Title: Securing Online Communities against Evolving Denial of Information Attacks

Danesh Irani <danesh@cc.gatech.edu>
School of Computer Science
College of Computing
Georgia Institute of Technology
http://www.cc.gatech.edu/~danesh/

Date:        May 8th, 2012
Time:        12pm-2pm EST
Location:    KACB 3402

Committee:

• Dr. Calton Pu (Advisor, Professor and John P. Imlay Jr. Chair in Software, School of Computer Science, Georgia Institute of Technology)
• Dr. Mustaque Ahamad (Professor, School of Computer Science, Georgia Institute of Technology)
• Dr. Jonathon Giffin (Assistant Professor, School of Computer Science, Georgia Institute of Technology)
• Dr. Ling Liu (Professor, School of Computer Science, Georgia Institute of Technology)
• Dr. Kang Li (Associate Professor, Department of Computer Science, University of Georgia)

Abstract:
    Online communities are growing at a phenomenal rate.  With the large number of users these communities contain, attackers are attracted to try and abuse them.  Although there are many different ways to abuse them, one of the hardest to secure against is a Denial of Information (DoI) attack.  A Denial of Information attack involves flooding a system with low-quality information, detracting from the usefulness of the online community.  In extreme cases, DoI attacks make communities unusable due to the high amounts of low-quality information, leading to an analogue of a Denial of Service (DoS) attack.
     In my dissertation, I introduce techniques for detection of evolving DoI attacks in online communities using meta-model classification and information unification approaches.  I apply insights gained from analysis of the evolution of an arms-race to measure the resilience of our approaches to adaptations by attackers.
    My meta-model classification approach involves classifying the "connected payload" associated with the information and using the classification result for the determination.  This approach allows for detection of DoI attacks in emerging domains where the amount of information may be constrained.  My information unification approach allows for detection of DoI attacks that previously could not be detected.  Unifying information across domains provides multiple sources for a single piece of information as well as additional pieces of information specific to each domain.  Using this we then identify previously undetectable DoI attacks in the unified information.