Abstract: Various embodiments provide a method and apparatus for providing queries in an information-centric network. In particular, the content is identified by a name that includes discrete components that identify the participating caching nodes within a network. Caching nodes store a reference to the content and are configured to provide the address of the node(s) providing the requested content.

Abstract: In a system for evaluating classification systems such as an operating system (OS) fingerprinting tool (e.g., Nmap), information gain is used as a metric to evaluate the quality of the tool's classification tests, including fingerprinting tests and their associated probes. Information gain is determined using the OS fingerprinting tool's signature database rather than raw training samples, including taking into account signatures/data that are represented by ranges of test values, disjunctive values, and missing values. Uniform distributions over test values and classifications are assumed in applying these methods to an example signature database for Nmap. Other assumptions or a priori information (e.g., normal distributions over ranges) can also be accommodated. The information gain measure provided can be applied to other classification problems as well.

Abstract: A method is provided for assessing the susceptibility of a NIDS to evasion. In an embodiment, the method involves intercepting packets that pass through a NIDS or other defensive device, reading, from the intercepted packets, message sequences that pertain to at least one protocol or network application, and constructing at least one stochastic sequential model of usage of the protocol from the protocol sequences.

Abstract: In a system for evaluating classification systems such as an operating system (OS) fingerprinting tool (e.g., Nmap), information gain is used as a metric to evaluate the quality of the tool's classification tests, including fingerprinting tests and their associated probes. Information gain is determined using the OS fingerprinting tool's signature database rather than raw training samples, including taking into account signatures/data that are represented by ranges of test values, disjunctive values, and missing values. Uniform distributions over test values and classifications are assumed in applying these methods to an example signature database for Nmap. Other assumptions or a priori information (e.g., normal distributions over ranges) can also be accommodated. The information gain measure provided can be applied to other classification problems as well.