~Information-Theoretic View of Connectivity in Wireless Sensor Networks//'', The first IEEE Communications Society Conference on Sensor and Ad Hoc Communications and Networks (SECON), 2004. [[pdf|papers/infotheory/liu2004sensornetconnectivity.pdf]] [[abstract|abstracts/infotheory/liu2004sensornetconnectivity.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=liu2004sensornetconnectivity]]\n\n----\n\n* Piyush Gupta and P. R. Kumar, ''//The Capaticy of Wireless Networks//'', IEEE Transactions on Information Theory, 46, 2, 2000. [[.pdf|papers/infotheory/gupta2000capacity.pdf]] [[abstract|abstracts/infotheory/gupta2000capacity.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=gupta2000capacity]]\n\n* Benyuan Liu, Zhen Liu and Don Towsley, ''//On the Capacity of Hybrid Wireless Networks//'', In Proceedings of INFOCOM 2003. [[pdf|papers/infotheory/liu2003capacity.pdf]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=liu2003capacity]]\n\n<html><div style="font-size: 12pt">Network coding</div></html>\n* Rudolf Ahlswede, Ning Cai, ~Shuo-Yen, Robert Li, and Raymond W. Yeung ''//Network Information Flow//'', IEEE Transactions on Information Theory, July 2000. [[.pdf|papers/infotheory/ahlswede00.pdf]] [[abstract|abstracts/infotheory/ahlswede2000netinfo.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=ahlswede2000netinfo]]\n\n* Tracey Ho, Muriel Medard and Ralf Koetter, ''//An information theoretic view of network management//'', IEEE Transactions on Information Theory, April 2005. [[.pdf|papers/infotheory/mgt-final-figures.pdf]] [[abstract|abstracts/infotheory/ho2005information.txt]]\n\n* M. Laifenfeld and A. Trachtenberg, ''//Disjoint identifying codes for arbitrary graphs//'', IEEE International Symposium on Information Theory, Adelaide, Australia, Sep 2005. [[.pdf|papers/infotheory/disjoint_web.pdf]] [[abstract|abstracts/infotheory/laifenfeld2005disjointcodes.txt]]\n\n<html><div style="font-size: 12pt">Set Reconciliation</div></html>\n* Yaron Minsky, Ari Trachtenberg, and Richard Zippel, ''//Set Reconciliation with Nearly Optimal Communication Complexity//'', IEEE Transactions on Information Theory, vol 49, no. 9. [[.pdf|papers/infotheory/minsky2001setrecon.pdf]] [[abstract|abstracts/infotheory/minsky2001setrecon.txt]]\n\n<html><div style="font-size: 12pt">Cryptography</div></html>\n* A. C. Yao, ''//Theory and applications of trapdoor functions (extended abstract)//'', Proceedings 23rd IEEE FOCS, 1982, 80--91. [[BibTex|showBibTexEntry.php?fn=bibtexs/infotheory.bib&k=yao1982trapdoor]]

[[Oral Exam|NahurOralExam.ppt]]

!Oral Exam\n* [[Classification for Applications of Information Theory to Networks]]\n* Ideas for illustrative experiments\n** [[How verbose is HTTP?]]

![[Home]]\n![[Publications]]\n![[Bookmarks]]\n![[Research]]\n![[Contact]]\n![[CV]]\n\n----\n[[TiddlyWiki|http://www.tiddlywiki.com]]\n

* Will E. Leland, Walter Willinger, Murad S. Taqqu and Daniel V. Wilson, ''//On the ~Self-Similar nature of Ethernet Traffic//'', In Proceedings of SIGCOMM'93, p.183--193. [[.pdf|papers/NetMez/leland1993selfsimilar.pdf]] [[abstract|abstracts/NetMez/leland1993selfsimilar.txt]]\n\n* Srikanth Kandula, Ranveer Chandra, Dina Katabi, ''//What's Going On? Learning Communication Rules In Edge Networks//'', In Proceedings of SIGCOMM 2008. [[.pdf|http://ccr.sigcomm.org/online/files/p87-kandulaA.pdf]] [[abstract|abstracts/NetMez/kandula2008edge.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/measurements.bib&k=kandula2008edge]]\n\n* Ionut Trestian, Aleksandar Kuzmanovic, Supranamaya Ranjan, Antonio Nucci, ''//Unconstrained Endpoint Profiling (Googling the Internet)//'', In Proceedings of SIGCOMM 2008. [[.pdf|http://ccr.sigcomm.org/online/files/p279-trestianA.pdf]] [[abstract|abstracts/NetMez/trestian2008endpoint.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/measurements.bib&k=trestian2008endpoint]]\n\n* Amit Mondal, Aleksandar Kuzmanovic, ''//Removing Exponential Backoff from TCP//'', In CCR, October, 2008. [[.pdf|http://networks.cs.northwestern.edu/publications/extr.pdf]] [[abstract|abstracts/NetMez/mondal2008backoff.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/measurements.bib&k=mondal2008backoff]]\n\n* Sharon Goldberg, David Xiao, Eran Tromer, Boaz Barak, Jennifer Rexford, ''//~Path-Quality Monitoring in the Presence of Adversaries//'', In Proceedings of SIGMETRICS 2008. [[.pdf|papers/NetMez/goldberg2008pathquality.pdf]] [[abstract|abstracts/NetMez/goldberg2008pathquality.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/measurements.bib&k=goldberg2008pathquality]]\n\n* Haiquan Zhao, Ashwin Lall Mitsunori Ogihara, Oliver Spatscheck, Jia Wang, Jum Xu, ''//A Data Streaming Algorithm for Estimating Entropies of OD Flows//'', In Proceedings of IMC 2007. [[.pdf|http://www.imconf.net/imc-2007/papers/imc111.pdf]] [[BibTex|showBibTexEntry.php?fn=bibtexs/measurements.bib&k=zhao2007odentropy]]

<<tabs tabsClass\nPapers "Papers survey" [[NetMezPapers]]\nGroups "Other groups" [[NetMezGroups]]\nConferences "Conferences in the area" [[NetMezConferences]]\nProjects "My projects" [[NetMezProjects]]\nPresentations "My presentations" [[NetMezPresentations]]\n>>

* Robert Kleinberg, ''//Geographic Routing Using Hyperbolic Space//'', In Proceedings of INFOCOM'2007, p.1902--1909. [[.pdf|http://www.cs.cornell.edu/~rdk/papers/pgr.pdf]] [[abstract|abstracts/Networks/kleinberg2007hyperbolic.txt]] [[BibTex|showBibTexEntry.php?fn=bibtexs/network.bib&k=kleinberg2007hyperbolic]]

{{{\n-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: GnuPG v1.4.5 (GNU/Linux)\n\nmQGiBEe1yr4RBADrxtMl8K8XoF6UbNE74x2aIHE/FEyTqlfD6AHkgdG2fB42O62y\n0nUG4473JY+h+VE8//kAASy4LvS8hLcwI/QOhG55qnNLskE3ZkSPg58t6EpESnaN\nY587XwtVLAgY3jQejEMGXuSa1LgKXFkaa+bHQ37i7wyXDRbC+pnmPOqQjwCggUpQ\n7E/RQSlwvngyar4Yint5svEEAIWHhUZoz4HaGnUxRQuDDVvbVw/lyGjXZc6ch73k\nYMQREgSw3fijUKNITmlGDKk7JlJzYv+8TeLOLQ9+9dLyt7DYEUalLFB2GvwihgJJ\nN5Ij7Kk8yb5G7h0wMxLT75oEmJRS2GzYMJNfUdmnARj+GLBEXwOMdgSnPzqLgDZs\nu65BBADkzH5oVq0QRujEepc+C7LoqwvDLsyZs3OAphu0ko3JQx7WkzbDhl9hXd6Q\nbjH4DlyBznhuT0l2X0zvynhyiVgcuWfdlq/m+y8RrRiUTZZVgtSD3L6ZhSM9wG1+\n1dsSx9a720VbIqlFdY1aVZ6cjaQXtwE/imhYzOSPwSeH79FBSLQwTmFodXIgRm9u\nc2VjYSAoQlUvQ1Mga2V5LXBhaXIpIDxuYWh1ckBjcy5idS5lZHU+iGAEExECACAF\nAke1yr4CGwMGCwkIBwMCBBUCCAMEFgIDAQIeAQIXgAAKCRD178M5NBvalwxGAJ0U\nuiH5gKNg6w2cdQqW2Vjex9sqYgCfTLc/3UDliYRzy+Z8E0GTZHE+9CG5Ag0ER7XK\nxBAIALffC6obrlsmseybuZ78LtvvFMw42P3rhJZq6IprWWsKQDEKMJfhEPFx1V5Z\nnnu30hrvybwtb6puPQD4KQsFRpBuugWq/tC0CDOYr3TSS2fRV9C/g3tSNhYMt3ac\nbK7r8GuPdjriwqn8hL0ITYZcZpXnymPBDNd5dc5O5GcwXYn06XtEypnn44jTgkeK\n6gAqNq2TsnsylIX8ZT74XgDVv0xKrWLoHxJHIlHVav0KT88ZZtEbjk+KNZ821E03\n6IqrHetbW/lS1a94rJqEjt34GUkPTvXSigcE9m+3CGF7fCTePMsYZsjvRioln2Ut\n4JU8FoKP+de8tx1b3bU83w7EXVcAAwUH/i0Wa6JSL0+hT8MGu1Q1eFFg4KKg0o9g\n/dZpi7TtsclXlDRvE34UyinTBlBpGNhTwE2bQtXAgcsZrzzBRg3wugKctZUIrXCe\nu/XaimSU/gddPyOAlnCL1F4jO3BSCDDgLtLHepc8h6SUYZ3yoMPTUQruQFmETN6X\n9aynrwRKqww47T7Ge4dsXs51rQfyQWOlFkOvSz6jZTVbC6xgG/AfMgQrpVuGAvWH\nZnW9iPf1pGop0Km2czBad1DXjh6LhEFiJVDfE9AM1jGcIGZtEw5UueqzSYdaKms9\nGfUb7HvHvOVXPIvXv0UENQcMPpEReCoFdUmhf0fkDsG8KS7bfgEqmhiISQQYEQIA\nCQUCR7XKxAIbDAAKCRD178M5NBval1YXAJ47eOQXT1KSqzfRCP4YxgKDb533ngCf\ndfHeWKKIFDqTlj5d3O+fzxkFQ+4=\n=UEV+\n-----END PGP PUBLIC KEY BLOCK-----\n}}}

* Nahur Fonseca, [[Mark Crovella|http://www.cs.bu.edu/~crovella]], [[Kave Salamatian|http://www-rp.lip6.fr/~salamat/]], ''//Long Range Mutual Information//'', ~HotMetrics'08 ([[on-line version|http://hotmetrics08.cs.umn.edu/acceptedpapers/paper4-nahur.pdf]]). Also to appear in ACM Performance Evaluation Review.\n* Nahur Fonseca and [[Mark Crovella|http://www.cs.bu.edu/~crovella]], ''//Bayesian Packet Loss Detection for TCP//'', In Proceedings of INFOCOM'05 [[.pdf|http://www.cs.bu.edu/faculty/crovella/paper-archive/infocom05-tcpbayes.pdf]]\n* Nahur Fonseca, [[Rodolfo S. F. Resende|http://www2.dcc.ufmg.br/~rodolfo/]] and [[Wagner Meira Jr.|http://www2.dcc.ufmg.br/~meira/]], ''//Dynamic Aspects of the Brazilian Web//'', In Proceedings of WISE'00 [[.pdf|papers/dynamicwebbrazil.pdf]]

These are the areas of research that I'm currently interested in.\n* [[Network measurements]]\n* [[Anomaly detection in networks]]\n* [[Use of information theory in the context of networks]]\n* [[Other great papers]]

[img[Nahur Fonseca|images/nahurfonseca.jpg]]Nahur Fonseca

.headerForeground {\npadding: 1em 0em 0em 1em;\n}\n\n.headerShadow {\npadding: 1em 0em 0em 1em;\n}\n\n.viewer th, thead td {\n background: #04b;\n border: 1px solid #666;\n color: #fe8;\n}\n\n.viewer td, .viewer tr {\n border: 1px solid #666;\n}\n\n#mainMenu h0, h1, h2 {\n background: #fff\n}\n\n.tabContents ul li {\n list-style: square outside;\n}\n\n.tabContents ul li ul li {\n list-style: circle outside;\n}\n\n#sidebarTabs .tabContents li {\n list-style: none;\n}

<<tabs tabsClass\nPapers "Papers survey" [[InfoTheoryPapers]]\nGroups "Other groups" [[InfoTheoryGroups]]\nConferences "Conferences in the area" [[InfoTheoryConferences]]\nProjects "My projects" [[InfoTheoryProjects]]\nPresentations "My presentations" [[InfoTheoryPresentations]]\n>>