Abstract: Systems, devices and methods for a Domain Name Data Networking (DNDN) content delivery system are disclosed. Embodiments perform operations including obtaining a content object having a unique identifier. The operations also include storing a local instance of the content object in association with DNS resource records and the unique identifier. The operations further include providing the local instance of the content to a client in response to receiving a request from the client including the unique identifier.

Abstract: The disclosure is directed to providing content access control in information centric networking (ICN) networks. Methods and systems include hardware and/or software that perform operations for sending to a content provider of an ICN network an access request for content in response to receiving a first content request from a client. The operations also include receiving from the content provider access control information for the content. The operations further include sending to the client a challenge. Additionally, the operations include receiving from the client an authorization of the content provider that includes information obtained by the client from the content provider based on the challenge. Furthermore, the operations include verifying the authorization received from the client using the access control information received from the content provider. Moreover, the operations include sending to the client the content.

Abstract: Systems, devices and methods for a Domain Name Data Networking (DNDN) content delivery system are disclosed. Embodiments perform operations including obtaining a content object having a unique identifier. The operations also include storing a local instance of the content object in association with DNS resource records and the unique identifier. The operations further include providing the local instance of the content to a client in response to receiving a request from the client including the unique identifier.

Abstract: Systems, devices and methods for a Domain Name Data Networking (DNDN) content delivery system are disclosed. Embodiments perform operations including obtaining a content object having a unique identifier. The operations also include storing a local instance of the content object in association with DNS resource records and the unique identifier. The operations further include providing the local instance of the content to a client in response to receiving a request from the client including the unique identifier.

Abstract: The disclosure is directed to providing content access control in information centric networking (ICN) networks. Methods and systems include hardware and/or software that perform operations for sending to a content provider of an ICN network an access request for content in response to receiving a first content request from a client. The operations also include receiving from the content provider access control information for the content. The operations further include sending to the client a challenge. Additionally, the operations include receiving from the client an authorization of the content provider that includes information obtained by the client from the content provider based on the challenge. Furthermore, the operations include verifying the authorization received from the client using the access control information received from the content provider. Moreover, the operations include sending to the client the content.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for characterizing domain names by determining a name server switching footprint for domain names using a data set corresponding to name server operations for the domain names. The domain names can be clustered into groups based on the name server switching footprints, and intended uses of domain names in a group can be extrapolated to other domain names in the group. Name server switching footprints can also be predicted for new domains names using a prediction model trained using the determined name server switching footprints for the domain names in the data set.

Abstract: Embodiments relate to systems, devices, and computing-implemented methods for separating malware and background events to classify malware based on traffic data by receiving the traffic data that includes malware events and background noise, converting the traffic data into a feature vector, performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, where the signal processing algorithm is associated with a malware family, determining a score for the malware events using a malware classification algorithm associated with the malware family, and applying a label associated with the malware family to the traffic data based on the score to classify the traffic data. Additionally, the malware application can be contained, removed, and/or the effects of a malware application can be neutralized based on the classification.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for preventing determination of previous access of sensitive content by receiving, from a user, a request for content at a device in an information centric network, where a cached version of the content is locally stored at the device; initiating a time delay based on a determination that the user has not previously requested the content; and transmitting the cached version of the content to the user after the time delay.

Abstract: The present invention generally relates to systems and methods for classifying executable files as likely malware or likely benign. The techniques utilize temporally-ordered network behavioral artifacts together with machine learning techniques to perform the classification. Because they rely on network behavioral artifacts, the disclosed techniques may be applied to executable files with obfuscated code.

Abstract: The disclosure is directed to providing content access control in information centric networking (ICN) networks. Methods and systems include hardware and/or software that perform operations for sending to a content provider of an ICN network an access request for content in response to receiving a first content request from a client. The operations also include receiving from the content provider access control information for the content. The operations further include sending to the client a challenge. Additionally, the operations include receiving from the client an authorization of the content provider that includes information obtained by the client from the content provider based on the challenge. Furthermore, the operations include verifying the authorization received from the client using the access control information received from the content provider. Moreover, the operations include sending to the client the content.

Abstract: The present invention generally relates to systems and methods for classifying executable files as likely malware or likely benign. The techniques utilize temporally-ordered network behavioral artifacts together with machine learning techniques to perform the classification. Because they rely on network behavioral artifacts, the disclosed techniques may be applied to executable files with obfuscated code.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for preventing determination of previous access of sensitive content by receiving, from a user, a request for content at a device in an information centric network, where a cached version of the content is locally stored at the device; initiating a time delay based on a determination that the user has not previously requested the content; and transmitting the cached version of the content to the user after the time delay.

Abstract: Systems, devices and methods for a Domain Name Data Networking (DNDN) content delivery system are disclosed. Embodiments perform operations including obtaining a content object having a unique identifier. The operations also include storing a local instance of the content object in association with DNS resource records and the unique identifier. The operations further include providing the local instance of the content to a client in response to receiving a request from the client including the unique identifier.

Abstract: The present invention generally relates to systems and methods for classifying executable files as likely malware or likely benign. The techniques utilize temporally-ordered network behavioral artifacts together with machine learning techniques to perform the classification. Because they rely on network behavioral artifacts, the disclosed techniques may be applied to executable files with obfuscated code.

Abstract: Embodiments relate to systems, devices, and computing-implemented methods for separating malware and background events to classify malware based on traffic data by receiving the traffic data that includes malware events and background noise, converting the traffic data into a feature vector, performing a signal processing algorithm on the feature vector to separate the malware events from the background noise, where the signal processing algorithm is associated with a malware family, determining a score for the malware events using a malware classification algorithm associated with the malware family, and applying a label associated with the malware family to the traffic data based on the score to classify the traffic data. Additionally, the malware application can be contained, removed, and/or the effects of a malware application can be neutralized based on the classification.

Abstract: The present invention generally relates to systems and methods for classifying executable files as likely malware or likely benign. The techniques utilize temporally-ordered network behavioral artifacts together with machine learning techniques to perform the classification. Because they rely on network behavioral artifacts, the disclosed techniques may be applied to executable files with obfuscated code.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for characterizing domain names by determining a name server switching footprint for domain names using a data set corresponding to name server operations for the domain names. The domain names can be clustered into groups based on the name server switching footprints, and intended uses of domain names in a group can be extrapolated to other domain names in the group. Name server switching footprints can also be predicted for new domains names using a prediction model trained using the determined name server switching footprints for the domain names in the data set.

Abstract: Embodiments relate to systems, devices, and computer-implemented methods for preventing determination of previous access of sensitive content by receiving, from a user, a request for content at a device in an information centric network, where a cached version of the content is locally stored at the device; initiating a time delay based on a determination that the user has not previously requested the content; and transmitting the cached version of the content to the user after the time delay.

Abstract: There are provided an apparatus and a method for privacy protection in association rule mining among data mining technologies. An apparatus for privacy protection in association rule mining according to an embodiment of the present invention comprises: a fake transaction inserter that generates fake transactions of a predetermined number each having a predetermined length and inserts the fake transactions between a plurality of transactions comprised in an original data set to generate a first virtual data set; and a distortion transaction generator that generates a second virtual data set by converting data of the transaction of the first virtual data set with a predetermined probability.

Abstract: The present invention includes a rotation based transformation method for preserving data privacy. A rotation based transformation method according to an embodiment of the present invention divides a given data set into a plurality of data subsets, applies a plurality of different rotation matrixes to the plurality of divided data subsets, respectively, to rotate the plurality of data subsets, and re-concatenates the plurality of rotated data subsets to generate a rotated data set. The rotated data set is released and used for data clustering. The rotation based transformation method is effectively used when the impact of the AK-ICA attack is mitigated. Meanwhile, when the two parties are related to the present invention, the two parties need to agree on parameters, such as the number of data subsets. It is preferable that the data subsets be divided into equal sizes.