arXiv subjects

Konstantinos Pelechrinis

Publications and source records attributed to Konstantinos Pelechrinis.

28 records · Page 2Linked to original sources

arXiv2018

Mining actionable information from security forums: the case of malicious IP addresses

The goal of this work is to systematically extract information from hacker forums, whose information would be in general described as unstructured: the text of a post is not necessarily following any writing rules. By contrast, many security initiatives and commercial entities are harnessing the readily public information, but they seem to focus on structured sources of information. Here, we focus on the problem of identifying malicious IP addresses, among the IP addresses which are reported in the forums. We develop a method to automate the identification of malicious IP addresses with the design goal of being independent of external sources. A key novelty is that we use a matrix decomposition method to extract latent features of the behavioral information of the users, which we combine with textual information from the related posts. A key design feature of our technique is that it can be readily applied to different language forums, since it does not require a sophisticated Natural Language Processing approach. In particular, our solution only needs a small number of keywords in the new language plus the users behavior captured by specific features. We also develop a tool to automate the data collection from security forums. Using our tool, we collect approximately 600K posts from 3 different forums. Our method exhibits high classification accuracy, while the precision of identifying malicious IP in post is greater than 88% in all three forums. We argue that our method can provide significantly more information: we find up to 3 times more potentially malicious IP address compared to the reference blacklist VirusTotal. As the cyber-wars are becoming more intense, having early accesses to useful information becomes more imperative to remove the hackers first-move advantage, and our work is a solid step towards this direction.

cs.SI↗

arXiv2018

iWinRNFL: A Simple, Interpretable & Well-Calibrated In-Game Win Probability Model for NFL

During the last few sports seasons a lot of discussion has been generated for the several, high-profile, "comebacks" that were observed in almost all sports. The Cavaliers won the championship after being down 3-1 in the 2016 NBA finals' series against the Golden State Warriors, which was exactly the case for Chicago Cubs and the World Series. The Patriots won the Super Bowl in 2016 even though they were trailing by 25 points late in the third quarter, while FC Barcelona in the top-16 round of the 2016-17 Champions League scored 3 goals during the last 7 minutes of the game (including stoppage time) against PSG to advance in the tournament. This has brought the robustness and accuracy of the various probabilistic prediction models under high scrutiny. Many of these models are proprietary, which makes it hard to evaluate. In this paper, we build a simple and open, yet robust and well-calibrated, in-game probability model for predicting the winner in an NFL (iWinRNFL) game. In particular, we build a logistic regression model that utilizes a set of 10 variables to predict the running win probability for the home team. We train our model using detailed play-by-play data from the last 7 NFL seasons obtained through the league's API. Our results indicate that in 75% of the cases iWinRNFL provides an accurate winner projection, as compared to a 63% accuracy of a baseline pre-game win probability model. Most importantly the probabilities that iWinRNFL provides are well-calibrated. Finally, we have also evaluated more complex, non-linear, models using the same set of features, without any significant improvement in performance.

stat.AP↗

arXiv2017

LinNet: Probabilistic Lineup Evaluation Through Network Embedding

Which of your team's possible lineups has the best chances against each of your opponents possible lineups? In order to answer this question we develop LinNet. LinNet exploits the dynamics of a directed network that captures the performance of lineups at their matchups. The nodes of this network represent the different lineups, while an edge from node j to node i exists if lineup i has outperformed lineup j. We further annotate each edge with the corresponding performance margin (point margin per minute). We then utilize this structure to learn a set of latent features for each node (i.e., lineup) using the node2vec framework. Consequently, LinNet builds a model on this latent space for the probability of lineup A beating lineup B. We evaluate LinNet using NBA lineup data from the five seasons between 2007-08 and 2011-12. Our results indicate that our method has an out-of-sample accuracy of 69%. In comparison, utilizing the adjusted plus-minus of the players within a lineup for the same prediction problem provides an accuracy of 56%. More importantly, the probabilities are well-calibrated as shown by the probability validation curves. One of the benefits of LinNet - apart from its accuracy - is that it is generic and can be applied in different sports since the only input required is the lineups' matchup performances, i.e., not sport-specific features are needed.

stat.AP↗

arXiv2016

Footballonomics: The Anatomy of American Football; Evidence from 7 years of NFL game data

Do NFL teams make rational decisions? What factors potentially affect the probability of wining a game in NFL? How can a team come back from a demoralizing interception? In this study we begin by examining the hypothesis of rational coaching, that is, coaching decisions are always rational with respect to the maximization of the expected points scored. We reject this hypothesis by analyzing the decisions made in the past 7 NFL seasons for two particular plays; (i) the Point(s) After Touchdown (PAT) and (ii) the fourth down decisions. Having rejected the rational coaching hypothesis we move on to examine how the detailed game data collected can potentially inform game-day decisions. While NFL teams personnel definitely have an intuition on which factors are crucial for winning a game, in this work we take a data-driven approach and provide quantifiable evidence using a large dataset of NFL games for the 7-year period between 2009 and 2015. In particular, we use a logistic regression model to identify the impact and the corresponding statistical significance of factors such as possession time, number of penalty yards, balance between passing and rushing offense etc. Our results clearly imply that avoiding turnovers is the best strategy for winning a game but turnovers can be overcome with letting the offense on the field for more time. Finally we combine our descriptive model with statistical bootstrap in order to provide a prediction engine for upcoming NFL games. Our evaluations indicate that even by only considering a small number of (straightforward) factors, we can achieve a very good prediction accuracy. In particular, the average accuracy during seasons 2014 and 2015 is approximately 63%. This performance is comparable to the more complicated state-of-the-art prediction systems, while it outperforms expert analysts 60% of the time.

stat.AP↗

arXiv2016

The Anatomy of the Three-Point Shot: Spatial Bias, Fractals and the Three-Point Line in the NBA

Even though it might have taken some time, the three-point line ultimately changed the way the game is played as evidenced by the increase in the three-point shot attempts over the years. However, during the last few years we have experienced record-breaking seasons in terms of both three-point attempts and field goals made. This brings back to the surface questions such as "What is the rationale behind the three-point line?", "Is the three-point shot distance appropriate?" and many more similar questions. In this work, even though we do not take a stand against the three-point line, we provide evidence that challenge its distance. In particular, we analyze shot charts and we identify a statistically significant discontinuity in the shot attempts between 1-feet zones just inside and outside the three-point line. In addition we introduce a metric inspired by fractal theory to quantify this bias and our results clearly indicate that the space dimensionality in these areas of the court is not fully exploited. By further examining the field goal percentages in the zones considered, we do not identify a similar discontinuity, i.e., the field goal percentage just inside the three-point line and just outside the line are statistically identical. Therefore, even though the shooting behavior of the teams appears to be rational, it raises important questions about the rationality of the three-point line itself.

stat.AP↗

arXiv2015

Analyzing and Modeling Special Offer Campaigns in Location-based Social Networks

The proliferation of mobile handheld devices in combination with the technological advancements in mobile computing has led to a number of innovative services that make use of the location information available on such devices. Traditional yellow pages websites have now moved to mobile platforms, giving the opportunity to local businesses and potential, near-by, customers to connect. These platforms can offer an affordable advertisement channel to local businesses. One of the mechanisms offered by location-based social networks (LBSNs) allows businesses to provide special offers to their customers that connect through the platform. We collect a large time-series dataset from approximately 14 million venues on Foursquare and analyze the performance of such campaigns using randomization techniques and (non-parametric) hypothesis testing with statistical bootstrapping. Our main finding indicates that this type of promotions are not as effective as anecdote success stories might suggest. Finally, we design classifiers by extracting three different types of features that are able to provide an educated decision on whether a special offer campaign for a local business will succeed or not both in short and long term.

cs.SI↗

arXiv2012

Gaming the Game: Honeypot Venues Against Cheaters in Location-based Social Networks

The proliferation of location-based social networks (LBSNs) has provided the community with an abundant source of information that can be exploited and used in many different ways. LBSNs offer a number of conveniences to its participants, such as - but not limited to - a list of places in the vicinity of a user, recommendations for an area never explored before provided by other peers, tracking of friends, monetary rewards in the form of special deals from the venues visited as well as a cheap way of advertisement for the latter. However, service convenience and security have followed disjoint paths in LBSNs and users can misuse the offered features. The major threat for the service providers is that of fake check-ins. Users can easily manipulate the localization module of the underlying application and declare their presence in a counterfeit location. The incentives for these behaviors can be both earning monetary as well as virtual rewards. Therefore, while fake check-ins driven from the former motive can cause monetary losses, those aiming in virtual rewards are also harmful. In particular, they can significantly degrade the services offered from the LBSN providers (such as recommendations) or third parties using these data (e.g., urban planners). In this paper, we propose and analyze a honeypot venue-based solution, enhanced with a challenge-response scheme, that flags users who are generating fake spatial information. We believe that our work will stimulate further research on this important topic and will provide new directions with regards to possible solutions.

cs.SI↗

arXiv2012

Cognitive Radio Networks: Realistic or Not?

A large volume of research has been conducted in the cognitive radio (CR) area the last decade. However, the deployment of a commercial CR network is yet to emerge. A large portion of the existing literature does not build on real world scenarios, hence, neglecting various important interactions of the research with commercial telecommunication networks. For instance, a lot of attention has been paid to spectrum sensing as the front line functionality that needs to be completed in an efficient and accurate manner to enable an opportunistic CR network architecture. This is necessary to detect the existence of spectrum holes without which no other procedure can be fulfilled. However, simply sensing (cooperatively or not) the energy received from a primary transmitter cannot enable correct dynamic spectrum access. For example, the low strength of a primary transmitter's signal does not assure that there will be no interference to a nearby primary receiver. In addition, the presence of a primary transmitter's signal does not mean that CR network users cannot access the spectrum since there might not be any primary receiver in the vicinity. Despite the existing elegant and clever solutions to the DSA problem no robust, implementable scheme has emerged. In this paper, we challenge the basic premises of the proposed schemes. We further argue that addressing the technical challenges we face in deploying robust CR networks can only be achieved if we radically change the way we design their basic functionalities. In support of our argument, we present a set of real-world scenarios, inspired by realistic settings in commercial telecommunications networks, focusing on spectrum sensing as a basic and critical functionality in the deployment of CRs. We use these scenarios to show why existing DSA paradigms are not amenable to realistic deployment in complex wireless environments.

cs.NI↗

arXiv2009

A Simple Conceptual Generator for the Internet Graph

The evolution of the Internet during the last years, has lead to a dramatic increase of the size of its graph at the Autonomous System (AS) level. Soon - if not already - its size will make the latter impractical for use from the research community, e.g. for protocol testing. Reproducing a smaller size, snapshot of the AS graph is thus important. However, the first step towards this direction is to obtain the ability to faithfully reproduce the full AS topology. The objective of our work, is to create a generator able to accurately emulate and reproduce the distinctive properties of the Internet graph. Our approach is based on (a) the identification of the jellyfish-like structure [1] of the Internet and (b) the consideration of the peer-to-peer and customer-provider relations between ASs. We are the first to exploit the distinctive structure of the Internet graph together with utilizing the information provided by the AS relationships in order to create a tool with the aforementioned capabilities. Comparing our generator with the existing ones in the literature, the main difference is found on the fact that our tool does not try to satisfy specific metrics, but tries to remain faithful to the conceptual model of the Internet structure. In addition, our approach can lead to (i) the identification of important attributes and patterns in the Internet AS topology, as well as, (ii) the extraction of valuable information on the various relationships between ASs and their effect on the formulation of the Internet structure. We implement our graph generator and we evaluate it using the largest and most recent available dataset for the AS topology. Our evaluations, clearly show the ability of our tool to capture the structural properties of the Internet topology at the AS level with high accuracy.

cs.NI↗

arXiv2009

A measurement driven, 802.11 anti-jamming system

Dense, unmanaged 802.11 deployments tempt saboteurs into launching jamming attacks by injecting malicious interference. Nowadays, jammers can be portable devices that transmit intermittently at low power in order to conserve energy. In this paper, we first conduct extensive experiments on an indoor 802.11 network to assess the ability of two physical layer functions, rate adaptation and power control, in mitigating jamming. In the presence of a jammer we find that: (a) the use of popular rate adaptation algorithms can significantly degrade network performance and, (b) appropriate tuning of the carrier sensing threshold allows a transmitter to send packets even when being jammed and enables a receiver capture the desired signal. Based on our findings, we build ARES, an Anti-jamming REinforcement System, which tunes the parameters of rate adaptation and power control to improve the performance in the presence of jammers. ARES ensures that operations under benign conditions are unaffected. To demonstrate the effectiveness and generality of ARES, we evaluate it in three wireless testbeds: (a) an 802.11n WLAN with MIMO nodes, (b) an 802.11a/g mesh network with mobile jammers and (c) an 802.11a WLAN. We observe that ARES improves the network throughput across all testbeds by up to 150%.

cs.NI↗