Botnet is the biggest threaten now. Botmasters inject bot code into normal computers so that computers become bots under control by the botmasters. Every bot connect to the botnet coordinator called Command and control server (C&C), the C&C delivers commands to bots, supervises the states of bots and keep bots alive. When C&C delivers commands from the botmasters to bots, bots have to do whatever botmasters want, such as DDoS attack, sending spam and steal private information from victims. If we can detect where the C&C is, we can prevent people from network attacking. Ant Colony Optimization (ACO) studies artificial systems that take inspiration from the behavior of real ant colonies and which are used to solve discrete optimization problems. When ants walk on the path, it will leave the pheromone on the path; more pheromone will attract more ants to walk. Quick convergence and heuristic are two main characteristics of ant algorithm, are adopted in the proposed approach on finding the C&C node. According to the features of connection between C&C and bots, ants select nodes by these features in order to detect the location of C&C and take down the botnet.

The Denial-of-Service (DoS) attacks with the source IP address spoofing techniques has become a major threat to the Internet. An intrusion detection system is often used to detect DoS attacks and to coordinate with the firewall to block them. However, DoS attack packets consume and may exhaust all the resources, causing degrading network performance or, even worse, network breakdown. A proactive approach to DoS attacks is allocating the original attack host(s) issuing the attacks and stopping the malicious traffic, instead of wasting resources on the attack traffic. In this research, an ant-based traceback approach is proposed to identify the DoS attack origin. Instead of creating a new type or function needed by the router or proceeding the high volume, find-grained data, the proposed traceback approach uses flow level information to spot the origin of a DoS attack. Two characteristics of ant algorithm, quick convergence and heuristic, are adopted in the proposed approach on finding the DoS attack path. Quick convergence efficiently finds out the origin of a DoS attack; heuristic gives the solution even though partial flow information is provided by the network. The proposed method is validated and evaluated through the preliminary experiments and simulations generating various network environments by network simulator, NS-2. The simulation results show that the proposed method can successfully and efficiently find the DoS attack path in various simulated network environments, with full and partial flow information provided by the network.

Made available in DSpace on 2016-03-15T19:37:53Z (GMT). No. of bitstreams: 1 Lucca Zamboni.pdf: 861341 bytes, checksum: 140f5571ef3e3bfdab49cd1cb7cecfff (MD5) Previous issue date: 2007-03-19 / Ant colonies can be considered a multi-agent system, where each agent (ant) works independently by simple rules. Algorithms based on the behavior of ant colonies have been used to solve optimization problems, because in the search for food ants tend to create the shortest (optimum) path between the nest and the food source. In this work, ant inspired algorithms are used in the optimization of the topology of electric energy distribution networks. The algorithm performance is investigated in function of its parameter values. Experiments in hypothetical and actual distribution systems are performed. / Colônias de formigas podem ser consideradas um sistema multi-agente, em que cada agente (formiga) opera independentemente por regras simples. Algoritmos baseados no comportamento de colônias de formigas têm sido usados para resolver problemas de otimização, pois, na procura por alimento, as formigas tendem a estabelecer a rota mais curta (ótima) entre o formigueiro e a fonte de alimento. Neste trabalho, usam-se algoritmos inspirados em formigas na otimização da topologia de circuitos de distribuição de energia elétrica. O desempenho do algoritmo é investigado em função dos valores dos seus parâmetros. Realizam-se experimentos em sistemas de distribuição hipotéticos e realistas.

In multi colony ant algorithms several colonies of ants cooperate in finding good solutions for an optimization problem. At certain time steps the colonies exchange information about good solutions. If the amount of exchanged information is not too large multi colony ant algorithms can be easily parallelized in a natural way by placing the colonies on different processors. In this paper we study the behaviour of multi colony ant algorithms with different kinds of information exchange between the colonies. Moreover we compare the behaviour of different numbers of colonies with a multi start single colony ant algorithm. As test problems we use the Traveling Salesperson problem and the Quadratic Assignment problem.

An ant colony optimization (ACO) approach for the resource-constrained project scheduling problem (RCPSP) is presented. Several new features that are interesting for ACO in general are proposed and evaluated. In particular, the use of a combination of two pheromone evaluation methods by the ants to find new solutions, a change of the influence of the heuristic on the decisions of the ants during the run of the algorithm, and the option that an elitist ant forgets the best-found solution are studied. We tested the ACO algorithm on a set of large benchmark problems from the Project Scheduling Library. Compared to several other heuristics for the RCPSP, including genetic algorithms, simulated annealing, tabu search, and different sampling methods, our algorithm performed best on average. For nearly one-third of all benchmark problems, which were not known to be solved optimally before, the algorithm was able to find new best solutions.

Ant Colony Optimization (ACO) is a metaheuristic used to solve combinatorial optimization problems. As with other metaheuristics, like evolutionary methods, ACO algorithms often show good optimization behavior but are slow when compared to classical heuristics. Hence, there is a need to find fast implementations for ACO algorithms. In order to allow a fast parallel implementation, we propose several changes to a standard form of ACO algorithms. The main new features are the non-generational approach and the use of a threshold based decision function for the ants. We show that the new algorithm has a good optimization behavior and also allows a fast implementation on reconfigurable processor arrays. This is the first implementation of the ACO approach on a reconfigurable architecture. The running time of the algorithm is quasi-linear in the problem size n and the number of ants on a reconfigurable mesh with n2 processors, each provided with only a constant number of memory words.

A new approach for solving permutation scheduling problems with ant colony optimization (ACO) is proposed in this paper. The approach assumes that no precedence constraints between the jobs have to be fulfilled. It is tested with an ACO algorithm for the single-machine total weighted deviation problem. In the new approach the ants allocate the places in the schedule not sequentially, as in the standard approach, but in random order. This leads to a better utilization of the pheromone information. It is shown by experiments that adequate combinations between the standard approach which can profit from list scheduling heuristics and the new approach perform particularly well.

Les réseaux sans fil sont devenus une technologie importante dans le secteur des télécommunications. L'une des principales technologies des réseaux sans fil sont les réseaux mobiles ad hoc (MANET). MANET est un système d'auto-configuration (autonome) des routeurs mobiles où les routeurs sont libres de se déplacer de façon aléatoire et de s'organiser arbitrairement. La topologie des réseaux sans fil peut alors changer rapidement et de manière imprévisible avec une grande mobilité et sans aucune infrastructure fixe et sans administration centrale. Les protocoles de routage MANET sont Ad Hoc on Demand Distance Vector (AODV), Optimized Link State Routing (OLSR), Topology Dissemination Based on Reverse-Path Forwarding (TBRPF) et Dynamic Source Routing (DSR).En raison des caractéristiques des réseaux mobiles ad hoc, les principaux problèmes concernent la sécurité, les performances du réseau et de la qualité de service. En termes de performances, AODV offre de meilleures performances que les autres protocoles de routage MANET. Cette thèse porte donc sur le développement d'un protocole sécurisé et sur l'acheminement optimisé basé sur le protocole de routage AODV. Dans la première partie, nous combinons la fonction de gateway de AODV + et la méthode reverse de R-AODV pour obtenir le protocole optimisé en réseau hybride. Le protocole proposé appelé AODV-UI. Mécanisme de demande inverse dans R-AODV est utilisé pour optimiser le rendement du protocole de routage AODV et le module de passerelle de AODV + est ajouté à communiquer avec le noeud d'infrastructure. Nous effectuons la simulation en utilisant NS-2 pour évaluer la performance de AODV-UI. Paramètres d'évaluation de la performance sont le taux de livraison de paquets de bout en bout retard et les frais généraux de routage. Les résultats des simulations montrent que AODV-UI surperformé AODV + en terme de performance.La consommation d'énergie et les performances sont évaluées dans les scénarios de simulation avec un nombre différent de noeuds source, la vitesse maximale différente, et également des modèles de mobilité différents. Nous comparons ces scénarios sous Random Waypoint (RWP) et Reference Point Group Mobility (RPGM) modèles. Le résultat de la simulation montre que sous le modèle de mobilité RWP, AODV-UI consommer petite énergie lorsque la vitesse et le nombre de nœuds accéder à la passerelle sont augmentés. La comparaison des performances lors de l'utilisation des modèles de mobilité différents montre que AODV-UI a une meilleure performance lors de l'utilisation modèle de mobilité RWP. Globalement, le AODV-UI est plus appropriée pour l'utilisation de modèle de mobilité RWP.Dans la deuxième partie, nous proposons un nouveau protocole AODV sécurisé appelé Trust AODV en utilisant le mécanisme de la confiance. Les paquets de communication sont envoyés uniquement aux nœuds voisins de confiance. Calcul de confiance est basée sur les comportements et les activités d'information de chaque nœud. Il est divisé en Trust Global (TG) et Trust Local (TL). TG est un calcul de confiance basée sur le total de paquets de routage reçues et le total de l'envoi de paquets de routage. TL est une comparaison entre les paquets reçus au total et nombre total de paquets transmis par nœud voisin de nœuds spécifiques. Noeuds concluent le niveau de confiance totale de ses voisins en accumulant les valeurs TL et TG. Quand un noeud est soupçonné d'être un attaquant, le mécanisme de sécurité sera l'isoler du réseau avant que la communication est établie. [...] / Currently wireless networks have grown significantly in the field of telecommunication networks. Wireless networks have the main characteristic of providing access of information without considering the geographical and the topological attributes of a user. One of the most popular wireless network technologies is mobile ad hoc networks (MANET). A MANET is a decentralized, self-organizing and infrastructure-less network. Every node acts as a router for establishing the communication between nodes over wireless links. Since there is no administrative node to control the network, every node participating in the network is responsible for the reliable operation of the whole network. Nodes forward the communication packets between each other to find or establish the communication route. As in all networks, MANET is managed and become functional with the use of routing protocols. Some of MANET routing protocol are Ad Hoc on Demand Distance Vector (AODV), Optimized Link State Routing (OLSR), Topology Dissemination Based on Reverse-Path Forwarding (TBRPF), and Dynamic Source Routing (DSR).Due to the unique characteristics of mobile ad hoc networks, the major issues to design the routing protocol are a security aspect and network performance. In term of performance, AODV has better performance than other MANET routing protocols. In term of security, secure routing protocol is divided in two categories based on the security method, i.e. cryptographic mechanism and trust based mechanism. We choose trust mechanism to secure the protocol because it has a better performance rather than cryptography method.In the first part, we combine the gateway feature of AODV+ and reverse method from R-AODV to get the optimized protocol in hybrid network. The proposed protocol called AODV-UI. Reverse request mechanism in R-AODV is employed to optimize the performance of AODV routing protocol and gateway module from AODV+ is added to communicate with infrastructure node. We perform the simulation using NS-2 to evaluate the performance of AODV-UI. Performance evaluation parameters are packet delivery rate, end to end delay and routing overhead. Simulation results show that AODV-UI outperformed AODV+ in term of performance. The energy consumption and performance are evaluated in simulation scenarios with different number of source nodes, different maximum speed, and also different mobility models. We compare these scenarios under Random Waypoint (RWP) and Reference Point Group Mobility (RPGM) models. The simulation result shows that under RWP mobility model, AODV-UI consume small energy when the speed and number of nodes access the gateway are increased. The performance comparison when using different mobility models shows that AODV-UI has a better performance when using RWP mobility model. Overall the AODV-UI is more suitable when using RWP mobility model.In the second part, we propose a new secure AODV protocol called Trust AODV using trust mechanism. Communication packets are only sent to the trusted neighbor nodes. Trust calculation is based on the behaviors and activities information’s of each node. It is divided in to Trust Global and Trust Local. Trust global (TG) is a trust calculation based on the total of received routing packets and the total of sending routing packets. Trust local (TL) is a comparison between total received packets and total forwarded packets by neighbor node from specific nodes. Nodes conclude the total trust level of its neighbors by accumulating the TL and TG values. When a node is suspected as an attacker, the security mechanism will isolate it from the network before communication is established. [...]

Opposition-based learning (OBL) was recently proposed to extend di erent machine learning algorithms. The main idea of OBL is to consider opposite estimates, actions or states as an attempt to increase the coverage of the solution space and to reduce exploration time. OBL has already been applied to reinforcement learning, neural networks and genetic algorithms. This thesis explores the application of OBL to ant algorithms. Ant algorithms are based on the trail laying and following behaviour of ants. They have been successfully applied to many complex optimization problems. However, like any other technique, they can benefit from performance improvements. Thus, this work was motivated by the idea of developing more complex pheromone and path selection behaviour for the algorithm using the concept of opposition. This work proposes opposition-based extensions to the construction and update phases of the ant algorithm. The modifications that focus on the solution construction include three direct and two indirect methods. The three direct methods work by pairing the ants and synchronizing their path selection. The two other approaches modify the decisions of the ants by using opposite-pheromone content. The extension of the update phase lead to an approach that performs additional pheromone updates using opposite decisions. Experimental validation was done using two versions of the ant algorithm: the Ant System and the Ant Colony System. The di erent OBL extensions were applied to the Travelling Salesman Problem (TSP) and to the Grid World Problem (GWP). Results demonstrate that the concept of opposition is not easily applied to the ant algorithm. One pheromone-based method showed performance improvements that were statistically significant for the TSP. The quality of the solutions increased and more optimal solutions were found. The extension to the update phase showed some improvements for the TSP and led to accuracy improvements and a significant speed-up for the GWP. The other extensions showed no clear improvement. The proposed methods for applying opposition to the ant algorithm have potential, but more investigations are required before ant colony optimization can fully benefit from opposition. Most importantly, fundamental theoretical work with graphs, specifically, clearly defining opposite paths or opposite path components, is needed. Overall, the results indicate that OBL ideas can be beneficial for ant algorithms.

Opposition-based learning (OBL) was recently proposed to extend di erent machine learning algorithms. The main idea of OBL is to consider opposite estimates, actions or states as an attempt to increase the coverage of the solution space and to reduce exploration time. OBL has already been applied to reinforcement learning, neural networks and genetic algorithms. This thesis explores the application of OBL to ant algorithms. Ant algorithms are based on the trail laying and following behaviour of ants. They have been successfully applied to many complex optimization problems. However, like any other technique, they can benefit from performance improvements. Thus, this work was motivated by the idea of developing more complex pheromone and path selection behaviour for the algorithm using the concept of opposition. This work proposes opposition-based extensions to the construction and update phases of the ant algorithm. The modifications that focus on the solution construction include three direct and two indirect methods. The three direct methods work by pairing the ants and synchronizing their path selection. The two other approaches modify the decisions of the ants by using opposite-pheromone content. The extension of the update phase lead to an approach that performs additional pheromone updates using opposite decisions. Experimental validation was done using two versions of the ant algorithm: the Ant System and the Ant Colony System. The di erent OBL extensions were applied to the Travelling Salesman Problem (TSP) and to the Grid World Problem (GWP). Results demonstrate that the concept of opposition is not easily applied to the ant algorithm. One pheromone-based method showed performance improvements that were statistically significant for the TSP. The quality of the solutions increased and more optimal solutions were found. The extension to the update phase showed some improvements for the TSP and led to accuracy improvements and a significant speed-up for the GWP. The other extensions showed no clear improvement. The proposed methods for applying opposition to the ant algorithm have potential, but more investigations are required before ant colony optimization can fully benefit from opposition. Most importantly, fundamental theoretical work with graphs, specifically, clearly defining opposite paths or opposite path components, is needed. Overall, the results indicate that OBL ideas can be beneficial for ant algorithms.