Scan Detection in High-Speed Networks Based on Optimal Dynamic Bit Sharing
|
|
- Emma Wiggins
- 8 years ago
- Views:
Transcription
1 Scan Detecton n Hgh-Speed Networks Based on Optal Dynac Bt Sharng Tao L Shgang Chen Wen Luo Mng Zhang Departent of Coputer & Inforaton Scence & Engneerng, Unversty of Florda Abstract Scan detecton s one of the ost portant functons n ntruson detecton systes. In order to keep up wth the everhgher lne speed, recent research trend s to pleent scan detecton n fast but sall SRAM. Ths leads to a dffcult techncal challenge because the aount of traffc to be ontored s huge but the on-de eory space for perforng such a ontorng task s very lted. We propose an effcent scan detecton schee based on dynac bt sharng, whch ncorporates probablstc saplng and bt sharng for copact nforaton storage. We desgn a axu lkelhood estaton ethod to extract persource nforaton fro the shared bts n order to deterne the scanners. Our new schee ensures that the false postve/false negatve ratos are bounded wth hgh probablty. Moreover, gven an arbtrary set of bounds, we develop a systeatc approach to deterne the optal syste paraeters that nze the aount of eory needed to eet the bounds. Experents based on a real Internet traffc trace deonstrate that the proposed scan detecton schee reduces eory consupton by three to twenty tes when coparng wth the best exstng work. I. INTRODUCTION Many network-based attacks are preceded wth a reconnassance phase, n whch the attacker or ts zobes scan the hosts n a network to dentfy vulnerablty. As a result, scan detecton s one of the ost fundaental functons n alost any network ntruson detecton syste (IDS). Csco has been pushng for years to buld securty functons nto ts hgh-end routers. Scan detecton s ncreasngly perfored by routers wth securty odules or frewalls that nspect packets [1]. The throughput of hgh-speed lnks has been ncreased fro 10 Mbps to 100 Mbps, ult-ggabts per second, and even terabts per second [2]. Modern frewalls heavly rely on ASIC chps to avod becong bottlenecks n the routng paths. In such a deandng envronent, t s hghly desrable to assst the fundaental IDS functons wth hardware. Specfcally, because scan detecton requres storng a large aount of nforaton extracted fro the packets, DRAM can be too slow. Recent research suggests pleentng ths functon n SRAM [3], [4], [5], [6]. On-de SRAM s fast but expensve. To acheve hgh speed, t s desrable to ake on-de eory sall the access te for a SRAM of tens of klobts s certanly uch saller than the access te for a SRAM of tens of egabts. Moreover, ths hgh-speed eory has to be shared aong other crtcal functons for routng, packet schedulng, traffc anageent and securty purposes. The aount that wll be allocated for onlne scan detecton s lkely to be a sall fracton of the avalable SRAM. Therefore, t s extreely portant to ake scan detecton, as well as other functons pleented n SRAM, eory-effcent. We defne a contact as a source-destnaton par, for whch the source sends a packet to the destnaton. The source or destnaton can be an IP address, a port nuber, or a cobnaton of the together wth other felds n the packet header. The spread of a source s the nuber of dstnct destnatons contacted by the source durng a easureent perod. A source s classfed as a scanner f ts spread exceeds a certan threshold. Therefore, scan detecton s fundaentally an onlne traffc easureent proble. One of the greatest challenges for scan detecton s that the data volue to be stored can be huge. For exaple, the an gateway at our capus observes ore than 10 llon dstnct source-destnaton pars on an average day. Suppose each easureent perod s one day long (n order to catch stealthy low-rate scanners). If we sply store all dstnct source/destnaton address pars for scan detecton, t wll requre ore than 80MB of SRAM, whch s too uch. A ajor thrust n the scan detecton research s to reduce the eory consupton [3], [4], [6], [7], [8]. Reducng eory consupton does not coe for free. The pror research sacrfces detecton accuracy for eory savng. The basc dea s to copress the contact nforaton n lted eory space. The copressed nforaton allows us to estate the spreads of the sources, nstead of countng the exactly. However, the estated spread values ay cause false postves (n whch a non-scanner s stakenly reported as a scanner) and false negatves (n whch a scanner s not reported). Consequently, the followng questons becoe portant for any practcal securty syste: How serous s the false postve/false negatve proble? Can the syste be confgured such that the false postve/false negatve ratos are bounded? To date, few papers drectly addressed these questons. The pror work follows two general ethods for eory reducton: probablstc saplng and storage sharng. The probablstc saplng ethod s to record only a certan percentage of randoly sapled contacts. An exaple s the one-level/two-level algorths proposed by Venkataraan et al [3]. These algorths store the source/destnaton addresses of the sapled contacts n hash tables. Ther an contrbuton s to derve the optal saplng probablty that ensures wth hgh probablty that the false postve/false negatve ratos do not exceed certan pre-defned bounds. However, t s not eory-effcent to drectly store the 1
2 addresses of the contacts ade by each source. A nave soluton s to use per-source counters to record the nuber of packets fro each source. Near-optal counter archtectures such as counter brads [9] requre only a few bts per source. The proble s that counters cannot reove duplcates: A thousand packets fro the sae source to the sae destnaton should count as one contact, nstead of a thousand. In order to reove duplcates, one ay use Bloo flters [3] or btap algorths [7]. They encode the contacts ade by each source n a separate btap, whch autoatcally flters duplcates. However, persource btaps stll take too uch space. Cao et al. use a seres of Bloo flters and a hash table to reduce the nuber of sources that need btaps [8]. Instead of usng a separate btap for each source, an nterestng space-savng ethod s to allow storage sharng, where each data structure s no longer dedcated to a sngle source but shared aong ultple sources. Ths s partcularly necessary when the nuber of sources s ore than the nuber of avalable bts. Zhao et al. [6] encodes each contact n three shared btaps usng a technque slar to Bloo flters. Yoon et al. [4] desgn another storage sharng ethod wth superor perforance. Although both ethods can be used for scan detecton, none of the provdes any eans to ensure that the false postve/false negatve ratos are bounded. Moreover, our experents show that these exstng ethods [8], [6], [4] take far ore eory than the one proposed n ths paper. Also related s the work by Band et al. [10] usng TCAM. Another research branch [10], [11], [12], [13], [14], [15], [16], [17], [18] s to fnd heavy htters,.e., sources that send a lot of packets. A heavy htter ay have a spread value of just one because t ay send all ts packets to the sae destnaton. Hence, heavy htters and scanners are very dfferent. Ths paper proposes an effcent scan detecton schee based on a new storage sharng ethod, called dynac bt sharng, whch shares the avalable bts unforly at rando aong all sources, such that the eory space s fully utlzed for storng contact nforaton. It eploys a axu lkelhood estaton ethod to extract per-source nforaton fro the shared bts n order to deterne the scanners. It also enhances securty through a prvate key. Our new ethod ensures that the false postve/false negatve ratos are bounded. Moreover, gven an arbtrary set of bounds, we show analytcally how to choose the optal syste paraeters such that the aount of eory needed to satsfy the bounds s nzed. We also perfor experents based on a real traffc trace and deonstrate that, usng these optal paraeters, we can reduce the eory consupton by three to twenty tes when coparng wth the best exstng work. II. PROBLEM STATEMENT The nuber of dstnct destnaton addresses that an external source has contacted s called the spread of the source. The proble of scan detecton s to confgure a frewall or an ntruson detecton syste to report all external sources whose spreads exceed a certan threshold durng a easureent perod. We refer to these sources as potental scanners (or scanners for short). If a frewall or an IDS keeps the exact count of dstnct destnatons that each source has contacted, t s able to report the scanners precsely. However, keepng track of per-source nforaton consues a large aount of resources. The lted SRAM ay only allow us to estate a rough count of dstnct destnatons that each source contacts [3], [4], [6]. When precsely reportng scanners s nfeasble, the functon of scan detecton ust be defned n a probablstc ter. We adopt the probablstc perforance objectve fro [3]. Let h and l be two postve ntegers, h > l. Let α and β be two probablty values, 0 < α < 1 and 0 < β < 1. The objectve s to report any source whose spread s h or larger wth a probablty no less than α and report any source whose spread s l or saller wth a probablty no ore than β. Let k be the spread of an arbtrary source src. The objectve can be expressed n ters of condtonal probabltes: Prob{report src as a scanner k h} α Prob{report src as a scanner k l} β We treat the report of a source whose spread s l or saller as a false postve, and the non-report of a source whose spread s h or larger as a false negatve. Hence, the above objectve can also be stated as boundng the false postve rato by β and the false negatve rato by 1 α. Our goal s to nze the aount of SRAM that s needed for achevng the above objectve. The eory requreent for detectng aggressve scanners s lkely to be sall. For exaple, suppose an aggressve scanner akes 100 dstnct contacts each second, whereas a noral host rarely akes 100 dstnct contacts n a day. To detect such a scanner, a frewall can set the easureent perod to be a second. The nuber of contacts that pass the frewall n such a sall perod s lkely to be sall. Consequently, t does not need uch eory to store the. However, the stuaton s totally dfferent for stealthy scanners that ake contacts at low rates. Consder a scanner that akes 500 dstnct contacts a day. If the easureent perod s a day, we are able to set t apart fro the noral hosts. However, f the easureent perod s a second, we wll not detect ths scanner because t akes less than contact per second on average. In order to detect dfferent types of scanners, a frewall ay execute ultple nstances of a scan detecton functon sultaneously, each havng a dfferent easureent perod. For aggressve scanners, a sall perod wll be chosen so that they can be detected n real te. For stealthy scanners, a large perod wll be chosen. In the latter case, tely detecton s of second prorty because the scanners theselves operate slowly. But the eory requreent s of frst prorty due to the large nuber of contacts that are expected to pass through the frewall n a long easureent perod. Reducng eory consupton s the focus of ths paper. III. AN EFFICIENT SCAN DETECTION SCHEME Ths secton presents an effcent scan detecton schee (ESD), whch s the cobnaton of probablstc saplng, (1) 2
3 dynac bt sharng, and axu lkelhood estaton for scanner report. A. Probablstc Saplng To save resources, a frewall (or IDS) saples the contacts ade by external sources to nternal destnatons, and t only stores the sapled contacts. The frewall selects contacts for storage unforly at rando wth a saplng probablty p. The saplng procedure s sple: the frewall hashes the source/destnaton address par of each packet that arrves at the external network nterface nto a nuber n a range [0,N). If the hash result s saller than p N, the contact wll be stored; otherwse, the contact wll not be stored. B. Bt-Sharng Storage A bt array (also called btap) ay be used to store all sapled contacts ade by a source [7]. The bts are ntally zeros. Each sapled contact s hashed to a bt n the btap, and the bt s set to one. At the end of the easureent perod, we can estate the nuber of contacts,.e., the spread of the source, based on the nuber of zeros reanng n the btap. Usng per-source btaps s not eory-effcent. On one hand, the sze of each btap has to be large enough to ensure the accuracy n estatng the spread values of the scanners. On the other hand, the vast ajorty of noral sources have sall spread values and ther btaps are largely wasted because ost bts rean zeros. To solve ths proble, we want to put those wasted bts n good use by allowng btaps to share ther bts. To fully share the avalable bts, ESD stores contacts fro dfferent sources n a sngle bt array B. Let be the nuber of bts n B. For an arbtrary source src, we use a hash functon to pseudo-randoly select a nuber of bts fro B to store the contacts ade by src. The ndces of the selected bts are H(src R[0]), H(src R[1]),..., H(src R[s 1]), where H(...) s a hash functon whose range s [0,), R s an nteger array, storng randoly chosen constants whose purpose s to arbtrarly alter the hash result, and s ( ) s a syste paraeter that specfes the nuber of bts to be selected. The above bts for a logcal btap of source src, denoted as LB(src). Slarly, a logcal btap can be constructed fro B for any other source. Essentally, we ebed the btaps of all possble sources n B. The bt-sharng relatonshp s dynacally deterned on the fly as each new source src whose contacts are sapled by the frewall wll be allocated a logcal btap LB(src ) fro B. At the begnnng of a easureent perod, all bts n B are reset to zeros. Consder an arbtrary contact src, dst that s sapled for storage, where src s the source address and dst s the destnaton address. The frewall sets a sngle bt n B to one. Obvously, t ust also be a bt n the logcal btap LB(src). The ndex of the bt to be set for ths contact s gven as follows: H(src R[H(dst K) od s]). The second hash, H(dst K), ensures that the bt s pseudorandoly selected fro LB(src). The prvate key K s ntroduced to prevent the hash collson attacks. In such an attack, a scanner src fnds a set of destnaton addresses, dst 1, dst 2,..., that have the sae hash value, H(dst 1 ) = H(dst 2 ) =... If t only contacts these destnatons, the sae bt n LB(src) wll be set, whch allows the scanner to stay undetected. Ths type of attacks can be prevented f we use a cryptographc hash functon such as MD5 or SHA1, whch akes t dffcult to fnd destnaton addresses that have the sae hash value. However, f a weaker hash functon s used for perforance reason, then a prvate key becoes necessary. Wthout knowng the key, the scanners wll not be able to predct whch destnaton addresses produce the sae hash value. To store a contact, ESD only sets a sngle bt and perfors two hash operatons. Ths s ore effcent than the ethods that use hash tables [3] or have features slar to Bloo flters that requre settng ultple bts for storng each contact [6]. C. Maxu Lkelhood Estaton and Scanner Report At the end of the easureent perod, ESD wll send the content of B to an offlne data processng center. There, the logcal btap of each sourcesrc s extracted and the estated spread ˆk of the source s coputed. Only f ˆk s greater than a threshold value T, ESD reports the source as a potental scanner. We wll dscuss how to keep track of the source addresses n Secton III-D, and explan how to deterne the threshold T n Secton IV. Below we derve the forula for ˆk. Let k be the true spread of source src, and n be the nuber of dstnct contacts ade by all sources. Let V be the fracton of bts n B whose values are zeros at the end of the easureent perod, V s be the fracton of bts n LB(src) whose values are zeros, and U s be the nuber of bts n LB(src) whose values are zeros. Clearly, V s = Us s. Dependng on the context, V (or V s, U s ) s used ether as a rando varable or an nstance value of the rando varable. The probablty for any contact to be sapled for storage s p. Consder an arbtrary bt b n LB(src). A sapled contact ade bysrc has a probablty of 1 s to set b to 1, and a sapled contact ade by any other source has a probablty of 1 to set b to 1. Hence, the probablty q(k) for b to rean 0 at the end of the easureent perod s q(k) = (1 p )n k (1 p s )k. (2) Each bt n LB(src) has a probablty of q(k) to rean 0. The observed nuber of 0 bts n LB(src) s U s. The lkelhood functon for ths observaton to occur s gven as follows: L = q(k) Us (1 q(k)) s Us. (3) In the standard process of axu lkelhood estaton, the unknown value k s techncally treated as a varable n (3). We want to fnd an estate ˆk that axzes the lkelhood functon. Naely, ˆk = arg ax{l}. (4) k 3
4 Snce the axa s not affected by onotone transforatons, we use logarth to turn the rght sde of (3) fro product to suaton: ln(l) = U s ln(q(k))+(s U s ) ln(1 q(k)). Fro (2), the above equaton can be wrtten as ln(l) =U s ((n k)ln(1 p )+kln(1 p s )) +(s U s ) ln(1 (1 p )n k (1 p s )k ). To fnd the axa, we dfferentate both sdes: ln(l) k = ln( 1 p s 1 p We then let the rght sde be zero. That s, ) Us s(1 p )n k (1 p s )k 1 (1 p )n k (1 p. (5) s )k U s = s(1 p )n k (1 p s )k. (6) Takng logarth on both sdes, we have ln U s s = nln(1 p )+k(ln(1 p s ) ln(1 p )), k = lnv s nln(1 p ) ln(1 p s ) ln(1 p (7) ). where V s = Us s. Suppose the nuber of sources (whch equals to the nuber of logcal btaps) s suffcently large. Because every bt n every logcal btap s randoly selected fro B, n ths sense, each of the n contacts has about the sae probablty p of settng any bt n B. Hence, we have Applyng (8) to (7), we have E(V ) = (1 p )n. (8) lnv s lne(v ) k = ln(1 p s ) ln(1 p (9) ). Replacng E(V ) by the nstance value V, we have the followng estaton for k. lnv s lnv ˆk = ln(1 p s ) ln(1 p (10) ), where V s can be easured by countng the nuber of zeros n LB(src), V can be easured by countng the nuber of zeros n B, and s, p and are pre-set paraeters of ESD (see the next secton). D. Source Addresses ESD does not store the source address of every arrval packet. Instead, t stores a source address only when a contact sets a bt n B fro 0 to 1. Hence, the frequency of storng source addresses s uch saller than the frequency at whch contacts are sapled for settng bts n B. Frst, nuerous packets ay be sent fro a source to a destnaton n a TCP/UDP sesson. Only the frst sapled packet ay cause the source address to be stored because only the frst packet sets a bt fro 0 to 1 and the reanng packets wll set the sae bt (whch s already 1 ). Second, a source ay send thousands or even llons of packets through a frewall, but the nuber of tes ts address wll be stored s bounded by s (whch s the nuber of bts n the source s logcal btap). In suary, because the operaton of storng source addresses s relatvely nfrequent, these addresses can be stored n the an eory. IV. OPTIMAL SYSTEM PARAMETERS AND MINIMUM MEMORY REQUIREMENT In ths secton, we frst develop the constrants that the syste paraeters ust satsfy n order to acheve the probablstc perforance objectve. Based on the constrants, we deterne the optal values for the sze s of the logcal btaps, the saplng probablty p, and the threshold T. We also deterne the nu aount of eorythat should be allocated for ESD to acheve the perforance objectve. Recall that on-de SRAM ay be shared by other functons. A. Report Probablty Consder an arbtrary source src whose spread s k. Gven a set of syste paraeters,,s,pandt, we derve the probablty for ESD to reportsrc as a scanner,.e.,prob{ˆk T}. Fro (10), we know that the followng nequaltes are equvalent. ˆk T lnv s lnv ln(1 p s ) ln(1 p ) T V s V ( 1 p s 1 p ) T Let U s be the rando varable for the nuber of 0 bts n LB(src). U s = s V s. The above nequalty becoes U s s V ( 1 p s 1 p ) T. (11) For a set of paraeters, s, p and T, we defne a constant C = s V ( 1 p s 1 p ) T, where the nstance value of V can be easured fro B after the easureent perod. Hence, the probablty for ESD to report src s Prob{ˆk T} = Prob{U s C}. U s follows the bnoal dstrbuton wth paraeters s and q(k), where q(k) n (2) s the probablty for an arbtrary bt n LB(src) to rean zero at the end of the easureent perod. Hence, the probablty of havng exactly zeros n LB(src) s gven by the followng probablty ass functon: Prob{U s = } = We ust have =0 ( s ) q(k) (1 q(k)) s. (12) Prob{ˆk T} = Prob{U s C} = q(k) (1 q(k)) s. (13) 4
5 Std(V )/E(V ) LF=0.5 LF=1 LF= (*100KB) Std(V Fg. 1. The relatve standard devaton, ), approaches to zero as E(V ) ncreases. The load factor (LF) s defned as n p/, where n p s the nuber of dstnct contacts that are sapled by ESD for storage. In our experents (reported n Secton V), when we use the syste paraeters deterned by the algorth proposed n ths secton, the load factor never exceeds 2. B. Constrants for the Syste Paraeters We derve the constrants that the syste paraeters ust satsfy n order to acheve the perforance objectve n (1). Frst, we gve the varance of V, whch s derved n Appendx A. Var(V ) e np (1 (1+ np2 )e np ). (14) It approaches to zero as ncreases. In Fgure 1, we plot the rato of the standard devaton Std(V ) = Var(V ) to E(V ), whch can be found n (8). The fgure shows that Std(V )/E(V ) s very sall when s reasonably large. In ths case, we can approxately treat V as a constant. V E(V ) (1 p )n. (15) The probablstc perforance objectve can be stated as two requreents. Frst, the probablty for ESD to report a source wth k h ust be at least α. That s, Prob{ˆk T} α, k h. Fro (13), ths requreent can be wrtten as the followng nequalty: =0 where C = s V ( 1 p s 1 p q(k) (1 q(k)) s α, ) T s (1 p )n ( 1 p s ) T. The 1 p left sde of the nequalty s an ncreasng functon n k. Hence, to satsfy the requreent n the worst case when k = h, the followng constrant for the syste paraeters ust be et: =0 q(h) (1 q(h)) s α. (16) Second, the probablty for ESD to report a source wth k l ust be no ore than β. Ths requreent can be slarly converted nto the followng constrant: =0 q(l) (1 q(l)) s β. (17) C. Optal Syste Paraeters Our goal s to optze the syste paraeters such that the eory requreent,, s nzed under the constrants (16) and (17). The proble s forally defned as follows. Mnze (18) Subject to q(h) (1 q(h)) s α, =0 =0 q(l) (1 q(l)) s β, C = s (1 p )n ( 1 p s 1 p ) T. The paraeters, h, l, α and β, are specfed n the perforance objectve. The value of n s decded based on the hstory data n the past easureent perods. To be conservatve, we take the the axu nuber n of dstnct contacts observed n a nuber of prevous easureent perods. More specfcally, (8) can be turned nto a forula for estatng n n each prevous perod f we replace E(V ) wth the nstance value V. ˆn = p lnv (19) We derve the relatve bas and the relatve standard devaton of the above estaton. Bas(ˆn n ) = E(ˆn np e ) 1 n np2 1 2np (20) Std(ˆn n ) = np np 2 (e np 1)1/2 (21) They both approach to zero as ncreases. Based on the largest ˆn value observed n a certan nuber of past easureent perods, we can set the value of n. To solve the constraned optzaton proble (18), we need to deterne the optal values of the reanng three syste paraeters, s, p and T, such that wll be nzed. We consder the left sde of (16) as a functon F h (,s,p,t), and the left sde of (17) as F l (,s,p,t). Naely, F h (,s,p,t) = q(h) (1 q(h)) s, =0 F l (,s,p,t) = q(l) (1 q(l)) s. =0 Both of the are non-ncreasng functons n T, accordng to the relaton between C and T. In the followng, we present an teratve nuercal algorth to solve the optzaton proble. The algorth conssts of four procedures. Frst, we construct a procedure called P otental(, s, p), whch takes a value of, a value of s and a value of p as nput and returns the axu value of F h (,s,p,t) under the condton that F l (,s,p,t) β s satsfed. Because F h (,s,p,t) s a non-ncreasng functon n T, we need to fnd the sallest value of T that satsfes F l (,s,p,t) β. 5
6 That can be done nuercally through bnary search: Pck a sall nteger T 1 such that F l (,s, p,t 1 ) β and a large nteger T 2 such that F l (,s,p,t 2 ) β. We teratvely shrnk the dfference between the by resettng one of the to be the average T1+T2 2, whle antanng the nequaltes, F l (,s,p,t 1 ) β and F l (,s,p,t 2 ) β. The process stops when T 1 = T 2, whch s denoted as T. The procedure Potental(,s,p) returns F h (,s,p,t ). The pseudo code s presented n Algorth 1. We wll ot the pseudo code for the other three procedures to save space. Algorth 1 P otental(, s, p) INPUT:,s,p and β OUTPUT: The axu value of F h (,s,p,t) under the condton that F l (,s,p,t) β. Pck a sall nteger T 1 such that F l (,s,p,t 1) > β and a large nteger T 2 such that F l (,s,p,t 2) β. whle T 2 T 1 > 1 do T = (T 1 +T 2)/2 f F l (,s,p, T) β then T 1 = T else T 2 = T end f end whle T = T return F h (,s,p,t ) Essentally, what P otental(, s, p) returns s the axu value of the left sde n (16) under the condton that (17) s satsfed. The dfference between P otental(, s, p) and α provdes us wth a quanttatve ndcaton on how conservatve or aggressve we have chosen the value of. If Potental(,s,p) α s postve, t eans that the perforance acheved by the current eory sze s ore than requred. We shall reduce. On the contrary, f P otental(, s,p) α s negatve, we shall ncrease. Gven the above seantcs, when we deterne the optal values for p and s, our goal s certanly to axze the return value of Potental(,s,p). Second, gven a value of and a value of s, we construct a procedure OptalP(, s) that deternes the optal value p such that Potental(,s,p ) s axzed. When the values of and s are fxed, Potental(,s,p) becoes a functon of p. It s a curve as llustrated n Fgure 3; see explanaton under the capton (a) and gnore the arrows n the fgure for now. We use a bnary search algorth to fnd a near-optal value of p. Let p 1 = 0 and p 2 = 1. Let δ be a sall postve value (such as 0.001). Repeat the followng operaton: Let p = (p 1 + p 2 )/2. If Potental(,s, p) < Potental(,s, p+δ), set p 1 to be p; otherwse, set p 2 to be p. The above teratve operaton stops when p 2 p 1 < δ. The procedure OptalP(,s) returns (p 1 +p 2 )/2, whch s wthn ±δ/2 of the optal. Ths dfference can be ade arbtrarly sall when we decrease δ at the expense of ncreased coputaton overhead. We want to stress that t s one-te overhead (not onlne overhead) Potental(, s, p) p p Fg. 2. (A) The curve (wthout the arrows) shows the value of Potental(,s,p) wth respect to p when = 0.45MB and s = 150. Its non-sooth appearance s due to n the forula of F h (,s,p,t ). F h (,s,p,t ) depends on the values of and q(h), whch are both functons of p. (B) The arrows llustrate the operaton of OptalP(, s). In the frst teraton (arrow 1 ), p 2 s set to be (p 1 + p 2 )/2. In the second teraton (arrow 2 ), p 1 s set to be (p 1 +p 2 )/2. In the thrd teraton (arrow 3 ), p 2 s set to be (p 1 +p 2 )/2. Potental(, s, OptalP(, s)) p Fg. 3. The value of Potental(,s,OptalP(,s)) wth respect to s when = 0.25MB. nuber of sources s spread (k) Fg. 4. Traffc dstrbuton: each pont shows the nuber of sources havng a certan spread value. to deterne the syste paraeters before deployent. The operaton of OptalP(,s) s llustrated by the arrows n Fgure 2; see explanaton under the capton (b). Thrd, gven a value of, we construct a procedure OptalS () that deternes the optal value s such that Potental(,s,OptalP(,s )) s axzed. When the value of s fxed, P otental(, s, OptalP(, s)) becoes a functon of s. It s a curve as llustrated n Fgure 3. We can use a bnary search algorth slar to that of OptalP(,s) to fnd s. Fourth, we construct a procedure OptalM() that deternes the nu eory requreent through bnary search: Denote P otental(, OptalS(), OptalP(, OptalS())) as Potental(,...). Pck a sall value 1 such that Potental( 1,...) α, whch eans that the perforance objectve s not et ore specfcally, accordng to the seantcs of P otental(...), the constrant (16) cannot be satsfed f the constrant (17) s satsfed. Pck a large value 6
7 2 such that Potental( 2,...) α, whch eans that the perforance objectve s et. Repeat the followng operaton. Let = ( )/2. If Potental(,...) α, set 1 to be ; otherwse, set 2 to be. The above teratve operaton ternates when 1 = 2, whch s returned by the procedure OptalM(). In practce, a network adnstrator wll frst defne the perforance objectve that s specfed by α, β, h and l. He or she sets the value of n based on hstory data, and then sets = OptalM(), s = OptalS(), p = OptalP(,s) and T as the threshold value T before the last call to P otental(, s, p) s returned durng the executon of OptalM(). After the frewall (or IDS) s confgured wth these paraeters and begns to easure the network traffc, t also ontors the value of n. If the axu nuber of dstnct contacts n a easureent perod changes sgnfcantly, the values of, s, p and T wll be recoputed. A. Experental Setup V. EXPERIMENTS We evaluate the perforance of ESD and copare t wth the exstng work, ncludng the Two-level Flterng Algorth (TFA) [3], the Thresholded Btap Algorth (TBA) [8], and the Copact Spread Estator (CSE) [4]. TFA uses two flters to reduce both the nuber of sources to be ontored and the nuber of contacts to be stored. It s desgned to satsfy the probablstc perforance objectve n (1). TBA s not desgned for eetng the probablstc perforance objectve. It cannot ensure that the false postve/false negatve ratos are bounded. CSE s desgned to estate the spreads of the external sources n a very copact eory space. It can be used for scan detecton by reportng the sources whose estated spreads exceed a certan threshold. However, the desgn of CSE akes t unsutable for eetng the objectve n (1). Onlne Streang Module (OSM) [6] s another related work. We do not pleent OSM n ths study because Yoon et al. show that, gven the sae aount of eory, CSE estates spread values ore accurately than OSM [4]. Moreover, the operatons of OSM share certan slarty wth Bloo flters. To store each contact, t perfors three hash functons and akes three eory accesses. In coparson, ESD perfors two hash functons and akes one eory access. The experents use a real Internet traffc trace captured by Csco s Netflow at the an gateway of our capus for a week. For exaple, n one day of the week, the traffc trace records 10,702,677 dstnct contacts, 4,007,256 dstnct source IP addresses and 56,167 dstnct destnaton addresses. The average spread per source s 2.67, whch eans a source contacts 2.67 dstnct destnatons on average. Fgure 4 shows the nuber of sources wth respect to the source spread n log scale. The nuber of sources decreases exponentally as the spread value ncreases fro 1 to 500. After that, there s zero, one or a few sources for each spread value. We pleent ESD, TFA, TBA and CSE, and execute the wth the traffc trace as nput. As part of the setup n each experent, the values of h and l are gven to specfy what to report as scanners. For exaple, f h = 500 and l = 0.7h, the sources whose spreads are 500 or ore should be reported, and the sources whose spreads are 350 or less should not be reported. In the experents, the source of a contact s the IP address of the sender and the destnaton s the IP address of the recever. The easureent perod s one day. A long easureent perod helps to separate low-rate scanners fro noral hosts. The experental results are the average over the week-long data. One perforance etrc used n coparson s the aount of eory that s requred for a scan detecton schee to eet a gven probablty perforance objectve. Rearkably, the nuber of bts requred by ESD s far saller than the nuber of dstnct sources n the traffc trace. That s, ESD requres uch less than 1 bt per source to perfor scan detecton. Other perforance etrcs nclude the false postve rato and the false negatve rato, whch wll be explaned further shortly. B. Coparson n Ters of Meory Requreent The frst set of experents copares ESD and TFA for the aount of eory that they need n order to satsfy a gven probablstc perforance objectve, whch s specfed by four paraeters, α, β, h, and l. See Secton II for the foral defnton of the perforance objectve. We do not copare TBA and CSE here because they are not desgned to eet ths objectve. The eory requred by ESD s deterned based on the teratve algorth n Secton IV-C. The values of other paraeters, s, T and p, are decded by the sae algorth. Usng these paraeters, we perfor experents on ESD wth the traffc trace as nput, and the experental results confr that the perforance objectve s ndeed acheved for each day durng the week. The aount of eory requred by TFA s deterned experentally based on the ethod n [3] together wth the traffc trace. The paraeters of TFA are chosen based on the orgnal paper. The eory requreents of ESD and TFA are presented n Tables I-III wth respect to α, β, h and l. For α = 0.9 and β = 0.1, Table I shows that TFA requres sx to twentyfour tes of the eory that ESD requres, dependng on the values of h and l (whch the syste adnstrator wll select based on the organzaton s securty polcy). For exaple, when h = 500 and l = 0.5h, ESD reduces the eory consupton by an order of agntude when coparng wth TFA. To deonstrate the pact of probablstc saplng, the table also ncludes the eory requreent of ESD when saplng s turned off (by settng p = 1). Ths verson of ESD s denoted as ESD-1. Snce p s set as a constant, the teratve algorth n Secton IV-C needs to be slghtly odfed: The procedure OptalP(, s) wll always return 1, whle other procedures rean the sae. Table I shows that the eory saved by saplng s sgnfcant when h s large. For exaple, when h = 5,000 and l = 0.3h, ESD wth saplng uses less than one thrteenth of the eory that s needed by ESD-1. However, when h becoes saller or l h becoes larger, ESD has to choose a larger saplng probablty n order to lt the 7
8 TABLE I MEMORY REQUIREMENTS (IN MB) OF ESD, TFA AND ESD-1 (I.E. ESD WITH p = 1) WHEN α = 0.9 AND β = 0.1. l = 0.1h l = 0.3h l = 0.5h l = 0.7h h ESD TFA ESD-1 ESD TFA ESD-1 ESD TFA ESD-1 ESD TFA ESD TABLE II MEMORY REQUIREMENTS (INMB) OF ESD, TFA AND ESD-1 (I.E. ESD WITHp = 1) WHEN α = 0.95 AND β = l = 0.1h l = 0.3h l = 0.5h l = 0.7h h ESD TFA ESD-1 ESD TFA ESD-1 ESD TFA ESD-1 ESD TFA ESD TABLE III MEMORY REQUIREMENTS (INMB) OF ESD, TFA AND ESD-1 (I.E. ESD WITHp = 1) WHEN α = 0.99 AND β = l = 0.1h l = 0.3h l = 0.5h l = 0.7h h ESD TFA ESD-1 ESD TFA ESD-1 ESD TFA ESD-1 ESD TFA ESD error n spread estaton caused by saplng. Consequently, t has to store ore contacts and thus requre ore eory. For nstance, when h = 500 and l = 0.5h, ESD wth saplng uses 55.6% of the eory that s needed by ESD-1. Table II copares the eory requreents of ESD and TFA when α = 0.95 and β = Table III copares the eory requreents when α = 0.99 and β = They show slar results: (1) ESD uses sgnfcantly less eory than TFA, and (2) the probablstc saplng ethod n ESD s crtcal for eory savng especally when h s large or l h s sall. The tables also deonstrate that the eory requreent of ether ESD or TFA ncreases when the perforance objectve becoes ore strngent,.e., α s set larger and β saller. TFA requres ore eory because t stores the source and destnaton addresses of the contacts. In [5], the authors also ndcate that Bloo Flters [19], [20] can be used to reduce the eory consupton. However, the paper does not gve detaled desgn or paraeter settngs. Therefore, we cannot pleent the Bloo-flter verson of TFA. The paper clas that the eory requreent wll be reduced by a factor of 2.5 when Bloo flters are used. Even when ths factor s taken nto account n Tables I-III, eory savng by ESD wll stll be sgnfcant. C. Coparson n Ters of False Postve Rato and False Negatve Rato The false postve rato (FPR) s defned as the fracton of all non-scanners (whose spreads are no ore than l) that are stakenly reported as scanners. The false negatve rato (FNR) s the fracton of all scanners (whose spreads are no less than h) that are not reported by the syste. In the prevous subsecton, we have shown that, gven the bounds of FPR and FNR, t takes ESD uch less eory to acheve the bounds than TFA. Snce CSE and TBA are not desgned for eetng a gven set of bounds, we copare our ESD wth the by a dfferent set of experents that easure and copare the FPR and FNR values under a fxed aount of SRAM. Gven a fxed eory sze, we use OptalS(, s) n Secton IV-C to deterne the value of s n ESD, use OptalP(, s) to deterne the value of p, and then set the threshold T as h+l 2. We perfor experents usng the weeklong traffc trace. For = 0.05MB and 0.2MB, the results are presented n Tables IV and V, respectvely. In both tables, l = 0.5h. We also perfor the sae experents for CSE and TBA, and the results are presented n the tables as well. The optal paraeters are chosen for each schee based on the orgnal papers. When the avalable eory s very sall, such as 0.05MB n Table IV, CSE has zero FNR but ts FPR s 1.0, whch eans t reports all non-scanners. The reason s that, wthout probablstc saplng, CSE stores nforaton of too any contacts such that ts data structure s fully saturated. In ths case, the spread estaton ethod of CSE breaks down. TBA has a sall FPR but ts FNR s large. For exaple, when h = 500, ts FNR s 26%. Only ESD acheves sall values for both FNR and FPR. For exaple, when h = 500, ts FNR 8
9 TABLE IV FALSE NEGATIVE RATIO AND FALSE POSITIVE RATIO OF ESD, CSE AND TBA WITH = 0.05MB. FNR FPR h ESD CSE TBA ESD CSE TBA e e-1 5.0e e e e-1 5.5e e e e-1 2.0e e e e-1 2.0e e e-1 2.0e e e-1 2.0e e-6 TABLE V FALSE NEGATIVE RATIO AND FALSE POSITIVE RATIO OF ESD, CSE AND TBA WITH = 0.2MB. FNR FPR h ESD CSE TBA ESD CSE TBA e-2 3.3e-2 3.7e-3 1.5e-3 1.2e-1 1.8e e e-3 7.5e-4 5.5e-2 1.9e e-3 7.5e-4 5.5e-2 2.0e e-3 7.5e-4 5.5e-2 1.8e e-3 7.5e-4 5.5e-2 1.9e e-3 7.5e-4 5.5e-2 1.8e-4 s 7.4% and ts FPR s 5.0%. These values decrease quckly as h ncreases. When h = 1,000, they are 1.0% and 0.55%, respectvely, whle the FNR of TBA reans to be 26%. When the avalable eory ncreases n Table V, the perforance of all three schees proves. Stll, ESD perfors better n ost cases. VI. CONCLUSIONS Scan detecton s one of the ost portant functons n ntruson detecton systes. The recent research trend s to pleent such a functon n the tght SRAM space to catch up wth the rapd advance n network speed. Ths paper proposes an effcent scan detecton schee based on a new ethod called dynac bt sharng, whch optally cobnes probablstc saplng, bt-sharng storage, and axu lkelhood estaton. We deonstrate theoretcally and experentally that the new schee s able to acheve a probablstc perforance objectve wth arbtrarly-set bounds on worst-case false postve/negatve ratos. It does so n a very tght eory space where the nuber of bts avalable s uch saller than the nuber of external sources to be ontored. REFERENCES [1] R. Deal, Csco Router Frewall Securty, Csco Press, ISBN-10: , August [2] W. Davd Gardner, Researchers Transt Optcal Data At 16.4 Tbps, InforatonWeek, February [3] S. Venkatataan, D. Song, P. Gbbons, and A. Blu, New Streang Algorths for Fast Detecton of Superspreaders, Proc. of NDSS, February [4] M. Yoon, T. L, and S. Chen, Ft a Spread Estator n Sall Meory, Proc. of IEEE INFOCOM, Aprl [5] Q. Zhao, A. Kuar, and J. Xu, Jont Data Streang and Saplng Technques for Accurate Identfcaton of Super Sources/Destnatons, Proc. of USENIX/ACM Internet Measureent Conference, October [6] Q. Zhao, J. Xu, and A. Kuar, Detecton of Super Sources and Destnatons n Hgh-Speed Networks: Algorths, Analyss and Evaluaton, IEEE Journal on Selected Areas n Councatons (JASC), vol. 24, no. 10, pp , October [7] C. Estan, G. Varghese, and M. Fsh, Btap Algorths for Countng Actve Flows on Hgh-Speed Lnks, IEEE/ACM Transactons on Networkng (TON), vol. 14, no. 5, pp , October [8] J. Cao, Y. Jn, A. Chen, T. Bu, and Z. Zhang, Identfyng Hgh Cardnalty Internet Hosts, Proc. of IEEE INFOCOM, Aprl [9] Y. Lu, A. Montanar, B. Prabhakar, S. Dharapurkar, and A. Kabban, Counter Brads: A Novel Counter Archtecture for Per-Flow Measureent, Proc. of ACM SIGMETRICS, June [10] N. Band, D. Agrawal, and A. Abbad, Fast Algorths for Heavy Dstnct Htters usng Assocatve Meores, Proc. of IEEE Internatonal Conference on Dstrbuted Coputng Systes(ICDCS), June [11] M. Charkar, K. Chen, and M. Farach-Colton, Fndng Frequent Ites n Data Streas, Proc. of Internatonal Colloquu on Autoata, Languages, and Prograng (ICALP), July [12] G. Corode and S. Muthukrshnan, Space Effcent Mnng of Multgraph Streas, Proc. of ACM PODS, June [13] E. Deane, A. Lopez-Ortz, and J. Ian-Munro, Frequency Estaton of Internet Packet Streas wth Lted Space, Proc. of Annual European Syposu on Algorths (ESA), Septeber [14] X. Dtropoulos, P. Hurley, and A. Knd, Probablstc Lossy Countng: An Effcent Algorth for Fndng Heavy Htters, ACM SIGCOMM Coputer Councaton Revew, vol. 38, no. 1, January [15] C. Estan and G. Varghese, New Drectons n Traffc Measureent and Accountng, Proc. of ACM SIGCOMM, October [16] P. Gbbons and Y. Matas, New Saplng-based Suary Statstcs for Iprovng Approxate Query Answers, Proc. of ACM SIGMOD, June [17] G. Manku and R. Motwan, Approxate Frequency Counts over Data Streas, Proc. of VLDB, August [18] Y. Zhang, S. Sngh, S. Sen, N. Duffeld, and C. Lund, Onlne Identfcaton of Herarchcal Heavy Htters: Algorths, Evaluaton, and Applcaton, Proc. of ACM SIGCOMM IMC, October [19] B. H. Bloo, Space/Te Trade-offs n Hash Codng wth Allowable Errors, Councatons of the ACM, vol. 13, no. 7, pp , [20] A. Broder and M. Mtzenacher, Network Applcatons of Bloo Flters: A Survey, Internet Matheatcs, vol. 1, no. 4, June APPENDIX A: VARIANCE OF V Let A be the event that the th bt n B reans 0 at the end of the easureent perod and 1 A be the correspondng ndcator rando varable. Let U be the rando varable for the nuber of 0 bts n B. We frst derve the probablty for A to occur and the expected value of U. For an arbtrary bt n B, each dstnct contact has a probablty of p to set the bt to one. All contacts are ndependent of each other when settng bts n B. Hence, Prob{A } = (1 p )n, [0,s). The probablty for A and A j,,j [0,), j, to happen sultaneously s Prob{A A j} = (1 2p )n. Snce V = U and U = =1 1 A, we have E(V) 2 = 1 2E(( 1 A ) 2 ) =1 = 1 2E( 1 2 A )+ 2 2E( =1 1 <j = 1 (1 p )n + 1 (1 2p )n. Based on (8) and the equaton above, we have Var(V ) = E(V 2 ) E(V ) 2 1 A 1 Aj ) = 1 (1 p )n + 1 (1 2p )n (1 p )2n np e (1 (1+ np 2 )e np ). (22) 9
How Much to Bet on Video Poker
How Much to Bet on Vdeo Poker Trstan Barnett A queston that arses whenever a gae s favorable to the player s how uch to wager on each event? Whle conservatve play (or nu bet nzes large fluctuatons, t lacks
More informationAn Electricity Trade Model for Microgrid Communities in Smart Grid
An Electrcty Trade Model for Mcrogrd Countes n Sart Grd Tansong Cu, Yanzh Wang, Shahn Nazaran and Massoud Pedra Unversty of Southern Calforna Departent of Electrcal Engneerng Los Angeles, CA, USA {tcu,
More informationTwo-Phase Traceback of DDoS Attacks with Overlay Network
4th Internatonal Conference on Sensors, Measureent and Intellgent Materals (ICSMIM 205) Two-Phase Traceback of DDoS Attacks wth Overlay Network Zahong Zhou, a, Jang Wang2, b and X Chen3, c -2 School of
More informationStochastic Models of Load Balancing and Scheduling in Cloud Computing Clusters
Stochastc Models of Load Balancng and Schedulng n Cloud Coputng Clusters Sva Theja Magulur and R. Srkant Departent of ECE and CSL Unversty of Illnos at Urbana-Chapagn sva.theja@gal.co; rsrkant@llnos.edu
More informationStochastic Models of Load Balancing and Scheduling in Cloud Computing Clusters
Stochastc Models of Load Balancng and Schedulng n Cloud Coputng Clusters Sva Theja Magulur and R. Srkant Departent of ECE and CSL Unversty of Illnos at Urbana-Chapagn sva.theja@gal.co; rsrkant@llnos.edu
More informationStochastic Models of Load Balancing and Scheduling in Cloud Computing Clusters
01 Proceedngs IEEE INFOCOM Stochastc Models of Load Balancng and Schedulng n Cloud Coputng Clusters Sva heja Magulur and R. Srkant Departent of ECE and CSL Unversty of Illnos at Urbana-Chapagn sva.theja@gal.co;
More informationA Statistical Model for Detecting Abnormality in Static-Priority Scheduling Networks with Differentiated Services
A Statstcal odel for Detectng Abnoralty n Statc-Prorty Schedulng Networks wth Dfferentated Servces ng L 1 and We Zhao 1 School of Inforaton Scence & Technology, East Chna Noral Unversty, Shangha 0006,
More informationTheHow and Why of Having a Successful Home Office
Near Optal Onlne Algorths and Fast Approxaton Algorths for Resource Allocaton Probles Nkhl R Devanur Kaal Jan Balasubraanan Svan Chrstopher A Wlkens Abstract We present algorths for a class of resource
More informationBANDWIDTH ALLOCATION AND PRICING PROBLEM FOR A DUOPOLY MARKET
Yugoslav Journal of Operatons Research (0), Nuber, 65-78 DOI: 0.98/YJOR0065Y BANDWIDTH ALLOCATION AND PRICING PROBLEM FOR A DUOPOLY MARKET Peng-Sheng YOU Graduate Insttute of Marketng and Logstcs/Transportaton,
More informationLuby s Alg. for Maximal Independent Sets using Pairwise Independence
Lecture Notes for Randomzed Algorthms Luby s Alg. for Maxmal Independent Sets usng Parwse Independence Last Updated by Erc Vgoda on February, 006 8. Maxmal Independent Sets For a graph G = (V, E), an ndependent
More informationA Novel Dynamic Role-Based Access Control Scheme in User Hierarchy
Journal of Coputatonal Inforaton Systes 6:7(200) 2423-2430 Avalable at http://www.jofcs.co A Novel Dynac Role-Based Access Control Schee n User Herarchy Xuxa TIAN, Zhongqn BI, Janpng XU, Dang LIU School
More informationMaximizing profit using recommender systems
Maxzng proft usng recoender systes Aparna Das Brown Unversty rovdence, RI aparna@cs.brown.edu Clare Matheu Brown Unversty rovdence, RI clare@cs.brown.edu Danel Rcketts Brown Unversty rovdence, RI danel.bore.rcketts@gal.co
More informationINTRODUCTION TO MERGERS AND ACQUISITIONS: FIRM DIVERSIFICATION
XV. INTODUCTION TO MEGES AND ACQUISITIONS: FIM DIVESIFICATION In the ntroducton to Secton VII, t was noted that frs can acqure assets by ether undertakng nternally-generated new projects or by acqurng
More informationPacket Reorderng Analysis
On Montorng of End-to-End Packet Reorderng over the Internet Bn Ye 1 Anura P. Jayasuana 1 Nschal M. Pratla 2 1Coputer Networkng Research laboratory, Colorado State Unversty, Fort Collns, CO 8523, USA 2
More informationBasic Queueing Theory M/M/* Queues. Introduction
Basc Queueng Theory M/M/* Queues These sldes are created by Dr. Yh Huang of George Mason Unversty. Students regstered n Dr. Huang's courses at GMU can ake a sngle achne-readable copy and prnt a sngle copy
More informationAn Error Detecting and Tagging Framework for Reducing Data Entry Errors in Electronic Medical Records (EMR) System
201 IEEE Internatonal Conference on Bonforatcs and Boedcne An Error Detectng and Taggng Fraework for Reducng Data Entry Errors n Electronc Medcal Records (EMR Syste Yuan Lng, Yuan An College of Coputng
More informationModule 2 LOSSLESS IMAGE COMPRESSION SYSTEMS. Version 2 ECE IIT, Kharagpur
Module LOSSLESS IMAGE COMPRESSION SYSTEMS Lesson 3 Lossless Compresson: Huffman Codng Instructonal Objectves At the end of ths lesson, the students should be able to:. Defne and measure source entropy..
More informationQuality of Service Analysis and Control for Wireless Sensor Networks
Qualty of ervce Analyss and Control for Wreless ensor Networs Jaes Kay and Jeff Frol Unversty of Veront ay@uv.edu, frol@eba.uv.edu Abstract hs paper nvestgates wreless sensor networ spatal resoluton as
More informationOnline Algorithms for Uploading Deferrable Big Data to The Cloud
Onlne lgorths for Uploadng Deferrable Bg Data to The Cloud Lnquan Zhang, Zongpeng L, Chuan Wu, Mnghua Chen Unversty of Calgary, {lnqzhan,zongpeng}@ucalgary.ca The Unversty of Hong Kong, cwu@cs.hku.hk The
More informationHow Sets of Coherent Probabilities May Serve as Models for Degrees of Incoherence
1 st Internatonal Symposum on Imprecse Probabltes and Ther Applcatons, Ghent, Belgum, 29 June 2 July 1999 How Sets of Coherent Probabltes May Serve as Models for Degrees of Incoherence Mar J. Schervsh
More informationInstitute of Informatics, Faculty of Business and Management, Brno University of Technology,Czech Republic
Lagrange Multplers as Quanttatve Indcators n Economcs Ivan Mezník Insttute of Informatcs, Faculty of Busness and Management, Brno Unversty of TechnologCzech Republc Abstract The quanttatve role of Lagrange
More informationAn Analytical Model of Web Server Load Distribution by Applying a Minimum Entropy Strategy
Internatonal Journal of Coputer and Councaton Engneerng, Vol. 2, No. 4, July 203 An Analytcal odel of Web Server Load Dstrbuton by Applyng a nu Entropy Strategy Teeranan Nandhakwang, Settapong alsuwan,
More informationGanesh Subramaniam. American Solutions Inc., 100 Commerce Dr Suite # 103, Newark, DE 19713, USA
238 Int. J. Sulaton and Process Modellng, Vol. 3, No. 4, 2007 Sulaton-based optsaton for ateral dspatchng n Vendor-Managed Inventory systes Ganesh Subraana Aercan Solutons Inc., 100 Coerce Dr Sute # 103,
More informationAn Alternative Way to Measure Private Equity Performance
An Alternatve Way to Measure Prvate Equty Performance Peter Todd Parlux Investment Technology LLC Summary Internal Rate of Return (IRR) s probably the most common way to measure the performance of prvate
More informationHow To Understand The Results Of The German Meris Cloud And Water Vapour Product
Ttel: Project: Doc. No.: MERIS level 3 cloud and water vapour products MAPP MAPP-ATBD-ClWVL3 Issue: 1 Revson: 0 Date: 9.12.1998 Functon Name Organsaton Sgnature Date Author: Bennartz FUB Preusker FUB Schüller
More informationWhat is Candidate Sampling
What s Canddate Samplng Say we have a multclass or mult label problem where each tranng example ( x, T ) conssts of a context x a small (mult)set of target classes T out of a large unverse L of possble
More informationPSYCHOLOGICAL RESEARCH (PYC 304-C) Lecture 12
14 The Ch-squared dstrbuton PSYCHOLOGICAL RESEARCH (PYC 304-C) Lecture 1 If a normal varable X, havng mean µ and varance σ, s standardsed, the new varable Z has a mean 0 and varance 1. When ths standardsed
More informationVirtual machine resource allocation algorithm in cloud environment
COMPUTE MOELLIN & NEW TECHNOLOIES 2014 1(11) 279-24 Le Zheng Vrtual achne resource allocaton algorth n cloud envronent 1, 2 Le Zheng 1 School of Inforaton Engneerng, Shandong Youth Unversty of Poltcal
More informationRecurrence. 1 Definitions and main statements
Recurrence 1 Defntons and man statements Let X n, n = 0, 1, 2,... be a MC wth the state space S = (1, 2,...), transton probabltes p j = P {X n+1 = j X n = }, and the transton matrx P = (p j ),j S def.
More information1 Example 1: Axis-aligned rectangles
COS 511: Theoretcal Machne Learnng Lecturer: Rob Schapre Lecture # 6 Scrbe: Aaron Schld February 21, 2013 Last class, we dscussed an analogue for Occam s Razor for nfnte hypothess spaces that, n conjuncton
More informationbenefit is 2, paid if the policyholder dies within the year, and probability of death within the year is ).
REVIEW OF RISK MANAGEMENT CONCEPTS LOSS DISTRIBUTIONS AND INSURANCE Loss and nsurance: When someone s subject to the rsk of ncurrng a fnancal loss, the loss s generally modeled usng a random varable or
More informationSupport Vector Machines
Support Vector Machnes Max Wellng Department of Computer Scence Unversty of Toronto 10 Kng s College Road Toronto, M5S 3G5 Canada wellng@cs.toronto.edu Abstract Ths s a note to explan support vector machnes.
More informationProject Networks With Mixed-Time Constraints
Project Networs Wth Mxed-Tme Constrants L Caccetta and B Wattananon Western Australan Centre of Excellence n Industral Optmsaton (WACEIO) Curtn Unversty of Technology GPO Box U1987 Perth Western Australa
More informationA Fuzzy Optimization Framework for COTS Products Selection of Modular Software Systems
Internatonal Journal of Fuy Systes, Vol. 5, No., June 0 9 A Fuy Optaton Fraework for COTS Products Selecton of Modular Software Systes Pankaj Gupta, Hoang Pha, Mukesh Kuar Mehlawat, and Shlp Vera Abstract
More informationPAS: A Packet Accounting System to Limit the Effects of DoS & DDoS. Debish Fesehaye & Klara Naherstedt University of Illinois-Urbana Champaign
PAS: A Packet Accountng System to Lmt the Effects of DoS & DDoS Debsh Fesehaye & Klara Naherstedt Unversty of Illnos-Urbana Champagn DoS and DDoS DDoS attacks are ncreasng threats to our dgtal world. Exstng
More information"Research Note" APPLICATION OF CHARGE SIMULATION METHOD TO ELECTRIC FIELD CALCULATION IN THE POWER CABLES *
Iranan Journal of Scence & Technology, Transacton B, Engneerng, ol. 30, No. B6, 789-794 rnted n The Islamc Republc of Iran, 006 Shraz Unversty "Research Note" ALICATION OF CHARGE SIMULATION METHOD TO ELECTRIC
More informationA R T I C L E S DYNAMIC VEHICLE DISPATCHING: OPTIMAL HEAVY TRAFFIC PERFORMANCE AND PRACTICAL INSIGHTS
A R T I C L E S DYAMIC VEHICLE DISPATCHIG: OPTIMAL HEAVY TRAFFIC PERFORMACE AD PRACTICAL ISIGHTS OAH GAS OPIM Departent, The Wharton School, Unversty of Pennsylvana, Phladelpha, Pennsylvana 19104-6366
More informationOn File Delay Minimization for Content Uploading to Media Cloud via Collaborative Wireless Network
On Fle Delay Mnmzaton for Content Uploadng to Meda Cloud va Collaboratve Wreless Network Ge Zhang and Yonggang Wen School of Computer Engneerng Nanyang Technologcal Unversty Sngapore Emal: {zh0001ge, ygwen}@ntu.edu.sg
More informationAnswer: A). There is a flatter IS curve in the high MPC economy. Original LM LM after increase in M. IS curve for low MPC economy
4.02 Quz Solutons Fall 2004 Multple-Choce Questons (30/00 ponts) Please, crcle the correct answer for each of the followng 0 multple-choce questons. For each queston, only one of the answers s correct.
More informationLeast Squares Fitting of Data
Least Squares Fttng of Data Davd Eberly Geoetrc Tools, LLC http://www.geoetrctools.co/ Copyrght c 1998-2016. All Rghts Reserved. Created: July 15, 1999 Last Modfed: January 5, 2015 Contents 1 Lnear Fttng
More informationTraffic Demand Forecasting for EGCS with Grey Theory Based Multi- Model Method
IJCSI Internatonal Journal of Coputer Scence Issues, Vol., Issue, No, January 3 ISSN (Prnt): 694-784 ISSN (Onlne): 694-84 www.ijcsi.org 6 Traffc Deand Forecastng for EGCS wth Grey Theory Based Mult- Model
More informationTechnical Report, SFB 475: Komplexitätsreduktion in Multivariaten Datenstrukturen, Universität Dortmund, No. 1998,04
econstor www.econstor.eu Der Open-Access-Publkatonsserver der ZBW Lebnz-Inforatonszentru Wrtschaft The Open Access Publcaton Server of the ZBW Lebnz Inforaton Centre for Econocs Becka, Mchael Workng Paper
More informationA Design Method of High-availability and Low-optical-loss Optical Aggregation Network Architecture
A Desgn Method of Hgh-avalablty and Low-optcal-loss Optcal Aggregaton Network Archtecture Takehro Sato, Kuntaka Ashzawa, Kazumasa Tokuhash, Dasuke Ish, Satoru Okamoto and Naoak Yamanaka Dept. of Informaton
More informationThe Development of Web Log Mining Based on Improve-K-Means Clustering Analysis
The Development of Web Log Mnng Based on Improve-K-Means Clusterng Analyss TngZhong Wang * College of Informaton Technology, Luoyang Normal Unversty, Luoyang, 471022, Chna wangtngzhong2@sna.cn Abstract.
More informationHow To Make A Dstrbuted Ddos Attack More Successful
PacketScore: Statstcs-based Overload Control aganst Dstrbuted Denal-of-Servce Attacks Yoohwan K * Wng Cheong Lau * Moo Choo Chuah ** H. Jonathan Chao EECS Departent Bell Labs CSE Departent ECE Departent
More informationRevenue Maximization Using Adaptive Resource Provisioning in Cloud Computing Environments
202 ACM/EEE 3th nternatonal Conference on Grd Coputng evenue Maxzaton sng Adaptve esource Provsonng n Cloud Coputng Envronents Guofu Feng School of nforaton Scence, Nanng Audt nversty, Nanng, Chna nufgf@gal.co
More informationInventory Control in a Multi-Supplier System
3th Intl Workng Senar on Producton Econocs (WSPE), Igls, Autrche, pp.5-6 Inventory Control n a Mult-Suppler Syste Yasen Arda and Jean-Claude Hennet LAAS-CRS, 7 Avenue du Colonel Roche, 3077 Toulouse Cedex
More informationA Cryptographic Key Binding Method Based on Fingerprint Features and the Threshold Scheme
A Cryptographc Key ndng Method Based on Fngerprnt Features and the Threshold Schee 1 Ln You, 2 Guowe Zhang, 3 Fan Zhang 1,3 College of Councaton Engneerng, Hangzhou Danz Unv., Hangzhou 310018, Chna, ryouln@gal.co
More informationPRIOR ROBUST OPTIMIZATION. Balasubramanian Sivan. A dissertation submitted in partial fulfillment of the requirements for the degree of
PRIOR ROBUST OPTIMIZATION By Balasubraanan Svan A dssertaton subtted n partal fulfllent of the requreents for the degree of Doctor of Phlosophy (Coputer Scences) at the UNIVERSITY OF WISCONSIN MADISON
More informationA Probabilistic Theory of Coherence
A Probablstc Theory of Coherence BRANDEN FITELSON. The Coherence Measure C Let E be a set of n propostons E,..., E n. We seek a probablstc measure C(E) of the degree of coherence of E. Intutvely, we want
More informationResearch Article Load Balancing for Future Internet: An Approach Based on Game Theory
Appled Matheatcs, Artcle ID 959782, 11 pages http://dx.do.org/10.1155/2014/959782 Research Artcle Load Balancng for Future Internet: An Approach Based on Gae Theory Shaoy Song, Tngje Lv, and Xa Chen School
More informationTHE DISTRIBUTION OF LOAN PORTFOLIO VALUE * Oldrich Alfons Vasicek
HE DISRIBUION OF LOAN PORFOLIO VALUE * Oldrch Alfons Vascek he amount of captal necessary to support a portfolo of debt securtes depends on the probablty dstrbuton of the portfolo loss. Consder a portfolo
More informationNaglaa Raga Said Assistant Professor of Operations. Egypt.
Volue, Issue, Deceer ISSN: 77 8X Internatonal Journal of Adanced Research n Coputer Scence and Software Engneerng Research Paper Aalale onlne at: www.jarcsse.co Optal Control Theory Approach to Sole Constraned
More informationYixin Jiang and Chuang Lin. Minghui Shi and Xuemin Sherman Shen*
198 Int J Securty Networks Vol 1 Nos 3/4 2006 A self-encrypton authentcaton protocol for teleconference servces Yxn Jang huang Ln Departent of oputer Scence Technology Tsnghua Unversty Beng hna E-al: yxang@csnet1cstsnghuaeducn
More informationTraffic-light a stress test for life insurance provisions
MEMORANDUM Date 006-09-7 Authors Bengt von Bahr, Göran Ronge Traffc-lght a stress test for lfe nsurance provsons Fnansnspetonen P.O. Box 6750 SE-113 85 Stocholm [Sveavägen 167] Tel +46 8 787 80 00 Fax
More informationSection 5.3 Annuities, Future Value, and Sinking Funds
Secton 5.3 Annutes, Future Value, and Snkng Funds Ordnary Annutes A sequence of equal payments made at equal perods of tme s called an annuty. The tme between payments s the payment perod, and the tme
More informationDEFINING %COMPLETE IN MICROSOFT PROJECT
CelersSystems DEFINING %COMPLETE IN MICROSOFT PROJECT PREPARED BY James E Aksel, PMP, PMI-SP, MVP For Addtonal Informaton about Earned Value Management Systems and reportng, please contact: CelersSystems,
More informationCapacity Planning for Virtualized Servers
Capacty Plannng for Vrtualzed Servers Martn Bchler, Thoas Setzer, Benjan Spetkap Departent of Inforatcs, TU München 85748 Garchng/Munch, Gerany (bchler setzer benjan.spetkap)@n.tu.de Abstract Today's data
More informationFeature selection for intrusion detection. Slobodan Petrović NISlab, Gjøvik University College
Feature selecton for ntruson detecton Slobodan Petrovć NISlab, Gjøvk Unversty College Contents The feature selecton problem Intruson detecton Traffc features relevant for IDS The CFS measure The mrmr measure
More informationII. THE QUALITY AND REGULATION OF THE DISTRIBUTION COMPANIES I. INTRODUCTION
Fronter Methodology to fx Qualty goals n Electrcal Energy Dstrbuton Copanes R. Rarez 1, A. Sudrà 2, A. Super 3, J.Bergas 4, R.Vllafáfla 5 1-2 -3-4-5 - CITCEA - UPC UPC., Unversdad Poltécnca de Cataluña,
More informationAn Enhanced K-Anonymity Model against Homogeneity Attack
JOURNAL OF SOFTWARE, VOL. 6, NO. 10, OCTOBER 011 1945 An Enhanced K-Anont Model aganst Hoogenet Attack Qan Wang College of Coputer Scence of Chongqng Unverst, Chongqng, Chna Eal: wangqan@cqu.edu.cn Zhwe
More information1. Fundamentals of probability theory 2. Emergence of communication traffic 3. Stochastic & Markovian Processes (SP & MP)
6.3 / -- Communcaton Networks II (Görg) SS20 -- www.comnets.un-bremen.de Communcaton Networks II Contents. Fundamentals of probablty theory 2. Emergence of communcaton traffc 3. Stochastc & Markovan Processes
More informationAnalysis of Energy-Conserving Access Protocols for Wireless Identification Networks
From the Proceedngs of Internatonal Conference on Telecommuncaton Systems (ITC-97), March 2-23, 1997. 1 Analyss of Energy-Conservng Access Protocols for Wreless Identfcaton etworks Imrch Chlamtac a, Chara
More informationCONSTRUCTION OF A COLLABORATIVE VALUE CHAIN IN CLOUD COMPUTING ENVIRONMENT
CONSTRUCTION OF A COLLAORATIVE VALUE CHAIN IN CLOUD COMPUTING ENVIRONMENT Png Wang, School of Econoy and Manageent, Jangsu Unversty of Scence and Technology, Zhenjang Jangsu Chna, sdwangp1975@163.co Zhyng
More informationRisk-based Fatigue Estimate of Deep Water Risers -- Course Project for EM388F: Fracture Mechanics, Spring 2008
Rsk-based Fatgue Estmate of Deep Water Rsers -- Course Project for EM388F: Fracture Mechancs, Sprng 2008 Chen Sh Department of Cvl, Archtectural, and Envronmental Engneerng The Unversty of Texas at Austn
More informationWeb Service-based Business Process Automation Using Matching Algorithms
Web Servce-based Busness Process Autoaton Usng Matchng Algorths Yanggon K and Juhnyoung Lee 2 Coputer and Inforaton Scences, Towson Uversty, Towson, MD 2252, USA, yk@towson.edu 2 IBM T. J. Watson Research
More informationExtending Probabilistic Dynamic Epistemic Logic
Extendng Probablstc Dynamc Epstemc Logc Joshua Sack May 29, 2008 Probablty Space Defnton A probablty space s a tuple (S, A, µ), where 1 S s a set called the sample space. 2 A P(S) s a σ-algebra: a set
More informationSurvey on Virtual Machine Placement Techniques in Cloud Computing Environment
Survey on Vrtual Machne Placement Technques n Cloud Computng Envronment Rajeev Kumar Gupta and R. K. Paterya Department of Computer Scence & Engneerng, MANIT, Bhopal, Inda ABSTRACT In tradtonal data center
More informationAnalysis of Clock Synchronization Approaches for Residential Ethernet
Analyss of Clock Synchronzaton Approaches for Resdental Ethernet Geoffrey M. Garner (Consultant) Kees den Hollander SAIT, Sasung Electroncs ggarner@cocast.net, denhollander.c.@sasung.co Abstract Resdental
More informationPeriod and Deadline Selection for Schedulability in Real-Time Systems
Perod and Deadlne Selecton for Schedulablty n Real-Tme Systems Thdapat Chantem, Xaofeng Wang, M.D. Lemmon, and X. Sharon Hu Department of Computer Scence and Engneerng, Department of Electrcal Engneerng
More informationThe Packing Server for Real-Time Scheduling of MapReduce Workflows
The Packng Server for Real-Te Schedulng of MapReduce Workflows Shen L, Shaohan Hu, Tarek Abdelzaher Unversty of Illnos at Urbana-Chapagn {shenl3, shu7, zaher}@llnos.edu Abstract Ths paper develops new
More informationInternational Journal of Information Management
Internatonal Journal of Inforaton Manageent 32 (2012) 409 418 Contents lsts avalable at ScVerse ScenceDrect Internatonal Journal of Inforaton Manageent j our nal ho e p age: www.elsever.co/locate/jnfogt
More informationNear Optimal Online Algorithms and Fast Approximation Algorithms for Resource Allocation Problems
Near Optal Onlne Algorths and Fast Approxaton Algorths for Resource Allocaton Probles ABSTRACT Nhl R Devanur Mcrosoft Research Redond WA USA ndev@crosoftco Balasubraanan Svan Coputer Scences Dept Unv of
More informationFault tolerance in cloud technologies presented as a service
Internatonal Scentfc Conference Computer Scence 2015 Pavel Dzhunev, PhD student Fault tolerance n cloud technologes presented as a servce INTRODUCTION Improvements n technques for vrtualzaton and performance
More informationVision Mouse. Saurabh Sarkar a* University of Cincinnati, Cincinnati, USA ABSTRACT 1. INTRODUCTION
Vson Mouse Saurabh Sarkar a* a Unversty of Cncnnat, Cncnnat, USA ABSTRACT The report dscusses a vson based approach towards trackng of eyes and fngers. The report descrbes the process of locatng the possble
More informationThe OC Curve of Attribute Acceptance Plans
The OC Curve of Attrbute Acceptance Plans The Operatng Characterstc (OC) curve descrbes the probablty of acceptng a lot as a functon of the lot s qualty. Fgure 1 shows a typcal OC Curve. 10 8 6 4 1 3 4
More information+ + + - - This circuit than can be reduced to a planar circuit
MeshCurrent Method The meshcurrent s analog of the nodeoltage method. We sole for a new set of arables, mesh currents, that automatcally satsfy KCLs. As such, meshcurrent method reduces crcut soluton to
More informationA Secure Password-Authenticated Key Agreement Using Smart Cards
A Secure Password-Authentcated Key Agreement Usng Smart Cards Ka Chan 1, Wen-Chung Kuo 2 and Jn-Chou Cheng 3 1 Department of Computer and Informaton Scence, R.O.C. Mltary Academy, Kaohsung 83059, Tawan,
More informationSketching Sampled Data Streams
Sketchng Sampled Data Streams Florn Rusu, Aln Dobra CISE Department Unversty of Florda Ganesvlle, FL, USA frusu@cse.ufl.edu adobra@cse.ufl.edu Abstract Samplng s used as a unversal method to reduce the
More informationThe Application of Fractional Brownian Motion in Option Pricing
Vol. 0, No. (05), pp. 73-8 http://dx.do.org/0.457/jmue.05.0..6 The Applcaton of Fractonal Brownan Moton n Opton Prcng Qng-xn Zhou School of Basc Scence,arbn Unversty of Commerce,arbn zhouqngxn98@6.com
More informationData Broadcast on a Multi-System Heterogeneous Overlayed Wireless Network *
JOURNAL OF INFORMATION SCIENCE AND ENGINEERING 24, 819-840 (2008) Data Broadcast on a Mult-System Heterogeneous Overlayed Wreless Network * Department of Computer Scence Natonal Chao Tung Unversty Hsnchu,
More informationJ. Parallel Distrib. Comput.
J. Parallel Dstrb. Comput. 71 (2011) 62 76 Contents lsts avalable at ScenceDrect J. Parallel Dstrb. Comput. journal homepage: www.elsever.com/locate/jpdc Optmzng server placement n dstrbuted systems n
More informationRobust Design of Public Storage Warehouses. Yeming (Yale) Gong EMLYON Business School
Robust Desgn of Publc Storage Warehouses Yemng (Yale) Gong EMLYON Busness School Rene de Koster Rotterdam school of management, Erasmus Unversty Abstract We apply robust optmzaton and revenue management
More informationAvailability-Based Path Selection and Network Vulnerability Assessment
Avalablty-Based Path Selecton and Network Vulnerablty Assessment Song Yang, Stojan Trajanovsk and Fernando A. Kupers Delft Unversty of Technology, The Netherlands {S.Yang, S.Trajanovsk, F.A.Kupers}@tudelft.nl
More informationCalculation of Sampling Weights
Perre Foy Statstcs Canada 4 Calculaton of Samplng Weghts 4.1 OVERVIEW The basc sample desgn used n TIMSS Populatons 1 and 2 was a two-stage stratfed cluster desgn. 1 The frst stage conssted of a sample
More informationProactive Secret Sharing Or: How to Cope With Perpetual Leakage
Proactve Secret Sharng Or: How to Cope Wth Perpetual Leakage Paper by Amr Herzberg Stanslaw Jareck Hugo Krawczyk Mot Yung Presentaton by Davd Zage What s Secret Sharng Basc Idea ((2, 2)-threshold scheme):
More informationAN APPOINTMENT ORDER OUTPATIENT SCHEDULING SYSTEM THAT IMPROVES OUTPATIENT EXPERIENCE
AN APPOINTMENT ORDER OUTPATIENT SCHEDULING SYSTEM THAT IMPROVES OUTPATIENT EXPERIENCE Yu-L Huang Industral Engneerng Department New Mexco State Unversty Las Cruces, New Mexco 88003, U.S.A. Abstract Patent
More informationEfficient On-Demand Data Service Delivery to High-Speed Trains in Cellular/Infostation Integrated Networks
IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS, VOL. XX, NO. XX, MONTH 2XX 1 Effcent On-Demand Data Servce Delvery to Hgh-Speed Trans n Cellular/Infostaton Integrated Networks Hao Lang, Student Member,
More informationAn Interest-Oriented Network Evolution Mechanism for Online Communities
An Interest-Orented Network Evoluton Mechansm for Onlne Communtes Cahong Sun and Xaopng Yang School of Informaton, Renmn Unversty of Chna, Bejng 100872, P.R. Chna {chsun,yang}@ruc.edu.cn Abstract. Onlne
More informationCalculating the high frequency transmission line parameters of power cables
< ' Calculatng the hgh frequency transmsson lne parameters of power cables Authors: Dr. John Dcknson, Laboratory Servces Manager, N 0 RW E B Communcatons Mr. Peter J. Ncholson, Project Assgnment Manager,
More informationRequIn, a tool for fast web traffic inference
RequIn, a tool for fast web traffc nference Olver aul, Jean Etenne Kba GET/INT, LOR Department 9 rue Charles Fourer 90 Evry, France Olver.aul@nt-evry.fr, Jean-Etenne.Kba@nt-evry.fr Abstract As networked
More informationGroup Solvency Optimization Model for Insurance Companies Using Copula Functions
Internatonal Conference on Econocs, Busness and Marketng Manageent IPEDR vol.9 () () IACSIT Press, Sngapore Group Solvency Optzaton Model for Insurance Copanes Usng Copula Functons Masayasu Kanno + Faculty
More informationChapter 4 ECONOMIC DISPATCH AND UNIT COMMITMENT
Chapter 4 ECOOMIC DISATCH AD UIT COMMITMET ITRODUCTIO A power system has several power plants. Each power plant has several generatng unts. At any pont of tme, the total load n the system s met by the
More informationA hybrid global optimization algorithm based on parallel chaos optimization and outlook algorithm
Avalable onlne www.ocpr.com Journal of Chemcal and Pharmaceutcal Research, 2014, 6(7):1884-1889 Research Artcle ISSN : 0975-7384 CODEN(USA) : JCPRC5 A hybrd global optmzaton algorthm based on parallel
More information7.5. Present Value of an Annuity. Investigate
7.5 Present Value of an Annuty Owen and Anna are approachng retrement and are puttng ther fnances n order. They have worked hard and nvested ther earnngs so that they now have a large amount of money on
More informationSecure Cloud Storage Service with An Efficient DOKS Protocol
Secure Cloud Storage Servce wth An Effcent DOKS Protocol ZhengTao Jang Councaton Unversty of Chna z.t.ang@163.co Abstract Storage servces based on publc clouds provde custoers wth elastc storage and on-deand
More informationINVESTIGATION OF VEHICULAR USERS FAIRNESS IN CDMA-HDR NETWORKS
21 22 September 2007, BULGARIA 119 Proceedngs of the Internatonal Conference on Informaton Technologes (InfoTech-2007) 21 st 22 nd September 2007, Bulgara vol. 2 INVESTIGATION OF VEHICULAR USERS FAIRNESS
More informationCan Auto Liability Insurance Purchases Signal Risk Attitude?
Internatonal Journal of Busness and Economcs, 2011, Vol. 10, No. 2, 159-164 Can Auto Lablty Insurance Purchases Sgnal Rsk Atttude? Chu-Shu L Department of Internatonal Busness, Asa Unversty, Tawan Sheng-Chang
More informationLinear Circuits Analysis. Superposition, Thevenin /Norton Equivalent circuits
Lnear Crcuts Analyss. Superposton, Theenn /Norton Equalent crcuts So far we hae explored tmendependent (resste) elements that are also lnear. A tmendependent elements s one for whch we can plot an / cure.
More informationEfficient Bandwidth Management in Broadband Wireless Access Systems Using CAC-based Dynamic Pricing
Effcent Bandwdth Management n Broadband Wreless Access Systems Usng CAC-based Dynamc Prcng Bader Al-Manthar, Ndal Nasser 2, Najah Abu Al 3, Hossam Hassanen Telecommuncatons Research Laboratory School of
More information