Improving traffic safety is considered as one of the most important tasks by many countries, and current solutions are not very effective due to the human factor. There are 30,000 deaths and 2.2 million injuries caused by car accidents each year just in the US alone. Many of these accidents are due to the lack of sufficient traffic information and slow driver reaction. Vehicular ad hoc networks (VANETs) is a peer-to-peer communication protocol designed to improve traffic safety. In order to achieve this, cars communicate with each other over a wireless channel exchanging information such as their current speeds, locations, heading angles, brake system statuses, etc. VANETs help collect traffic information more accurately and from a much wider area than drivers.

Autonomous driving eliminates the human factor, which will prevent traffic accidents more effectively. Autonomous vehicles are expected to be on the market in 2020. VANET will be used by these cars since it decreases the dependency on expensive sensors, thus making the deployment of autonomous vehicles easier and faster. The accurate traffic information collected using VANETs from a wide area will provide highly effective collision avoidance tools in these autonomous vehicles. However, these benefits are counterbalanced by possible security attacks. Researchers showed that computers inside these vehicles can be compromised; as a result, attackers can take full control of them. Similar to Internet botnets, we can expect that attackers will organize these vehicles into vehicular botnets. We demonstrate the particular dangers of this threat by designing vehicular botnets that consist of these compromised autonomous cars. Existing research into security problems with autonomous vehicles cannot properly cope with our vehicular botnets since they fail to consider the possibility of cooperative malicious cars.

This dissertation investigates the potential uses of vehicular botnets, how they can be organized and controlled, and how we might detect and defend against them. We discuss how an attacker who controls a number of vehicles can organize them into a botnet using the current VANET infrastructure. We demonstrate three powerful attacks performed by our vehicular botnets. We then present our detection mechanism to find vehicular botnets, discuss possible approaches to evict them from the network, and the effect of their eviction. Our work is the first that ever proposed and designed vehicular botnets in the literature. The evaluation of our work is solely through simulations since experimenting with real autonomous vehicles is impractical and dangerous.

High volume DDoS attacks continue to cause serious financial losses and damage to company reputations, despite years of research in preventing and mitigating them. Many proposed techniques for handling these attacks assume that the attack has already been detected and its traffic properly characterized; yet, existing methods of detecting and characterizing such attacks have not been widely adopted, for various reasons. We describe a scalable real-time DDoS monitoring system that leverages modern big data technologies to effectively analyze high volume DDoS attacks. Evaluated on multiple large-scale traffic datasets that capture recent real-world DDoS attacks and synthetic traffic based on sophisticated attack characteristics, our approach detects and characterizes these attacks quickly and accurately. Furthermore, we show that our monitoring system 1) clearly justifies its decisions resulting from explainable analysis of input traffic volume metrics, thus increasing monitoring transparency and facilitating the diagnosis and debugging of monitoring performance for network security teams 2) leverages identified attack characteristics to separate benign from malicious traffic and send helpful defense recommendations, the identified attack characteristics and malicious traffic traces, to downstream DDoS traffic filtering systems.

Ever since the earliest days of the Internet, malware has been a problem for computers. Since then, this problem’s severity has only increased, with important organizations like universities and hospitals suffering major security breaches due to malware. As detection techniques get more advanced, so do attackers' evasion attempts. One such method, called the mimicry attack, introduces benign behavior to malware to produce a benign classification in detectors even while retaining its malicious behaviors. In this document, I will describe the work we did on developing malware detection methods that remain effective in the presence of such evasion attacks. Using Windows APIs, our detection pipeline generates a summary of program behavior, vectorizes it in a way that's robust to modifications, and constrains features to reduce the impact of added benign behaviors. We use two methods of constraining features, enforcing monotonicity on them and removing them from the feature vector. To evaluate this detection pipeline and other methods, we use hooking and injection techniques to generate mimicry attacks that can insert benign behavior in more locations than prior work, and are thus produce stronger attacks than prior work. Our results show that our methods can effectively and consistently detect malware that use both mimicry attacks and adversarial attacks with minimal accuracy loss in vanilla data.

In this dissertation, we describe avoidance routing. Avoidance routing is a mechanism that provides users control over how their data transits the Internet. Currently, a user may use cryptography to provide confidentially for their data, but has no control over who can observe or access their data. Avoidance routing provides this control by having users specify properties of routers they do not trust, such as geopolitical location. A path to the destination that does not transit routers with the given properties is found, on-demand, with reasonable assurances that the path found does not contain untrusted routers.

Avoidance routing accomplishes this by augmenting BGP with a security vector. This vector contains the properties of each router along the given AS path. Given this vector and a users criteria, avoidance routing conducts a depth-first search to find a valid path the destination. We leverage the information contained within BGP to try and find this path quickly and optimally. Our results show that avoidance routing tends to find short paths, on average 7 hops longer than the standard path in the worst case. Further, less than 1\% of nodes on the Internet are visited, and only 5\% in the worst case. The storage space required to store the augmented advertisements or conduct the search is both reasonable and small. Finally, their is no performance impact in terms of packet forwarding by using avoidance routing.

We will discuss our use of a consensus mechanism to provide protection of routing information. This mechanism treats each neighbor of a node as a consensus speaker or ``voter''. These speakers will each make claims about their neighbor, and the consensus approach will attempt to determine the validity of these claims as well as the quality of each speaker. When routing, only nodes with high agreement on their claims will be used, as well as only speakers with high quality. Our results show that our consensus mechanism, while simple, also provides reasonable security guarantees.

Protecting data from accidental loss or theft is crucial in today's world of

mobile computing. Data Tethers provides environmental policy control of information at the data level, rather than the file level. Data Tethers uses dynamic recompilation to add label tracking instructions to existing applications in the OpenSolaris operating system, allowing fine-grain data flow tracking in legacy applications without the need to recompile from source. We demonstrate the system's feasibility with microbenchmarks that show individual component performance and benchmarks of real user applications like word processors and spreadsheets.

Currently, every packet sent on the Internet goes through numerous routers and intermediaries until it gets to the intended receiver. While routing the traffic, these intermediaries (referred to as middleboxes) are potentially capable of making significant changes to what happens to a traffic stream on the network. During the past decade, a wide variety of middleboxes have been proposed, implemented and deployed. Examples include traffic shapers, proxies, firewalls, and WAN optimizers. These middleboxes are becoming a common element of various types of networks, making their detection by end-hosts beneficial and in some cases crucial.

One class of intermediaries, defined as "payload-preserving middleboxes", makes no changes to the content of the traffic, giving the appearance that nothing has been done to the stream other than routing it to the destination. This transparency property can make end-to-end detection of such intermediaries very challenging in most cases. The main contribution of this dissertation is to investigate the detectability of such middleboxes by seeking answers to this question: "If they pay attention, can the sender or receiver (or both if they cooperate) determine that something of this kind has been done?''

Another contribution of this dissertation is to view and analyze the universal set of all middlebox interferences on network traffic as a whole. We partition this set of middlebox interferences into detectable and undetectable middleboxes. Within the detectable partition, we introduce the notion of normally detectable middleboxes, denoting that a certain type of middlebox is detectable under normal Internet conditions, with a specific degree of certainty. In this research we developed a general framework to detect network discriminators, which we have defined as middleboxes that delay and/or drop packets in a discriminatory fashion. We achieved this by modeling their interference on the network and proposing a unified solution to the detectability problem, rather than ad hoc approaches that are only applicable to a specific type of middlebox.

To illustrate the implementation feasibility of our generalization idea, we then used our results to detect a number of prevalent and important middleboxes: network compression, traffic prioritization, and traffic shaping/policing. In addition to the analytical approach that we took to solve our detection problem, our results are also supported by extensive network simulations and live Internet experiments using a real middlebox.

Typically used to save space, non-lossy data compression can save time and energy during communication if the cost to compress and send data is less than the cost of sending uncompressed data. However, compression can degrade efficiency if it compresses insufficiently or delays the operation significantly, which can depend on many factors. Because predicting the best strategy is risky and difficult, compression (if available) is typically manually controlled, resulting in missed opportunities and avoidable losses.

This dissertation describes Datacomp, a general-purpose Adaptive Compression (AC) framework that improves efficiency in terms of time, space and energy for real-world workloads on real-world systems like laptops and smartphones. Prior systems are limited in important ways or rely on external hosts for prediction and compression, reducing their effectiveness or imposing unnecessary dependencies. In contrast, Datacomp is a Local Adaptive Compression system capable of choosing between numerous compressors using system monitors, a novel compressibility estimation technique and a history mechanism. Datacomp wraps system calls with AC capabilities, enabling applications to benefit with little modification. I also built Comptool, an off-line "AC oracle" for investigation and validation. Comptool, which includes LEAP energy-measurement capabilities, identifies the best-case compression strategy for a given scenario, highlighting critical factors for AC and providing a valuable standard against which to compare systems such as Datacomp.

I evaluated two Datacomp-enabled utilities: drcp, a throughput-sensitive remote copy tool and dzip, an AC-enabled compression utility. I collected hundreds of megabytes of nine common but distinct classes of data to serve as workloads, including web traces, binaries, email and collections of personal data from volunteers. Experiments were performed using both Comptool and Datacomp while varying the data type, bandwidth, CPU load, frequency, and more. Up to and including 100Mbit/s, Datacomp consistently came within 1-3% of the best strategy identified by Comptool, improving throughput for realistic types by up to 74% over no compression, and up to 45% over zlib compression. Comptool generated strategies that could improve efficiency at gigabit speeds (over no compression) by up to 28% for Wikipedia data and 14% for Facebook data.

Many applications today rely on storage and management of semi-structured information. Data stored in such databases often has to be shared with untrusted third parties for research-related or other purposes, which makes privacy a fundamental problem. In this thesis, we study privacy-preserving publishing of hierarchical data, where an individual's information in a database can be collected and represented using a tree structure. We provide practical algorithms and solutions regarding how some of the well-known privacy definitions (e.g., k-anonymity and l-diversity), which were designed for tabular data, can be generalized and applied to hierarchical data. We show that different solutions are preferable depending on the needs and expectations of data recipients, in order to maximize data applicability and utility. Thus, we introduce a range of techniques to anonymize hierarchical data. We experiment on realistic synthetic databases to test our algorithms and validate our claims.