CIS 864 - Advanced Topics in Network Security - Spring 2007

News Calendar and Syllabus Textbooks and Resources
Course Description Course Requirements Grading
Instructor: Jelena Mirkovic  
Office hours: T 5-6pm, Th 5-6 pm
Office: 412 Smith Hall 
E-mail: sunshine@cis.udel.edu
Phone: 302-831-6052 
Semester: Spring 2007 
Time: Tu/Th 3.30-4.45pm 
Room: Smith 102A
Course Web page: http://www.cis.udel.edu/~sunshine/courses/S07/CIS864
News
  • 4/15 Project presentation and report: The project presentation should last 20 minutes and contain the following slides:
    1. project title and names of people in the group - 1 slide
    2. what is the problem you are solving - 1 slide
    3. description of your approach - 1 or 2 slides
    4. experiment setup (how did you validate that your implementation works) - 1 slide
    5. experiment results - 1 or 2 slides
    6. discussion (future work, pros and cons of your approach) - 1 slide
    Each group member should present a few slides. Make sure your presentation lasts no more than 20 minutes.

    The project writeup should be written in a single-column format and resemble a research paper. It should contain the following sections (you can change the order of the sections but you MUST label them clearly so that I can identify them easily in text):

    1. project title and names of people in the group
    2. a short abstract
    3. what is the problem you are solving
    4. related work
    5. description of your approach in detail, including implementation (do not include any source code but do explain what tools you used in implementation) - use some diagrams if applicable
    6. experiment setup (possibly with figures of topologies if applicable)
    7. experiment results (graphs must be informative, properly labeled and visible on a printout in black and white)
    8. future work
    9. conclusions
    10. references
    11. division of work - which group member was responsible for which high-level tasks
    The length of the report will depend on your project topic but I suggest aiming at producing 4-6 pages. Do spell-check and proof-read your report, make sure it reads easily, it is clear and esthetically pleasing since it will affect your grade.
  • 2/26 Project proposals: Here are the topics that I would like you to cover in your project proposal and the suggested length of these sections (you can go over or above it):
    1. Names of people participating in the project (1 sentence)
    2. Suggested idea or several ideas if you have not decided yet on one (3-5 sentences per idea)
    3. For each idea give a specific goal - what you plan to have completed by the end of semester to demonstrate feasibility. This should be a smaller task within your idea. (2-3 sentences per goal)
    4. For each goal, list whether it will use an Emulab implementation with my kernel code, with Click, simulation with NS-2 or something else (and what). (2-3 sentences)
    5. List at least 3 papers you have read that relate to the idea you propose (e.g., deal with the same problem). This will later go into your related work section. (3 sentences, just list papers)
  • 2/15 Presentations: Aim to have a presentation run 40-45 minutes. This means you will need 30-40 slides depending on the speed of your presentation and how much information is on each slide. You should cover the following topics from the paper in your presentation (Slide numbers are suggestions, not requirements. You can have more or less slides on a given topic but you must cover it in your presentation, i.e. you must have at least one slide for each of the topics below.):
    1. Title slide with paper title, names of paper authors and your name as a presenter (1 slide)
    2. Brief statement what the problem is and what is the proposed solution (1 slide)
    3. An overview slide for the rest of the presentation (1 slide)
    4. More information about the problem being addressed (2-4 slides)
    5. More information about the proposed solution (4-10 slides)
    6. Experimental setup if the proposed solution is evaluated through experiments or simulation, theoretical foundation if proposed solution is evaluated in theory, measurement setup if the proposed solution is applied to measure some phenomenon. If none of this applies, have a slide stating why it doesn't apply. (1-3 slides)
    7. Experimental results, theoretical results, measurements (4-6 slides)
    8. Related work from the paper (2-3 slides)
    9. Your critique of the paper (1-2 slides)
    10. Conclusions (1 slide)
    Your presentation grade will be 50% based on the slide content and 50% based on your presentation: your understanding of the content, clarity of the presentation and the ability to answer questions about the paper posed by instructor and students.

    Please annotate the slides with the topic's number you are covering. Use the numbers from the list above.

Calendar and Syllabus
Date Topic Required reading Presenter Slides
2/6 Introduction J. Mirkovic Class 1
2/8 Cryptography Cryptography overview J. Mirkovic Class 2
February 13 at 4pm - Deadline for E-mailing the instructor about your chosen paper to present
2/13 Intrusions
Worms
Intrusion overview
Worm overview
J. Mirkovic Class 3
2/15 DoS
IP spoofing
IP spoofing overview
DoS overview
J. Mirkovic Class 4
2/20 Intrusions SANE: A Protection Architecture for Enterprise Networks Michael Haggerty Presentation
Student presentations begin
2/22 Intrusions Polymorphic blending attacks Jelena Presentation
March 1 at 4pm - Deadline for E-mailing the instructor about your chosen project
2/26 Intrusions Dynamic Application-Layer Protocol Analysis Guna Ranjan
3/1 Intrusions Behavior-based Spyware Detection Kishen Maloor
3/6 IP spoofing The Spoofer Project: Inferring the Extent of Source Address Filtering on the Internet Gaurav Jain
3/8 IP spoofing Efficient and Secure Source Authentication with Packet Passports Xiao Yun
3/13 Routing security PHAS: A Prefix Hijack Alert System Ke Li
3/15 Botnets Revealing Botnet Membership Using DNSBL Counter-Intelligence Amit Hetawal
3/20 Botnets An Algorithm for Anomaly-based Botnet Detection Gaurav Chadha
3/22 Worms On Detecting Camouflaging Worm Richie Gupta
3/27 Spring break
3/29 Spring break
4/3 Worms Search worms Arpita Gandhi
4/5 Worms Internet-Scale Malware Mitigation: Combining Intelligence of the Control and Data Plane Nikhil Shirude
4/10 Worms On the Impact of Dynamic Addressing on Malware Propagation Xia Cheng
4/12 Worms Polygraph: Automatically Generating Signatures for Polymorphic Worms Rajesh Ponnurangam
4/17 DoS A Framework for Collaborative DDoS Defense Kanika Thapar
4/19 DoS DDoS Defense by Offense Mohit Mehta
4/24 DoS Botz-4-Sale: Surviving Organized DDoS Attacks That Mimic Flash Crowds Rashmi Singh
4/26 DoS Inferring Internet Denial of Service Acivity Vimal Kannan
5/1 DoS A DoS-limiting network architecture Roli Shrivastava
5/3 e-VotingDesigning voting machines for verificationManoj Pillay
Project presentations begin
5/8 Arpita Gandhi and Rashmi Singh
Kishen Maloor and Gaurav Jain
Richie Gupta and Amit Hetawal
5/10 Kanika Thapar and Mohit Mehta
Manoj Pillay and Rajesh Ponnurangam and Vimal Kannan
Nikhil Shirude and Roli Shrivastava and Guna Ranjan
5/15 Michael Haggerty
Gaurav Chadha and Deepak Desore
Ke Li and Xiao Yun and Xia Cheng
May 16 at 4pm - Deadline for E-mailing the instructor your project report
Textbooks and resources
Optional reading
J. Nazario
"Defense and Detection Strategies against Internet Worms"
B. Schneier
"Applied Cryptography: Protocols, Algorithms, and Source Code in C," 2nd edition
W. Stallings
"Cryptography and Network Security: Principles and Practice"
C. Kaufman, et. al
"Network Security: Private Communication in a Public World"
B. Schneier
"Secrets and Lies"
E. Skoudis
"Counter Hack: A Step-by-Step Guide to Computer Attacks and Effective Defenses"
W. Cheswick, et. al
"Firewalls and Internet Security: Repelling the Wily Hacker," 2nd edition
Class slides
Will be posted in here after each class.
Course Description
This course is heavily focused on research and emphasizes reading and writing of technical papers, and project work. Course 664 is not a prerequisite for 864, but it is definitely useful. 864 course covers a variety of topics in network security field, such as denial-of-service, worm and virus attacks, privacy, anonymization techniques, IP spoofing, social engineering, etc. The course explores each topic through a blend of short in-class overview followed by the discussion of the selected articles from techical conferences and journals that address important topic-related problems.
Course Requirements
Programming Project
There will be one programming project in the course. The project should be done in the groups of 2 people, although individual projects and projects in 3-people groups may be allowed after talking to the instructor. Students should choose one of the network security topics and make an original research contribution with their project. This means that a project should pursue some original idea, not found in the current research, and should contain its implementation and experimental performance results or a theoretical proof. While it is hard to do a significant research work during one semester, the project should at least demonstrate that the idea is feasible and promising. For example, a project could take an existing defense approach against the problem X, and augment it to work better. Or, a project could combine ideas found in existing approaches Y and Z into an integrated solution, or apply an approach known to work against problem A to problem B. Of course, a completely new idea could also form the core of a project. Students should survey the current research on their chosen topic before deciding on the project, to further their understanding of the problem, and to make sure that similar ideas have not been tried before. Below are some questions to help you choose a suitable project. You should carefully consider them before you decide what you want to do.
  • Is the problem important?
  • What are the existing approaches to solving the problem? Why don't they work?
  • Is my idea likely to work? Will it be practical? Will it be expensive?
  • Can I define a segment of this idea that can be done in one semester and that will provide results to show if this idea is worth pursuing further?
Feel free to contact the instructor to discuss possible project ideas or get recommendations of papers related to your project.

Projects will likely involve a significant programing load for implementation of the proposed idea. Students can perform experiments required for their project work in four ways:

  1. In Emulab, using the code that Jelena will provide, to capture packets at the kernel level, collect statistics and drop packets, if needed. To access this code open an account at Emulab using the Web interface and join the project "CIS859". Then ssh on to users.emulab.net and cd to /proj/CIS859/tools. All the instructions are in the README file.
  2. In Emulab, using Click routers to capture, account for and drop or forward packets.
  3. Using the ns-2 simulator. You can download and install it on any PC.
  4. Use another simulator or build your custom simulator.

If you have difficulties deciding on a project, programming or dividing the load fairly with your group members, talk to the instructor.

Project grading
As a part of the course requirement you will need to prepare a 20-min presentation and a report about your project. A project grade will be based on the three criteria - quality of the project (60% of the project grade), presentation (20% of the project grade) and report (20% of the project grade).
Paper reports
Students are required to read each paper before its scheduled presentation. Additionally, each student should read another paper that addresses the same or a similar problem --- an alternative paper. Students can locate alternative papers from the related work section or searching for key words on Google. Before each class, students should E-mail the instructor a brief report (in plain text) containing answers to the following questions:
  • What does the paper propose? (3-4 sentences)
  • What is the value of this paper? (1-2 sentences)
  • In your opinion, is the idea discussed in the paper good or not, and why? (3-4 sentences)
  • Compare this paper to the alternative paper you read. Which one is better and why? (3-4 sentences)
  • State any suggestions you have that could improve this paper? (3-4 sentences)
Paper reports should be received at least an hour before the class in which the paper will be discussed. No extensions will be granted.
Paper presentation
Students should choose one paper from the required course reading, prepare a presentation explaining this paper and present it in the class. The presentation should be in PowerPoint, StarOffice or Latex. It should contain 30-40 slides and run about 40 minutes. Students should E-mail the presentation to the instructor by 8 am of the presentation day. They can use personal laptops or an instructor's laptop for presenting.
Class participation
After each paper's presentation we will discuss this paper and the alternative papers that address the same or a similar problem. Students should be prepared to present a brief description of the alternative paper they have read and to argue for or against this approach.
Course Policy
Attendance
I personally understand that there will be times when you can't make itbut please make every effort to attend the class regularly. Although I will post class slides online after each lecture, they can hardly replace all the clarifications, discussions and announcements made in class. If you do miss a class, I strongly advise you to obtain class notes from one of your classmates and to talk to them to see if you missed some important announcements. Be aware that 10% of your grade is class participation.

The University Seat Claim Policy states:

Unless excused by the faculty member, students holding a confirmed assigned seat in a class will have relinquished their seat if they have not personally appeared in class to claim the seat by ... the second meeting for a class scheduled to meet twice a week ... If the student does not claim the seat within the time limit specified above, and does not drop the course, the instructor has the option of assigning the student a grade of "Z" at the end of the term. It is the responsibility of the student to drop each course that he/she does not plan no attend, even when the student's registration is canceled for non-payment of fees. Failure to drop a course will result in a grade of "Z".
Therefore, attendance will be taken for the first two class meetings. Please make sure that you sign the attendance sheet.
Late policy
When you come in late you are disturbing both me and your classmates. Please make every effort to come on time. However, if you do happen to be late, come in and join the class (even if you are 30+ min late). Just don't make it a habit.
Academic honesty
You will work on projects in a group. However, you must make sure that each member contributes significantly to the project. If you have problems dividing the work talk to the instructor. Students should get acquainted with their rights and responsibilities as explained in the Student Guide to University Policies (http://www.udel.edu/stuguide/06-07/code.html#honesty).

Also be aware that copy/pasting any text or picture from a public source such as Internet, a book or a research paper, without putting it in quotes and acknowledging the source in text, is considered plagiarism and can seriously affect your academic status.

Asking for help
If you need help, don't hesitate to ask for it. There are no stupid questions, and nothing you ask will negatively affect your grade. On the contrary, students that ask for help early generally manage to improve their understanding of the material and achieve better grades. Also, remember that office hours are the time dedicated to meeting with students and answering their questions. The instructor is happy to have you come and make use of this time.

If you have any problem with the class (difficulties understanding the material or doing the projects, excused absence, emergency that prevents you from meeting a project deadline, need a special accomodation, etc.) E-mail the instructor, come to office hours, or simply find the instructor in the office. You can also call by phone if there is an emergency and you have no access to E-mail.

Grading policy
Project50%
Paper reports20%
Paper presentation20%
Class participation10%

You can check your assignment scores at this page using your secret number. You can use the following charts to predict your grade in class. You need to get the specified number of points or more to obtain the grade from the same column. Scores in form x.y are rounded up if y>5, otherwise they are rounded down.

AA-B+BB-C+C C-D+DD-
93908683 80 767370666360