DDoS avoidance strategy for service availability

Defending from DDoS attacks have become more difficult because they have evolved in many ways. Absence of a specific predetermined pattern, increase of number of attack devices, and distributed execution of the DDoS attack makes hard the recognition of the attack sources and thus application of countermeasures. When the DDoS attack is being executed, most of the cases, the target cannot provide its services normally; this is not a significant problem for non-critical application, but, for availability critical services such as stock financial, stock market, or governmental, the effect of the attack may involve huge damage. In this paper, we propose a DDoS avoidance strategy to provide service availability to those preregistered important users. In the proposed strategy, we divide the attack scenario in different time points and provide alternative access channels to already authenticated and other valid users.     

Cooperative detection and protection against network attacks using decentralized information sharing

Network attacks, such as distributed denial of service (DDoS) and Internet worms, are highly distributed and well coordinated offensive assaults on services, hosts, and the infrastructure of the Internet, and can have disastrous effects including financial losses and disruption of essential services. Consequently, effective defensive countermeasures against these attacks must provide equally sophisticated and well coordinated mechanisms for monitoring, analysis, and response. In this paper, we investigate techniques for cooperative attack detection and countermeasures using decentralized information sharing. The key underlying idea is the use of epidemic algorithms to share attack information and achieve quasi-global knowledge about attack behaviors. This paper first presents a conceptual model that defines the relationships between the level of knowledge in the distributed system and the accuracy of attack detection. The design of a cooperative attack detection and defense framework is then presented, and its use for detecting and defending against DDoS attacks and Internet worms is described. Simulation results are presented to demonstrate the feasibility and effectiveness of the framework against these attacks.     

Nest architecture and traffic flow: large potential effects from small structural features

1. Research on human pedestrian dynamics predicts that seemingly small architectural features of the surroundings can have large effects on the behaviour of crowds and the flow of pedestrian traffic, particularly when a crowd is panicked. This theoretical framework might usefully be applied to the study of collective movement within subterranean nests of social insects. 2. We examined the rate of egress from artificial nests by alarmed Linepithema humile ants. In accord with model predictions, but counter to intuition, we found that a partially obstructed exit enhanced the average rate of escape from the nest. 3. The study of traffic flows in subterranean nests is almost non‐existent, but it would be worth studying the effect of nest design elements on collective movements, given the great variety of nest forms among ants and termites.     

Performance Evaluation of WAP and Internet Protocols over W-CDMA Networks

This paper compares the performance of WAP 1.x to that of Internet protocols. We implement a WAP client and a WAP gateway based on the WAP version 1.1 and assess the overall response time to compare it to those of HTTP and TCP. We use a W-CDMA emulator to evaluate WAP 1.x performance in high-speed wireless networks such as 3G. The results show that all protocols have comparable performance (i.e., response time) except when transmitting large content sets (e.g., multimedia data files), in which case HTTP/TCP offers better performance than WAP 1.x. We also evaluate WAP specific functions such as the binary encoding of WAP headers and WML contents. While binary encoding is effective for small content sets, its effectiveness and performance are questionable for large content sets. Based on the results of our evaluation, we conclude that standard Internet protocols (i.e., HTTP/TCP) are suitable for high-speed wireless networks such as 3G.     

A low-temperature-sensitive intermediate state between S2 and S3 in photosynthetic water oxidation deduced by means of thermoluminescence measurements

The temperature dependence of S-state transitions in Photosystem II was measured by means of thermoluminescence using two different protocols for low-temperature flash excitation: protocol A, “last flash at low temperature”, and protocol B, “all flashes at low temperature”. Comparison of the temperature-dependence curves obtained by these two protocols revealed a marked difference particular for the three-flash experiments. The difference was attributed to the formation of a low-temperature sensitive precursor state between S₂ and S₃. The state is formed by two flash illumination given at −5 to −50°C, spontaneously transforms to normal S₃ on dark warming, and is not converted to S₀ by the 3rd flash. The precursor state was tentatively assigned to an S₃ in which H⁺ release is not completed.     

Multiple Roles of Tail Display by the Curly-Tailed Lizard Leiocephalus carinatus: Pursuit Deterrent and Deflective Roles of a Social Signal

The same display may be used in different contexts to convey different messages, or may have other, non-signaling functions. Several lines of evidence suggest that vertical tail curling, a previously documented social display in the lizard Leiocephalus carinatus , has antipredatory functions that may include pursuit deterrence and deflection of attacks from the body to the tail, which can be autotomized. An antipredatory role of tail curling is suggested by its more frequent occurrence when a predator is approaching than moving away, its greater frequency and intensity when a lizard is approached by a predator than when it moves spontaneously, and its greater frequency when the predator approaches directly rather than on a path bypassing the lizard. Evidence is presented contradicting use of tail curling for flash concealment or as an alarm signal to conspecifics. A pursuit-deterrent function of tail curling is suggested by its (1) more frequent use by lizards close to a refuge than those further from a refuge, (2) greater frequency during direct approaches by predators, and (3) much greater frequency when a predator is far enough away for pursuit to be deterred than when the predator is close enough to pose a high risk of capture. Lizards fled into a refuge without tail curling when the predator was very close, but often stopped outside a refuge while displaying the curled tail when the predator was farther away. Tail curling also may deflect attacks to the autotomizable tail, as suggested by its occurrence during spontaneous movements when no predator is approaching and by the high frequency of completely uncurled tails among individuals under bushes. The role of the tail in autotomy may facilitate evolution of pursuit-deterrent signals involving the tail.     

Similar Crowd Behavior in Organisms of Vastly Different Body Size

Crowd behaviors can have large fitness consequences for social organisms. Here we ask if there are similarities in the crowd dynamics of organisms that differ in body size, manner of locomotion, cognitive abilities, and state of alarm. Existing models of human crowd behavior have not been tested for their generality across species and body size nor across routine and emergency movements. We explore this issue by comparing the traffic dynamics of humans and of Argentine ants (Linepithema humile) to the predictions of our own model which was designed to simulate pedestrian movement. Some parameter values in the model were directly measured on ants but others were allometrically scaled from the human values to ant values based on the body mass difference. The model, with appropriately scaled parameters, correctly predicted two important properties of crowd behaviour for both organisms in a variety of circumstances: the flow rates and the distribution of time headways between successive ants in the escape sequence. The ability of a model of human pedestrian dynamics to predict behaviours of ant aggregations through allometric scaling of some parameter values suggests that there are fundamental features of crowd behavior that transcend the biological idiosyncrasies of the organisms involved.     

Traffic instabilities in self-organized pedestrian crowds

In human crowds as well as in many animal societies, local interactions among individuals often give rise to self-organized collective organizations that offer functional benefits to the group. For instance, flows of pedestrians moving in opposite directions spontaneously segregate into lanes of uniform walking directions. This phenomenon is often referred to as a smart collective pattern, as it increases the traffic efficiency with no need of external control. However, the functional benefits of this emergent organization have never been experimentally measured, and the underlying behavioral mechanisms are poorly understood. In this work, we have studied this phenomenon under controlled laboratory conditions. We found that the traffic segregation exhibits structural instabilities characterized by the alternation of organized and disorganized states, where the lifetime of well-organized clusters of pedestrians follow a stretched exponential relaxation process. Further analysis show that the inter-pedestrian variability of comfortable walking speeds is a key variable at the origin of the observed traffic perturbations. We show that the collective benefit of the emerging pattern is maximized when all pedestrians walk at the average speed of the group. In practice, however, local interactions between slow- and fast-walking pedestrians trigger global breakdowns of organization, which reduce the collective and the individual payoff provided by the traffic segregation. This work is a step ahead toward the understanding of traffic self-organization in crowds, which turns out to be modulated by complex behavioral mechanisms that do not always maximize the group's benefits. The quantitative understanding of crowd behaviors opens the way for designing bottom-up management strategies bound to promote the emergence of efficient collective behaviors in crowds.     

Sample Collection Protocol Effects on Quantification of Gene Expression in Potato Leaf Tissue

New platforms allow quantification of gene expression from large, replicated experiments but current sampling protocols for plant tissue using immediate flash freezing in liquid nitrogen are a barrier to these high-throughput studies. In this study, we compared four sampling methods for RNA extraction for gene expression analysis: (1) the standard sampling method of flash freezing whole leaves in liquid nitrogen immediately upon removal from the plant; (2) incubation of excised leaf disks for 2 min at field temperature followed by flash freezing; (3) incubation of excised leaf disks for 1 h on ice followed by flash freezing; and (4) incubation of excised leaf disks for 1 h at field temperature followed by flash freezing. Gene expression analysis was done for 23 genes using nCounter, and normalization of the data was done using the geometric mean of five housekeeping genes. Quality of RNA was highest for protocol A and lowest for protocol D. Despite some differences in RNA quality, gene expression was not significantly different among protocols A, B, and C for any of the 23 genes. Expression of some genes was significantly different between protocol D and the other protocols. This study demonstrates that when sampling leaf disks for gene expression analysis, the time between tissue removal from the plant and flash freezing in liquid nitrogen can be extended. This increase in time allowable during sampling provides greater flexibility in sampling large replicated field experiments for statistical analysis of gene expression data.     

Effects of light flashes on the dark closure of Albizzia julibrissin pinnules

An electronic flash unit is used to deliver, at the beginning of a 10 min dark period and within a few ms, large doses of light to Albizzia julibrissin pinnules, to ascertain their effects on the rate of pinnule closing. In a series of alternating light flashes at 710 and 550 nm, the first 710 nm light flash significantly retards closing. A following light flash at 550 nm negates the far-red induced delay. The second 710 nm light flash delays closing less effectively than the first when given within 4 s after the green flash, but is just as effective when given after 30 s. The delay brought about by the second 710 nm light flash is again abolished by a light flash at 550 nm. A light flash at 660 nm has no effect on pinnule closing by itself and is also ineffective in reversing the far-red induced delay. A series of ten 710 nm light flashes becomes most effective in delaying closure when there is a dark interval of one min between flashes. The closing delay induced by a 710 nm light flash escapes reversal by a 550 nm light flash when the dark interval between the two flashes exceeds 2–3 min. A 750 nm light flash has no retarding effect on pinnule closing, but it becomes effective when preceded by a 660 nm or 550 nm light flash. The results obtained are suggested to be due to light absorbed by phytochrome and an unknown photoreceptor with green, far-red photoreversal property.     

Eye Tracking the Face in the Crowd Task: Why Are Angry Faces Found More Quickly?

Among a crowd of distractor faces, threatening or angry target faces are identified more quickly and accurately than are nonthreatening or happy target faces, a finding known as the “face in the crowd effect.” Two perceptual explanations of the effect have been proposed: (1) the “target orienting” hypothesis (i.e., threatening targets orient attention more quickly than do nonthreatening targets and (2) the “distractor processing” hypothesis (i.e., nonthreatening distractors paired with a threatening target are processed more efficiently than vice versa, leading to quicker detection of threatening targets). Using a task, with real faces and multiple identities, the current study replicated the face in the crowd effect and then, via eye tracking, found greater support for the target orienting hypothesis. Across both the classical search asymmetry paradigm (i.e., one happy target in a crowd of angry distractors vs. one angry target in a crowd of happy distractors) and the constant distractor paradigm (i.e., one happy target in a crowd of neutral distractors vs. one angry target in a crowd of neutral distractors), fewer distractors were fixated before first fixating angry targets relative to happy targets, with no difference in the processing efficiency of distractors. These results suggest that the face in the crowd effect on this task is supported to a greater degree by attentional patterns associated with properties of target rather those of the crowd.     

ProServer: a simple, extensible Perl DAS server

SUMMARY: The increasing size and complexity of biological databases has led to a growing trend to federate rather than duplicate them. In order to share data between federated databases, protocols for the exchange mechanism must be developed. One such data exchange protocol that is widely used is the Distributed Annotation System (DAS). For example, DAS has enabled small experimental groups to integrate their data into the Ensembl genome browser. We have developed ProServer, a simple, lightweight, Perl-based DAS server that does not depend on a separate HTTP server. The ProServer package is easily extensible, allowing data to be served from almost any underlying data model. Recent additions to the DAS protocol have enabled both structure and alignment (sequence and structural) data to be exchanged. ProServer allows both of these data types to be served. AVAILABILITY: ProServer can be downloaded from http://www.sanger.ac.uk/proserver/ or CPAN http://search.cpan.org/~rpettett/. Details on the system requirements and installation of ProServer can be found at http://www.sanger.ac.uk/proserver/.     

Effects of successive predator attacks on prey aggregations

We study the cumulative effect of successive predator attacks on the disturbance of a prey aggregation using a modelling approach. Our model intends to represent fish schools attacked by both aerial and underwater predators. This individual-based model uses long-distance attraction and short-distance repulsion between prey, which leads to prey aggregation and swarming in the absence of predators. When intermediate-distance alignment is added to the model, the prey aggregation displays a cohesive displacement, i.e., schooling, instead of swarming. Including predators, i.e. with repulsion behaviour for prey to predators in the model, leads to flash expansion of the prey aggregation after a predator attack. When several predators attack successively, the prey aggregation dynamics is a succession of expanding-grouping-swarming/schooling phases. We quantify this dynamics by recording the changes in the simulated prey aggregation radius over time. This radius is computed as the longest distance of individual prey to the aggregation centroid, and it is assumed to increase along with prey disturbance. The prey aggregation radius generally increases during flash expansion, then decreases during grouping until reaching a constant lowest level during swarming/schooling. This general dynamics is modulated by several parameters: the frequency, direction (vertical vs. horizontal) and target (centroid of the prey aggregation vs. random prey) of predator attacks; the distance at which prey detect predators; the number of prey and predators. Our results suggest that both aerial and underwater predators are more efficient at disturbing fish schools by increasing their attack frequency at such level that the fish cannot return to swarming/schooling. We find that a mix between aerial and underwater predators is more efficient at disturbing a fish school than a single type of attack, suggesting that aerial and underwater foragers may gain mutual benefits in forming foraging groups.     

Security of grid structures under disguised traffic attacks

Models of rectangular grid structures were constructed in the form of a colored Petri net. The basic model consists of a matrix of switching nodes that deliver packets to computing nodes which are attached to the matrix borders and produce and consume packets. Since grid structures are often employed to solve boundary value problems, square and torus surfaces were studied and generalized to hypercube and hypertorus in multidimensional space using a grid node that aggregates switching and computing nodes. Traffic guns were added to the models to represent traffic attacks. Simulation in CPN Tools revealed simple and dangerous traffic gun configurations, such as a traffic duel, focus, crossfire, and side shot, which bring the grid to complete deadlock at less than 5 % of the grid peak load. Comparably low gun intensity targeted to induce deadlock areas within a grid (network) is a key characteristic of disguised traffic attacks. The aim of future work will be to develop counter-measures for these attacks.     

蓝莓离体叶片胚状体高效发生及其组织学观察

以高灌蓝莓试管苗叶片为外植体、以改良WPM为基本培养基,研究了外源激素TDZ、ZT及其组合对离体叶片胚状体发生的影响,同时也探讨了蔗糖浓度、水解酪蛋白、椰汁等对胚状体发生、丛芽形成的影响.结果表明:不同浓度的外源激素TDZ、ZT及其组合对胚状体的发生频率、丛芽的形成和生长起重要作用;蔗糖浓度对胚状体的发生及丛芽的生长影响较大,而添加有机质则对胚状体的发生及丛芽的生长没有明显影响.适合高灌蓝莓叶片胚状体发生及成苗的培养基为WPM TDZ 0.04 mg/L ZT 0.25～2.0 mg/L 蔗糖20～40 g/L,而培养基WPM ZT 0.5～1.0 mg/L 蔗糖20 g/L适合于丛芽继代生长.组织学观察表明,蓝莓叶片胚状体发生主要起源于叶上表皮细胞和部分叶肉细胞,可能为多细胞起源,历经多细胞原胚、原球胚、梨形胚、心形胚、子叶胚等发育阶段,并能直接发育成苗.     

IP traceback with sparsely-tagged fragment marking scheme under massively multiple attack paths

IP traceback is known to be one of the most effective measures to deter Internet attacks. Various techniques for IP traceback have been suggested. Among them, we focus on Probabilistic Packet Marking scheme (PPM) with tagging. We believe PPM is more advantageous than others because it does not generate additional network traffic and requires minimal protocol change. However, three parameters need to be optimized to make PPM practical under massively multiple attack paths: the number of packets to collect, the number of fragment combinations to recover the IP addresses, and the false positive error rate. Tagging is an effective way to reduce the number of combinations but it increases the false positive error rates when the number of routers in the attack paths grows. Other PPM-related techniques suggested in the past have similar problems. They improve one or two parameters at the expense of others, or they require additional data structures such as an upstream router map. In this paper, we propose a method that optimizes the three parameters at the same time and recovers original IPs quickly and correctly even in the presence of massive multiple attack paths. Our method does not need either a combinatorial process to recover IPs or additional information such as an upstream router map. Our result shows that our method recovers 95% of the original IPs correctly with no fragment combinations and with zero false positives. It needs to collect only 8N packets per router where N is the number of routers involved in the attack paths.     

Features of transformation of phosphates in Rhodobacter sphaeroides chromatophores

We have found the ATP production in the Rhodobacter sphaeroides chromatophores illuminated by single short light flash, that is under conditions when the proton gradient formed as a result of electron transport after the second flash, is absent. The ATP synthesis was accompanied by the H2O2 formation. Simultaneous formation of H2O2 is indicative of the oxidative activation of phosphate during the ATP synthesis, as in the model systems with isolated chlorophyll. These data provide a theoretical background to the fitting of illumination parameters in both laboratory and industrial photobioreactors with photosynthetic bacteria used in biotechnological processes.     

Flash Expansion Threshold in Whirligig Swarms

In the selfish herd hypothesis, prey animals move toward each other to avoid the likelihood of being selected by a predator. However, many grouped animals move away from each other the moment before a predator attacks. Very little is known about this phenomenon, called flash expansion, such as whether it is triggered by one individual or a threshold and how information is transferred between group members. We performed a controlled experiment with whirligig beetles in which the ratio of sighted to unsighted individuals was systematically varied and emergent flash expansion was measured. Specifically, we examined: the percentage of individuals in a group that startled, the resulting group area, and the longevity of the flash expansion. We found that one or two sighted beetles in a group of 24 was not enough to cause a flash expansion after a predator stimulus, but four sighted beetles usually initiated a flash expansion. Also, the more beetles that were sighted the larger the resulting group area and the longer duration of the flash expansion. We conclude that flash expansion is best described as a threshold event whose adaptive value is to prevent energetically costly false alarms while quickly mobilizing an emergent predator avoidance response. This is one of the first controlled experiments of flash expansion, an important emergent property that has applications to understanding collective motion in swarms, schools, flocks, and human crowds. Also, our study is a convincing demonstration of social contagion, how the actions of one individual can pass through a group.     

Visitor effects on the behavior of captive Western lowland gorillas: the importance of individual differences in examining welfare

Given the conflicting and somewhat limited findings available on the effect of zoo visitors on primate behavior, the primary purpose of this study was to provide additional data on gorillas' response to variations in crowd size and to look at what other factors—both intrinsic (e.g. personality, sex, and rearing history) and extrinsic (e.g. group)—might influence such responses. Subjects included four groups (three mixed‐sex and one bachelor) of captive western lowland gorillas living at Zoo Atlanta. Overall activity budgets and rates of social behaviors in high and low crowd conditions were compared. Behaviors suggestive of general welfare did not vary as a function of crowd size alone, although we did observe one significant interaction and several trends. Specifically, two groups spent more time engaged in undesirable behaviors in the high crowd condition, whereas the other two groups showed the opposite response pattern. Additionally, males, but not females, showed a trend toward greater rates of contact aggression in the high crowd condition, although wounding rates did not vary with crowd size. We also found trends towards variation in response to crowd size as a function of individual personality ratings. These results suggest that although the visitor effect may constitute an impediment to optimal animal welfare, this may only apply to some individuals or groups. We emphasize the importance of continuing to explore individual differences and the limitations of a one‐size‐fits‐all approach when describing influences on animal welfare. Zoo Biol 31:586‐599, 2012. © 2011 Wiley Periodicals, Inc.