@conference {
	title = {On Optimal Watermarking Schemes in Uncertain Gaussian Channels},
	author = {Cardenas, Alvaro A., Moustakides, George V., Baras, John S.},
	year = {2007},
	month = {09/2007},
	abstract = {This paper describes the analytical derivation of a new watermarking algorithm satisfying optimality properties when the distortion of the watermarked signal is caused by a Gaussian process. We also extend previous work under the same assumptions and obtain more general solutions.},
	address = {San Antonio, Texas},
	booktitle = {IEEE International Conference on Signal Processing ICIP 2007},
	pages = {pp. 449-452}
}
@conference {
	title = {Performance Comparison of Detection Schemes for MAC Layer Misbehavior},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2007},
	month = {05/2007},
	abstract = {This paper revisits the problem of detecting greedy behavior in the IEEE 802.11 MAC protocol by evaluating the performance of two previously proposed schemes: DOMINO and the Sequential Probability Ratio Test (SPRT). The evaluation is carried out in four steps. We first derive a new analytical formulation of the SPRT that takes into account the discrete nature of the problem. Then we develop a new tractable analytical model for DOMINO. As a third step, we evaluate the theoretical performance of SPRT and DOMINO with newly introduced metrics that take into account the repeated nature of the tests. This theoretical comparison provides two major insights into the problem: it confirms the optimality of SPRT and motivates us to define yet another test, a nonparametric CUSUM statistic that shares the same intuition as DOMINO but gives better performance.We finalize the paper with experimental results, confirming our theoretical analysis and validating the introduction of the new nonparametric CUSUM statistic.},
	address = {Anchorage, Alaska},
	booktitle = {Proceedings of the 26th Annual IEEE Conference on Computer Communications (Infocom)},
	pages = {pp. 1496-1504}
}
@conference {
	title = {Towards Optimal Design of Data Hiding Algorithms Against Nonparametric Adversary Models},
	author = {Cardenas, Alvaro A., Moustakides, George V., Baras, John S.},
	year = {2007},
	month = {03/2007},
	abstract = {This paper presents a novel zero-sum watermarking game between a detection algorithm and a data hiding adversary. Contrary to previous research, the detection algorithm and the adversary we consider are both nonparametric in a continuous signal space, and thus they have no externally imposed limitations on their allowed strategies except for some distortion constraints. We show that in this framework no deterministic detection algorithm is optimal. We then find optimal randomized detection algorithms for different distortion levels and introduce a new performance tradeoff between completeness and accuracy when a detection algorithm does not have enough evidence to make an accurate decision.},
	address = {Baltimore, Maryland},
	booktitle = {41st Annual Conference on Information Sciences and Systems},
	pages = {pp. 911-916}
}
@conference {
	title = {Detecting IEEE 802.11 MAC Layer Misbehavior in Ad Hoc Networks},
	author = {Radosavac, Svetlana., Cardenas, Alvaro A., Baras, John S., Moustakides, George V.},
	year = {2007},
	month = {01/2007},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focusing on the back-off manipulation by selfish nodes. We first propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework and providing an optimal detection rule for the worst-case attack scenarios. Finally, we evaluate the performance of single and colluding attackers in terms of detection delay. Although our approach is general and can be used with any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.},
	booktitle = {Robust Strategies Against Individual and Colluding Attacker\&quot; Journal of Computer Security: Special Issue on Security of Ad Hoc and Sensor Networks},
	pages = {pp. 103-128}
}
@conference {
	title = {A Unified Framework of Information Assurance for the Design and Analysis fo Security Algorithms},
	author = {Cardenas, Alvaro A., Taban, Gelareh., Baras, John S.},
	year = {2006},
	month = {11/2006},
	abstract = {Most information security algorithms cannot achieve perfect security without incurring severe operational costs such as false alarms, network congestion, capital investment etc. Operating or designing an algorithm with perfect security is therefore not an economically rational alternative and thus the question arises of how to find the appropriate tradeoff between security and its costs. Although several other researchers have recognized that there is a tradeoff, there is very little work in formally characterizing it. This paper provides the first steps towards a more systematic and general approach for cost-effective security management.},
	address = {Orlando, FL},
	booktitle = {25th Army Science Conference},
	pages = {pp. 1-8}
}
@conference {
	title = {B-ROC Curves for the Assessment of Classifiers over Imbalanced Data Sets},
	author = {Cardenas, Alvaro A., Baras, John S.},
	year = {2006},
	month = {07/2006},
	abstract = {The class imbalance problem appears to be ubiquitous to a large portion of the machine learning and data mining communities. One of the key questions in this setting is how to evaluate the learning algorithms in the case of class imbalances. In this paper we introduce the Bayesian Receiver Operating Characteristic (B-ROC) curves, as a set of tradeoff curves that combine in an intuitive way, the variables that are more relevant to the evaluation of classifiers over imbalanced data sets. This presentation is based on section 4 of (C{\textasciiacute}ardenas, Baras, \&amp; Seamon 2006).},
	address = {Boston, Massachusetts},
	booktitle = {21st National Conference on Artificial Intelligence, (AAAI 06) Nectar track,},
	pages = {pp. 1581-1584}
}
@conference {
	title = {Evaluation of Classifiers Practical Considerations for Security Applications},
	author = {Cardenas, Alvaro A., Baras, John S.},
	year = {2006},
	month = {07/2006},
	abstract = {In recent years several tools based on statistical methods and machine learning have been incorporated in security related tasks involving classification, such as intrusion detection systems (IDSs), fraud detection, spam filters, biometrics and multimedia forensics. Measuring the security performance of these classifiers is an essential part for facilitating decision making, determining the viability of the product, or for comparing multiple classifiers. There are however relevant considerations for security related problems that are sometimes ignored by traditional evaluation schemes. In this paper we identify two pervasive problems in securityrelated applications. The first problem is the usually large class imbalance between normal events and attack events. This problem has been addressed by evaluating classifiers based on cost-sensitive metrics and with the introduction of Bayesian Receiver Operating Characteristic (B-ROC) curves. The second problem to consider is the fact that the classifier or learning rule will be deployed in an adversarial environment. This implies that good performance on average might not be a good performance measure, but rather we look for good performance under the worst type of adversarial attacks. In order to address this notion more precisely we provide a framework to model an adversary and define security notions based on evaluation metrics},
	address = {Boston, MA},
	booktitle = {AAAI Workshop on Evaluation Methods for Machine Learning}
}
@conference {
	title = {Evaluation of Classifiers: Practical Considerations for Security Applications},
	author = {Cardenas, Alvaro A., Baras, John S.},
	year = {2006},
	month = {07/2006},
	abstract = {In recent years several tools based on statistical methods and machine learning have been incorporated in security related tasks involving classification, such as intrusion detection systems (IDSs), fraud detection, spam filters, biometrics and multimedia forensics. Measuring the security performance of these classifiers is an essential part for facilitating decision making, determining the viability of the product, or for comparing multiple classifiers. There are however relevant considerations for security related problems that are sometimes ignored by traditional evaluation schemes. In this paper we identify two pervasive problems in security related applications. The first problem is the usually large class imbalance between normal events and attack events. This problem has been addressed by evaluating classifiers based on cost-sensitive metrics and with the introduction of Bayesian Receiver Operating Characteristic (B-ROC) curves. The second problem to consider is the fact that the classifier or learning rule will be deployed in an adversarial environment. This implies that good performance on average might not be a good performance measure, but rather we look for good performance under the worst type of adversarial attacks. In order to address this notion more precisely we provide a framework to model an adversary and define security notions based on evaluation metrics.},
	address = {Boston, Massachusetts},
	booktitle = {AAAI Workshop on Evaluation Methods for Machine Learning}
}
@conference {
	title = {A Framework for the Evaluation of Intrusion Detection Systems},
	author = {Cardenas, Alvaro A., Baras, John S., Seamon, Karl.},
	year = {2006},
	month = {05/2006},
	abstract = {Classification accuracy in intrusion detection systems (IDSs) deals with such fundamental problems as how to compare two or more IDSs, how to evaluate the performance of an IDS, and how to determine the best configuration of the IDS. In an effort to analyze and solve these related problems, evaluation metrics such as the Bayesian detection rate, the expected cost, the sensitivity and the intrusion detection capability have been introduced. In this paper, we study the advantages and disadvantages of each of these performance metrics and analyze them in a unified framework. Additionally, we introduce the intrusion detection operating characteristic (IDOC) curves as a new IDS performance tradeoff which combines in an intuitive way the variables that are more relevant to the intrusion detection evaluation problem. We also introduce a formal framework for reasoning about the performance of an IDS and the proposed metrics against adaptive adversaries. We provide simulations and experimental results to illustrate the benefits of the proposed framework.},
	address = {Oakland, California},
	booktitle = {2006 IEEE Symposium on Security and Privacy}
}
@conference {
	title = {Detection and Prevention of MAC Layer Misbehavior in Ad Hoc Networks},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2004},
	month = {10/2004},
	abstract = {Selfish behavior at the MAC layer can have devastating side effects on the performance of wireless networks, similar to the effects of DoS attacks. In this paper, we focus on the prevention and detection of the manipulation of the backoff mechanism by selfish nodes in 802.11. We first propose an algorithm to ensure honest backoffs when at least one, either the receiver or the sender is honest. Then we discuss detection algorithms to deal with the problem of colluding selfish nodes. Although we have focused on the MAC layer of 802.11, our approach is general and can serve as a guideline for the design of any probabilistic distributed MAC protocol.},
	address = {Washington DC},
	booktitle = {2nd ACM workshop on Security of ad hoc and sensor networks},
	pages = {pp. 17-22}
}
@conference {
	title = {Distributed Change Detection for Worms, DDoS and Other Network Attacks},
	author = {Cardenas, Alvaro A., Baras, John S., V. Ramezani},
	year = {2004},
	month = {06/2004},
	abstract = {Self-propagating code (worms) and distributed denial of service (DDoS) attacks are the most frequent and quite devastating attacks on communication networks and the Internet. We provide novel formulations for the rapid detection of these attacks in the control-theoretic framework of change detection. We present algorithms that effectively can detect worms from their temporal spreading characteristics. We describe the effects of the network topology on the algorithms and their performance. We next present algorithms for detecting DDoS while discriminating against changes in the normal traffic. This is accomplished by a distributed detection formalism where a concept of directionality is introduced and exploited. We then turn into attacks to routing protocols in mobile wireless networks. We develop change detection formulations involving hidden Markov models, which match distribution of the number of hops in the mobile and wireless nodes. Using observations that suggest that this distribution is altered substantially in the presence of such attacks we develop and analyze algorithms for their detection.},
	address = {Boston, MA},
	booktitle = {2004 American Control Conference},
	pages = {pp. 1008-1013}
}
@conference {
	title = {On-line Detection of Distributed Attacks from Space-time Network Flow Patterns},
	author = {Baras, John S., Cardenas, Alvaro A., Vahid Ramezani},
	year = {2002},
	month = {12/2002},
	abstract = {Parametric and non-parametric change detection algorithms are applied to the problem of detecting changes in the direction of traffic flow. The directionality of the change in a network flow is assumed to have an objective or target. The particular problem of detecting distributed denial of service attacks from distributed observations is presented as a working framework. The performance of our change detection algorithms is evaluated via simulations.},
	address = {Orlando, Florida},
	booktitle = {23rd Army Science Conference}
}
@article {
	title = {Evaluation of Detection Algorithms for MAC Layer Misbehavior: Theory and Experiments},
	author = {Cardenas, Alvaro A., Radosavac, Svetlana., Baras, John S.},
	year = {2009},
	month = {04/2009},
	abstract = {We revisit the problem of detecting greedy behavior in the IEEE 802.11 MAC protocol by evaluating the performance of two previously proposed schemes: DOMINO and the Sequential Probability Ratio Test (SPRT). Our evaluation is carried out in four steps. We first derive a new analytical formulation of the SPRT that considers access to the wireless medium in discrete time slots. Then, we introduce an analytical model for DOMINO. As a third step, we evaluate the theoretical performance of SPRT and DOMINO with newly introduced metrics that take into account the repeated nature of the tests. This theoretical comparison provides two major insights into the problem: it confirms the optimality of SPRT and motivates us to define yet another test: a nonparametric CUSUM statistic that shares the same intuition as DOMINO but gives better performance. We finalize the paper with experimental results, con- firming the correctness of our theoretical analysis and validating the introduction of the new nonparametric CUSUM statistic.},
	pages = {pp. 605-617},
	volume = {Vol. 17},
	number = {No 2},
	journal = {IEEE/ACM Transactions on Networking (TON)}
}
@article {
	title = {Detecting IEEE 802.11 MAC Layer Misbehavior in Ad Hoc Networks: Robust Strategies Against Individual and Colluding Attackers},
	author = {Radosavac, Svetlana., Cardenas, Alvaro A., Baras, John S., Moustakides, George V.},
	year = {2007},
	month = {01/2007},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focusing on the back-off manipulation by selfish nodes. We first propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework and providing an optimal detection rule for the worst-case attack scenarios. Finally, we evaluate the performance of single and colluding attackers in terms of detection delay. Although our approach is general and can be used with any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.},
	pages = {pp.  103-128},
	volume = {Vol. 15},
	number = {No. 1},
	journal = {Journal of Computer Security: Special Issue on Security of Ad Hoc and Sensor Networks}
}
@techreport {
	title = {Detection of Greedy Individual and Colluding MAC Layer Attackers},
	author = {Radosavac, Svetlana., Cardenas, Alvaro A., Moustakides, George V.},
	year = {2006},
	month = {01/2006},
	abstract = {Selfish behavior at the Medium Access (MAC) Layer can have devastating side effects on the performance of wireless networks, with effects similar to those of Denial of Service (DoS) attacks. In this paper we consider the problem of detection and prevention of node misbehavior at the MAC layer, focusing on the back-off manipulation by selfish nodes. We propose an algorithm that ensures honest behavior of non-colluding participants. Furthermore, we analyze the problem of colluding selfish nodes, casting the problem within a minimax robust detection framework, providing a detection rule of optimum performance for the worst-case attack. Finally, we compare the effects of colluding attackers with a single attacker in terms of the detection delay. Although our approach is general and can serve as a guideline for the design of any probabilistic distributed MAC protocol, we focus our analysis on the IEEE 802.11 MAC.},
	number = {Number: ISR TR 2006-8}
}
