@inproceedings{TwarokLangendoerferKoenig, author = {Twarok, Sven and Langend{\"o}rfer, Peter and K{\"o}nig, Hartmut}, title = {Automated Derivation of ILP Implementations from SDL Specifications}, series = {Formal techniques for networked and distributed systems, FORTE 2001, IFIP TC6/WG6.1 - 21st International Conference on Formal Techniques for Networked and Distributed Systems, August 28 - 31, 2001, Cheju Island, Korea}, booktitle = {Formal techniques for networked and distributed systems, FORTE 2001, IFIP TC6/WG6.1 - 21st International Conference on Formal Techniques for Networked and Distributed Systems, August 28 - 31, 2001, Cheju Island, Korea}, editor = {Kim, Myungchul}, publisher = {Kluwer}, address = {Boston [u.a.]}, isbn = {0-7923-7470-3}, pages = {3 -- 18}, language = {en} } @inproceedings{Koenig, author = {K{\"o}nig, Hartmut}, title = {Testing of Communicating Systems XIV (TestCom 2002): Application to Internet Technologies and Services}, language = {en} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Ein Ansatz f{\"u}r eine effiziente Schl{\"u}sselverteilung f{\"u}r kleine geschlossene Peer-Gruppen}, language = {de} } @inproceedings{RakelKoenigSchmitt, author = {Rakel, Daniel and K{\"o}nig, Hartmut and Schmitt, Jens B.}, title = {Effiziente Medienstromverteilung in geschlossenen Peer-to-Peer-Videokonferenzsystemen}, series = {Kommunikation in verteilten Systemen, Kurzbeitr{\"a}ge und Workshop der 14. GI/ITG-Fachtagung, 28. Februar - 3. M{\"a}rz 2005 in Kaiserslautern}, booktitle = {Kommunikation in verteilten Systemen, Kurzbeitr{\"a}ge und Workshop der 14. GI/ITG-Fachtagung, 28. Februar - 3. M{\"a}rz 2005 in Kaiserslautern}, editor = {M{\"u}ller, Paul}, publisher = {Ges. f{\"u}r Informatik}, address = {Bonn}, isbn = {3-88579-390-3}, pages = {159 -- 162}, language = {de} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Secure and Efficient Key Distribution for Collaborative Applications}, series = {2005 International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom), 19 - 22 December 2005, San Jose, CA}, booktitle = {2005 International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom), 19 - 22 December 2005, San Jose, CA}, publisher = {IEEE Operations Center}, address = {Piscataway, NJ}, isbn = {1-424-40030-9}, pages = {120 -- 130}, language = {en} } @inproceedings{Koenig, author = {K{\"o}nig, Hartmut}, title = {Peer-to-Peer Intrusion Detection Systeme f{\"u}r den Schutz sensibler IT-Infrastrukturen}, language = {de} } @inproceedings{Schmerl, author = {Schmerl, Sebastian}, title = {Ein Ansatz zur Virtualisierung der Analyse von Audit-Daten}, language = {de} } @inproceedings{LiuKoenig, author = {Liu, F. and K{\"o}nig, Hartmut}, title = {Designing Security Architecture for a P2P Video Conference System}, language = {en} } @inproceedings{SchmerlVogel, author = {Schmerl, Sebastian and Vogel, Michael}, title = {Efficient Analysis Distribution for Intrusion Detection}, series = {Proceedings of the NATO RTO Information Systems and Technology Panel (IST) Symposium on Information Assurance for Emerging and Future Military Systems, 2008, Ljubljana, Slovenia}, booktitle = {Proceedings of the NATO RTO Information Systems and Technology Panel (IST) Symposium on Information Assurance for Emerging and Future Military Systems, 2008, Ljubljana, Slovenia}, language = {en} } @inproceedings{SchmerlKoenigFlegeletal., author = {Schmerl, Sebastian and K{\"o}nig, Hartmut and Flegel, Ulrich and Meier, Michael and Rietz, Ren{\´e}}, title = {Systematic Signature Engineering by Re-use of Snort Signatures}, series = {Proceedings of the 24th International Annual Computer Security Applications Conference (ACSAC 2008), Anaheim, California, USA, December 2008}, booktitle = {Proceedings of the 24th International Annual Computer Security Applications Conference (ACSAC 2008), Anaheim, California, USA, December 2008}, pages = {23 -- 32}, language = {en} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Security Considerations on Pervasive Real-time Collaboration}, series = {IEEE 6th International Conference on Mobile Adhoc and Sensor Systems, 2009, MASS '09, 12 - 15 Oct. 2009, Macau, China}, booktitle = {IEEE 6th International Conference on Mobile Adhoc and Sensor Systems, 2009, MASS '09, 12 - 15 Oct. 2009, Macau, China}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-424-45114-2}, pages = {722 -- 727}, language = {en} } @inproceedings{KaliappanKoenigSchmerletal., author = {Kaliappan, Prabhu Shankar and K{\"o}nig, Hartmut and Schmerl, Sebastian and Dong, Jin Song and Zhu, Huibiao}, title = {Model-Driven Protocol Design Based on Component Oriented Modeling}, series = {Formal methods and software engineering, proceedings 12th International Conference on Formal Engineering Methods, ICFEM 2010, Shanghai, China, November 17 - 19, 2010}, booktitle = {Formal methods and software engineering, proceedings 12th International Conference on Formal Engineering Methods, ICFEM 2010, Shanghai, China, November 17 - 19, 2010}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {978-3-642-16900-7}, pages = {613 -- 629}, language = {en} } @misc{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {A Survey of Video Encryption Algorithms}, language = {en} } @inproceedings{ZuehlkeKoenig, author = {Z{\"u}hlke, Mario and K{\"o}nig, Hartmut}, title = {Voting Based Bandwidth Management in Multiparty Video Conferences}, series = {Protocols and systems for interactive distributed multimedia, proceedings, Joint International Workshops on Interactive Distributed Multimedia Systems and Protocols for Multimedia Systems, IDMS PROMS 2002, Coimbra, Portugal, November 26 - 29, 2002}, booktitle = {Protocols and systems for interactive distributed multimedia, proceedings, Joint International Workshops on Interactive Distributed Multimedia Systems and Protocols for Multimedia Systems, IDMS PROMS 2002, Coimbra, Portugal, November 26 - 29, 2002}, editor = {Boavida, Fernando}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-00169-7}, language = {en} } @inproceedings{HolzMeierKoenig, author = {Holz, Thomas and Meier, Michael and K{\"o}nig, Hartmut}, title = {High-efficient intrusion detection infrastructure}, series = {Real time intrusion detection, papers presented at the RTO Information Systems Technology Panel (IST) Symposium, held in Estoril, Portugal, 27 - 28 May 2002}, booktitle = {Real time intrusion detection, papers presented at the RTO Information Systems Technology Panel (IST) Symposium, held in Estoril, Portugal, 27 - 28 May 2002}, publisher = {NATO Research and Technology Organisation}, address = {Neuilly-sur-Seine}, isbn = {92-837-0032-5}, pages = {14/1 -- 14/12}, language = {en} } @inproceedings{HolzMeierKoenig, author = {Holz, Thomas and Meier, Michael and K{\"o}nig, Hartmut}, title = {An Efficient Intrusion Detection System Design}, series = {Proceedings of the ISSA 2002 Information for Security for South-Africa 2nd Annual Conference, 10-12 July 2002, Misty Hills Country Hotel, Muldersdrift, Gauteng, South Africa}, booktitle = {Proceedings of the ISSA 2002 Information for Security for South-Africa 2nd Annual Conference, 10-12 July 2002, Misty Hills Country Hotel, Muldersdrift, Gauteng, South Africa}, pages = {12}, language = {en} } @article{HolzMeierKoenig, author = {Holz, Thomas and Meier, Michael and K{\"o}nig, Hartmut}, title = {Bausteine f{\"u}r effiziente Intrusion-Detection-Syteme}, language = {de} } @inproceedings{MeierBischofHolz, author = {Meier, Michael and Bischof, Niels and Holz, Thomas}, title = {SHEDEL - A Simple Hierarchical Event Description Language for Specifying Attack Signatures}, series = {Security in the information society, IFIP TC11 17th, International Conference on Information Security (SEC2002) May, 7 - 9, 2002, Cairo, Egypt}, booktitle = {Security in the information society, IFIP TC11 17th, International Conference on Information Security (SEC2002) May, 7 - 9, 2002, Cairo, Egypt}, publisher = {Kluwer}, address = {Boston [u.a.]}, isbn = {1-402-07030-6}, pages = {559 -- 571}, language = {en} } @inproceedings{OpitzMielkeKoenig, author = {Opitz, Alek and Mielke, Torsten and K{\"o}nig, Hartmut}, title = {Virtual Private Components}, language = {en} } @phdthesis{Zuehlke, author = {Z{\"u}hlke, Mario}, title = {Verteilt organisierte Mehrteilnehmer - Videokonferenzen f{\"u}r geschlossene Gruppen im Internet}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-000000540}, language = {de} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {A Novel Encryption Algorithm for High Resolution Video}, language = {en} } @inproceedings{OpitzKoenig, author = {Opitz, Alek and K{\"o}nig, Hartmut}, title = {Optimizing the Access to Read-Only Data in Grid Computing}, series = {Distributed applications and interoperable systems, 5th IFIP WG 6.1 International Conference, DAIS 2005, Athens, Greece, June 15-17, 2005, proceedings}, booktitle = {Distributed applications and interoperable systems, 5th IFIP WG 6.1 International Conference, DAIS 2005, Athens, Greece, June 15-17, 2005, proceedings}, editor = {Kutvonen, Lea}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-26262-8}, pages = {206 -- 219}, language = {en} } @incollection{HolzMeierKoenig, author = {Holz, Thomas and Meier, Michael and K{\"o}nig, Hartmut}, title = {High-Efficient Intrusion Detection Infrastructure}, language = {en} } @inproceedings{PopoviciZuehlkeMahlo, author = {Popovici, Eduard and Z{\"u}hlke, Mario and Mahlo, Ralf}, title = {BRAVIS - Ein Ansatz f{\"u}r geschlossene Mehrteilnehmer-Videokonferenzen im Internet}, language = {de} } @incollection{PopoviciZuehlkeMahlo, author = {Popovici, Eduard and Z{\"u}hlke, Mario and Mahlo, Ralf}, title = {Verteilte Mehrteilnehmer-Videokonferenzen im Internet}, language = {de} } @book{OPUS4-2327, title = {Detection of intrusions and malware \& vulnerability assessment : GI Special Interest SIDAR Workshop, DIMVA 2004, Dortmund, Germany, July 6 - 7, 2004 ; proceedings}, editor = {Flegel, Ulrich and Meier, Michael}, publisher = {Bonn : Ges. f{\"u}r Informatik}, isbn = {3-88579-375-X}, language = {de} } @inproceedings{Meier, author = {Meier, Michael}, title = {A model for the semantics of attack signatures in misuse detection systems}, isbn = {3-540-23208-7}, language = {en} } @book{Koenig, author = {K{\"o}nig, Hartmut}, title = {Protocol Engineering : Prinzip, Beschreibung und Entwicklung von Kommunikationsprotokollen}, publisher = {Stuttgart [u.a.] : Teubner}, isbn = {3-519-00454-2}, language = {de} } @misc{MeierFlegelKoenig, author = {Meier, Michael and Flegel, Ulrich and K{\"o}nig, Hartmut}, title = {Reactive Security - Intrusion Detection, Honeypots, and Vulnerability Assessment}, series = {Praxis der Informationsverarbeitung und Kommunikation}, volume = {27}, journal = {Praxis der Informationsverarbeitung und Kommunikation}, number = {4}, pages = {186 -- 187}, language = {de} } @inproceedings{SchmerlMeierKoenigetal., author = {Schmerl, Sebastian and Meier, Michael and K{\"o}nig, Hartmut and Flegel, Ulrich}, title = {Simplifying Signature Engineering by Reuse}, series = {Emerging trends in information and communication security, ETRICS 2006, Freiburg, Germany, June 6 - 9, 2006 Conference, Freiburg, Germany, June 2006}, booktitle = {Emerging trends in information and communication security, ETRICS 2006, Freiburg, Germany, June 6 - 9, 2006 Conference, Freiburg, Germany, June 2006}, editor = {M{\"u}ller, G{\"u}nter}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-34640-6}, pages = {436 -- 450}, language = {en} } @inproceedings{Schmerl, author = {Schmerl, Sebastian}, title = {Validierung von Signaturen - Testmethoden zur Feststellung von Korrektheit und Pr{\"a}zision}, editor = {Flegel, Ulrich}, language = {de} } @inproceedings{SchmerlKoenig, author = {Schmerl, Sebastian and K{\"o}nig, Hartmut}, title = {Towards Systematic Signature Testing}, series = {19th IFIP TC6/WG6.1 International Conference, TestCom 2007, 7th International Workshop, FATES 2007, Tallin, Estonia, June 26-29, 2007, Proceedings}, booktitle = {19th IFIP TC6/WG6.1 International Conference, TestCom 2007, 7th International Workshop, FATES 2007, Tallin, Estonia, June 26-29, 2007, Proceedings}, editor = {Petrenko, Alexandre}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-73065-6}, pages = {276 -- 291}, language = {en} } @phdthesis{Opitz, author = {Opitz, Alek}, title = {Prognose freier Rechenkapazit{\"a}ten zur besseren Nutzung von Grid-Ressourcen}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus-9527}, language = {de} } @inproceedings{OpitzKoenig, author = {Opitz, Alek and K{\"o}nig, Hartmut}, title = {Predicting Free Computing Capacities on Individual Machines}, language = {en} } @inproceedings{OPUS4-4430, title = {Perspectives Workshop: Network Attack Detection and Defense}, series = {Dagstuhl Seminar 08102, 02.03. - 06.03.2008}, booktitle = {Dagstuhl Seminar 08102, 02.03. - 06.03.2008}, editor = {Carle, Georg and Dressler, Falko and Kemmerer, Richard A. and K{\"o}nig, Hartmut and Kruegel, Christopher and Laskov, Pavel}, issn = {1862-4405}, language = {en} } @misc{VogelSchmerlKoenig, author = {Vogel, Michael and Schmerl, Sebastian and K{\"o}nig, Hartmut}, title = {Analyseverlagerung in P2P-Overlaynetzen}, language = {de} } @inproceedings{KaliappanKoenigKaliappan, author = {Kaliappan, Prabhu Shankar and K{\"o}nig, Hartmut and Kaliappan, V. K.}, title = {Designing and Verifying Communication Protocols using Model Driven Architecture and Spin Model Checker}, language = {en} } @misc{CarleDresslerKemmereretal., author = {Carle, Georg and Dressler, Falko and Kemmerer, Richard A. and K{\"o}nig, Hartmut and Kruegel, Christopher and Laskov, Pavel}, title = {Network attack detection and defense - Manifesto of the Dagstuhl Perspective Workshop}, language = {en} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {A Simple Balanced Password-Authenticated Key Agreement Protocol}, series = {Proceedings, the 10th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2011, ICESS 2011, FCST 2011, Conferences, Symposiums and Workshops, 16-18 November 2011, Changsha, Hunan Province, China}, booktitle = {Proceedings, the 10th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, TrustCom 2011, ICESS 2011, FCST 2011, Conferences, Symposiums and Workshops, 16-18 November 2011, Changsha, Hunan Province, China}, publisher = {IEEE Computer Society}, address = {Los Alamitos, Calif.}, isbn = {978-0-7695-4600-1}, pages = {403 -- 408}, language = {en} } @misc{KirscheDreissigKopschetal., author = {Kirsche, Michael and Dreissig, Matthias and Kopsch, Ralf and G{\"a}bler, Jan and Klauck, Ronny and Pink, Mario and Liu, Fuwen and K{\"o}nig, Hartmut}, title = {uBeeMe - Eine Plattform zur Unterst{\"u}tzung mobiler kollaborativer Anwendungen}, series = {Praxis der Informationsverarbeitung und Kommunikation : (PIK)}, volume = {34}, journal = {Praxis der Informationsverarbeitung und Kommunikation : (PIK)}, number = {1}, issn = {0930-5157}, doi = {10.1515/PIKO.2011.003}, pages = {11 -- 22}, language = {de} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Cryptanalysis of a SIP Authentication Scheme}, series = {Communications and multimedia security, 12th IFIP TC 6/TC 11 international conference, CMS 2011, Ghent, Belgium, October 19-21, 2011}, booktitle = {Communications and multimedia security, 12th IFIP TC 6/TC 11 international conference, CMS 2011, Ghent, Belgium, October 19-21, 2011}, editor = {Decker, Bart De and Lapon, Jorn and Naessens, Vincent and Uhl, Andreas}, publisher = {Springer}, address = {Heidelberg [u.a.]}, isbn = {978-3-642-24711-8}, pages = {134 -- 143}, language = {en} } @misc{GaeblerKlauckSchoepkeetal., author = {G{\"a}bler, Jan and Klauck, Ronny and Sch{\"o}pke, Sebastian and K{\"o}nig, Hartmut and Werner, Martin and Roth, J{\"o}rg}, title = {Lemon Tree - Flexible Deich{\"u}berwachung mit XMPP und Cloud-Diensten}, series = {8. GI/ITG KuVS-Fachgespr{\"a}ch Ortsbezogene Anwendungen und Dienst}, journal = {8. GI/ITG KuVS-Fachgespr{\"a}ch Ortsbezogene Anwendungen und Dienst}, publisher = {Logos-Verlag}, address = {Berlin}, isbn = {978-3-8325-3041-9}, pages = {137 -- 148}, language = {de} } @misc{Koenig, author = {K{\"o}nig, Hartmut}, title = {Network Attack Detection and Defense}, series = {Praxis der Informationsverarbeitung und Kommunikation : (PIK)}, volume = {35}, journal = {Praxis der Informationsverarbeitung und Kommunikation : (PIK)}, number = {1}, issn = {0930-5157}, doi = {10.1515/pik-2012-0001}, pages = {S. 1}, language = {en} } @inproceedings{PinkPietschKoenig, author = {Pink, Mario and Pietsch, Thomas and K{\"o}nig, Hartmut}, title = {Towards a seamless mobility solution for the real world: Handover decision}, series = {Hand-over decision, International Symposium on Wireless Communication Systems 2012, August 2012, Paris, France}, booktitle = {Hand-over decision, International Symposium on Wireless Communication Systems 2012, August 2012, Paris, France}, publisher = {IEEE}, isbn = {978-1-4673-0761-1}, doi = {10.1109/ISWCS.2012.6328448}, pages = {651 -- 655}, abstract = {The increasing use of wireless networks has raised the desire to have not only a stable and good quality access to the network, but also to seamlessly change the network when moving. Various handover algorithms have been proposed to handle this situation. Unfortunately, many of these handover algorithms have only been evaluated by simulations. They do not take the wide range of mobile devices with varying system parameters into account. For the practical deployment, handover algorithms are required that adapt to various device parameters and network characteristics. In this paper we present a fuzzy-based vertical handover decision algorithm which adjusts itself to the given device and network capabilities. Starting with a discussion of handover requirements we present the algorithm and describe how it is activated in the handover process. Finally we present several experiments which evaluate the accuracy of the handover decision, the quality of service guarantees for the application, and the resource consumption.}, language = {en} } @inproceedings{PinkPietschKoenig, author = {Pink, Mario and Pietsch, Thomas and K{\"o}nig, Hartmut}, title = {An adaptive Handover decision algorithm for heterogeneous wireless networks}, series = {Mobile Wireless Middleware, Operating Systems, and Applications, 5th International Conference, Mobilware 2012, Berlin, Germany, November 13-14, 2012}, booktitle = {Mobile Wireless Middleware, Operating Systems, and Applications, 5th International Conference, Mobilware 2012, Berlin, Germany, November 13-14, 2012}, publisher = {Springer}, address = {Berlin}, isbn = {978-3-642-36659-8}, pages = {136 -- 149}, language = {en} } @inproceedings{Schuster, author = {Schuster, Franka}, title = {Intrusion Detection for Automation Technology}, series = {Proceedings of the Seventh GI SIG SIDAR Graduate Workshop on Reactive Security (SPRING)}, booktitle = {Proceedings of the Seventh GI SIG SIDAR Graduate Workshop on Reactive Security (SPRING)}, editor = {Mulliner, Collin and Stewin, Patrick}, publisher = {GI FG SIDAR}, address = {Berlin}, pages = {S. 14}, language = {en} } @misc{VogelRietzSchmerl, author = {Vogel, Michael and Rietz, Ren{\´e} and Schmerl, Sebastian}, title = {Automated Generation of Precise Signatures}, series = {Praxis der Informationsverarbeitung und Kommunikation : (PIK)}, volume = {35}, journal = {Praxis der Informationsverarbeitung und Kommunikation : (PIK)}, number = {1}, issn = {0930-5157}, doi = {10.1515/pik-2012-0007}, pages = {40 -- 45}, language = {en} } @inproceedings{KaliappanKoenig, author = {Kaliappan, Prabhu Shankar and K{\"o}nig, Hartmut}, title = {On the Formalization of UML Activities for Component-Based Protocol Design Specifications}, series = {Theory and practice of computer science, SOFSEM 2012, 38th Conference on Current Trends in Theory and Practice of Computer Science, Špindlerův Ml{\´y}n, Czech Republic, January 21 - 27, 2012}, booktitle = {Theory and practice of computer science, SOFSEM 2012, 38th Conference on Current Trends in Theory and Practice of Computer Science, Špindlerův Ml{\´y}n, Czech Republic, January 21 - 27, 2012}, editor = {Katzenbeisser, Stefan}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {978-3-642-27659-0}, pages = {479 -- 491}, abstract = {This book constitutes the refereed proceedings of the 38th Conference on Current Trends in Theory and Practice of Computer Science, SOFSEM 2012, held in Špindlerův Ml{\´y}n, Czech Republic, in January 2012. The 43 revised papers presented in this volume were carefully reviewed and selected from 121 submissions. The book also contains 11 invited talks, 10 of which are in full-paper length. The contributions are organized in topical sections named: foundations of computer science; software and Web engineering; cryptography, security, and verification; and artificial intelligence.}, language = {en} } @inproceedings{KlauckKirsche, author = {Klauck, Ronny and Kirsche, Michael}, title = {XMPP to the Rescue: Enhancing Post Disaster Management and Joint Task Force Work}, series = {2012 IEEE International Conference on Pervasive Computing and Communications (PerCom 2012), Lugano, Switzerland, 19 - 23 March 2012}, booktitle = {2012 IEEE International Conference on Pervasive Computing and Communications (PerCom 2012), Lugano, Switzerland, 19 - 23 March 2012}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-467-30256-2}, pages = {752 -- 757}, language = {en} } @inproceedings{KlauckKirsche, author = {Klauck, Ronny and Kirsche, Michael}, title = {Bonjour Contiki: A Case Study of a DNS-Based Discovery Service for the Internet of Things}, series = {Ad-hoc, mobile, and wireless networks, 11th international conference, ADHOC-NOW 2012, Belgrade, Serbia, July 9 - 11, 2012, proceedings}, booktitle = {Ad-hoc, mobile, and wireless networks, 11th international conference, ADHOC-NOW 2012, Belgrade, Serbia, July 9 - 11, 2012, proceedings}, editor = {Li, Xiang-Yang and Papavassiliou, Symeon and Ruehrup, Stefan}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {978-3-642-31637-1}, pages = {317 -- 330}, language = {en} } @inproceedings{KlauckKirsche, author = {Klauck, Ronny and Kirsche, Michael}, title = {Chatty Things - Making the Internet of Things Readily Usable for the Masses with XMPP}, series = {Proceedings of the 8th International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom 2012), Pittsburgh, Pennsylvania, USA, October, 2012}, booktitle = {Proceedings of the 8th International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom 2012), Pittsburgh, Pennsylvania, USA, October, 2012}, publisher = {IEEE}, isbn = {978-1-4673-2740-4}, pages = {60 -- 69}, language = {en} } @book{KoallKlauck, author = {Koall, Sebastian and Klauck, Ronny}, title = {Dualisierung graphischer Benutzeroberfl{\"a}chen: Portierung einer GUI vom Desktop auf Smartphone}, publisher = {Akademieverlag}, address = {Berlin}, isbn = {978-3-639-39126-8}, pages = {100}, language = {de} } @misc{KoenigGaeblerKlaucketal., author = {K{\"o}nig, Hartmut and G{\"a}bler, Jan and Klauck, Ronny and Pink, Mario and Sprejz, Michael}, title = {uBeeMe - A Platform for Mobile Collaborative Applications}, series = {PIK - Praxis der Informationsverarbeitung und Kommunikation}, volume = {36}, journal = {PIK - Praxis der Informationsverarbeitung und Kommunikation}, number = {1}, issn = {0930-5157}, doi = {10.1515/pik-2012-0058}, pages = {S. 43}, language = {en} } @misc{GaeblerKoenig, author = {G{\"a}bler, Jan and K{\"o}nig, Hartmut}, title = {Moversight: a group communication protocol for mobile scenarios}, series = {Telecommunication systems : modeling, analysis, design and managementversion}, volume = {61}, journal = {Telecommunication systems : modeling, analysis, design and managementversion}, number = {4}, issn = {1572-9451}, doi = {10.1007/s11235-015-0062-1}, pages = {695 -- 716}, abstract = {The increasing mobility of Internet users and the growing need to collaborate with staff travelling on business belong to the key characteristics of the future Internet. Mobile collaborative applications require novel schemes for group communication that actively support collaborations in wireless scenarios. An intrinsic problem of collaborations in wireless scenarios is the temporary connection loss with the group due to user mobility and network issues. Existing group communication protocols do not sufficiently support this situation. In this paper, we present a new peer-to-peer group communication protocol, called Moversight, that was specifically designed to support closed group cooperation in mobile environments with varying churn rates. It applies a new group communication paradigm, called mobile optimistic virtual synchrony, to handle churn-related peer failures. It enhances the virtual synchrony paradigm for mobile scenarios. The paper introduces the paradigm and describes the main protocol features of Moversight. Finally we present simulation results to demonstrate the applicability of the protocol.}, language = {en} } @misc{KlauckKirsche, author = {Klauck, Ronny and Kirsche, Michael}, title = {Combining Mobile XMPP Entities and Cloud Services for Collaborative Post-Disaster Management in Hybrid Network Environments}, series = {Mobile Networks and Applications : the journal of special issues on mobility of systems, users, data and computing}, volume = {18}, journal = {Mobile Networks and Applications : the journal of special issues on mobility of systems, users, data and computing}, number = {2}, issn = {1383-469X}, doi = {10.1007/s11036-012-0391-1}, pages = {253 -- 270}, abstract = {Crises such as the Fukushima incident in Japan showed the demand for flexible and easy-to-use monitoring and communication systems to support post-disaster management (i.e. the organization of actions in the follow-up of disasters), especially when critical infrastructure is affected. Such systems can effectively only be realized with a merging of various device classes and the integration of mobile actors and wireless communication technologies to provide the necessary flexibility. This article introduces a system design that combines portable hand-held devices as well as autonomous sensors through XMPP with the flexibility of cloud services to support post-disaster management. This combination provides the communication between the different involved parties (e.g., rescue teams, relief forces, NGOs) and enables a global view on sensed data through the use of cloud-based storage and analysis services. Along with a discussion about requirements and a description of appropriate solutions and initial evaluations, we present new insights on the practical appliance of XMPP and potential enhancements for XMPP-based real life collaboration applications in hybrid (ad hoc and infrastructure) networkscenarios.We also show that resource constrained devices can run the XMPP protocol to extend smartphones with sensors or to connect different device classes in a seamless way.}, language = {en} } @inproceedings{KirscheSchnurbusch, author = {Kirsche, Michael and Schnurbusch, Matti}, title = {A new IEEE 802.15.4 Simulation Model for OMNeT++ / INET}, series = {Proceedings of the 1st International OMNeT++ Community Summit (OMNeT 2014)}, booktitle = {Proceedings of the 1st International OMNeT++ Community Summit (OMNeT 2014)}, abstract = {This paper introduces a new IEEE 802.15.4 simulation model for OMNeT++ / INET. 802.15.4 is an important underlying standard for wireless sensor networks and Internet of Things scenarios. The presented implementation is designed to be compatible with OMNeT++ 4.x and INET 2.x and laid-out to be expandable for newer revisions of the 802.15.4 standard.}, language = {en} } @misc{KarglHeijdenKoenigetal., author = {Kargl, Frank and Heijden, Rens W. van der and K{\"o}nig, Hartmut and Valdes, Alfonso and Dacier, Marc C.}, title = {Insights on the Security and Dependability of Industrial Control Systems}, series = {IEEE Security \& Privacy}, volume = {12}, journal = {IEEE Security \& Privacy}, number = {6}, issn = {1540-7993}, doi = {10.1109/MSP.2014.120}, pages = {75 -- 78}, language = {en} } @misc{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Puzzle - an efficient, compression independent video encryption algorithm}, series = {Multimedia tools and applications}, volume = {73}, journal = {Multimedia tools and applications}, number = {2}, issn = {1573-7721}, doi = {10.1007/s11042-012-1185-y}, pages = {715 -- 735}, language = {en} } @inproceedings{BoehmKirsche, author = {B{\"o}hm, Sebastian and Kirsche, Michael}, title = {Looking into Hardware-in-the-Loop Coupling of OMNeT++ and RoSeNet}, series = {Proceedings of the 2nd International OMNeT++ Community Summit (OMNeT 2015), Zurich, Switzerland, September, 2015, CoRR}, booktitle = {Proceedings of the 2nd International OMNeT++ Community Summit (OMNeT 2015), Zurich, Switzerland, September, 2015, CoRR}, pages = {5}, language = {en} } @misc{StritterFreilingKoenigetal., author = {Stritter, Benjamin and Freiling, Felix and K{\"o}nig, Hartmut and Rietz, Ren{\´e} and Ullrich, Steffen and Gernler, Alexander von and Erlacher, Felix}, title = {Cleaning up Web 2.0's Security Mess - at Least Partly}, series = {IEEE Security \& Privacy}, volume = {14}, journal = {IEEE Security \& Privacy}, number = {2}, issn = {1540-7993}, pages = {48 -- 71}, language = {en} } @inproceedings{PaulSchusterKoenig, author = {Paul, Andreas and Schuster, Franka and K{\"o}nig, Hartmut}, title = {Network Topology Exploration for Industrial Networks}, series = {2nd EAI International Conference on Industrial Networks and Intelligent Systems (INISCOM 2016), October 31 - November 1, 2016, Leicester, Great Britain}, booktitle = {2nd EAI International Conference on Industrial Networks and Intelligent Systems (INISCOM 2016), October 31 - November 1, 2016, Leicester, Great Britain}, publisher = {Springer International Publishing}, address = {Cham}, isbn = {978-3-319-52568-6}, doi = {10.1007/978-3-319-52569-3}, pages = {63 -- 76}, language = {en} } @inproceedings{CwalinskiKoenig, author = {Cwalinski, Radoslaw and K{\"o}nig, Hartmut}, title = {RADIator - An approach for controllable wireless networks}, series = {IEEE NetSoft Conference and workshops, 6-10 June 2016, Seoul, South Corea}, booktitle = {IEEE NetSoft Conference and workshops, 6-10 June 2016, Seoul, South Corea}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-4673-9486-4}, doi = {10.1109/NETSOFT.2016.7502421}, pages = {260 -- 268}, abstract = {In this paper we propose a novel software-defined networking architecture for enterprise wireless local area networks (WLANs). The goal is to build a framework that exposes tools and methods for a centralized processing of IEEE 802.11 frames. In our architecture all management tasks, including beaconing, client authentication and association, are performed by the central controller instead of the distributed wireless access points as in traditional networks. The generated frames are tunneled to lightweight wireless access points (APs) or thin APs that perform the media access and radio frequency (RF) conversion. Agents executed on thin APs allow scheduling of simple tasks like traffic filtering for local execution. Additionally, the agents provide functions found in modern WLAN chipsets, such as precise frame transmit timings or RF spectrum analysis to the controller. Our architecture allows to delegate computationally intensive tasks to a central instance with enough processing power. Thus, it is best suited for devices with limited resources that we use as thin APs. We present applications that can be built using our framework, e.g., client geolocalization or energy consumption optimization. Finally we evaluate the performance of our architecture in a testbed using COTS devices with open-source software.}, language = {en} } @inproceedings{RietzKoenigUllrichetal., author = {Rietz, Ren{\´e} and K{\"o}nig, Hartmut and Ullrich, Steffen and Stritter, Benjamin}, title = {Firewalls for the Web 2.0}, series = {Proceedings of the 2016 IEEE International Conference on Software Quality, Reliability and Security (QRS), 1-3 Aug. 2016}, booktitle = {Proceedings of the 2016 IEEE International Conference on Software Quality, Reliability and Security (QRS), 1-3 Aug. 2016}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-5090-4127-5}, doi = {10.1109/QRS.2016.36}, pages = {242 -- 253}, abstract = {The widespread use of Web 2.0 technologies yields an increasing threat potential for users and related systems. Modern web applications and online services are nowadays based on Web 2.0 technologies, such as JavaScript and AJAX, and thus on the execution of active content in the browsers of the users. Firewalls are a common practice to securely connecting to the internet. In this paper, we propose a novel perimeter firewall architecture for web applications that addresses the entire process chain starting from the data transfer with HTTP via the analysis of manipulated web documents to the extraction and analysis of active contents. The basic idea is to allow only a restricted set of web applications to pass the firewall based on a model of their HTML and JavaScript structure. We evaluate the capability of the resulting models for identifying the underlying web applications and their ability to ward off additional malicious inputs.}, language = {en} } @inproceedings{DacierDietrichKargletal., author = {Dacier, Marc C. and Dietrich, Sven and Kargl, Frank and K{\"o}nig, Hartmut}, title = {Network Attack Detection and Defense - Security Challenges and Opportunities of Software-Defined Networking}, series = {Network Attack Detection and Defense, Dagstuhl Seminar 16361}, booktitle = {Network Attack Detection and Defense, Dagstuhl Seminar 16361}, publisher = {Schloss Dagstuhl}, address = {Wadern}, doi = {10.4230/DagRep.6.9.1}, url = {http://nbn-resolving.de/urn:nbn:de:0030-drops-69122}, pages = {1 -- 28}, abstract = {This report documents the program and the outcomes of Dagstuhl Seminar 16361 "Network Attack Detection and Defense: Security Challenges and Opportunities of Software-Defined Networking". Software-defined networking (SDN) has attracted a great attention both in industry and academia since the beginning of the decade. This attention keeps undiminished. Security-related aspects of software-defined networking have only been considered more recently. Opinions differ widely. The main objective of the seminar was to discuss the various contrary facets of SDN security. The seminar continued the series of Dagstuhl events Network Attack Detection and Defense held in 2008, 2012, and 2014. The objectives of the seminar were threefold, namely (1) to discuss the security challenges of SDN, (2) to debate strategies to monitor and protect SDN-enabled networks, and (3) to propose methods and strategies to leverage on the flexibility brought by SDN for designing new security mechanisms. At the seminar, which brought together participants from academia and industry, we discussed the advantages and disadvantages of using software-defined networks from the security point of view. We agreed that SDN provides new possibilities to better secure networks, but also offers a number of serious security problems which require further research. The outcome of these discussions and the proposed research directions are presented in this report.}, language = {en} } @inproceedings{GaeblerKoenig, author = {G{\"a}bler, Jan and K{\"o}nig, Hartmut}, title = {Distributed Cluster-Topology Maintenance for Mobile Collaborative Applications}, series = {IEEE 41st Conference on Local Computer Networks (LCN), 7-10 Nov. 2016}, booktitle = {IEEE 41st Conference on Local Computer Networks (LCN), 7-10 Nov. 2016}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-5090-2054-6}, doi = {10.1109/LCN.2016.55}, pages = {271 -- 279}, abstract = {Nowadays, collaborative applications play an increasing role in mobile communications in order to enable cooperation among mobile and/or stationary participants - often using the peer-to-peer (P2P) group communication paradigm. The probability of communication failures increases in mobile environments. As a consequence, frequent leaving and joining of partners can be observed resulting in unstable group topologies. A widely used approach is to divide the group into peer clusters that are fully meshed among each other. In this paper, we propose an application-independent approach for a periodic maintenance of distributed cluster-based group topologies for mobile collaborative applications. The proposed approach also dynamically adapts the overlay structure to changing network conditions. The maintenance strategy can be parametrized by several metrics. It outperforms simple overlay maintenance strategies, such as round-robin, by respecting the resource and computation limitations of mobile devices. The run-time is increased by 10\% in the best case compared to LEACH, and by 3 — 5\% on average. We describe the approach and evaluate its performance w.r.t. different metrics.}, language = {en} } @misc{RietzCwalinskiKoenigetal., author = {Rietz, Ren{\´e} and Cwalinski, Radoslaw and K{\"o}nig, Hartmut and Brinner, Andreas}, title = {An SDN-based Approach to Ward of LAN Attacks}, series = {Journal Computer Networks and Communications}, volume = {2018}, journal = {Journal Computer Networks and Communications}, doi = {10.1155/2018/4127487}, pages = {12}, language = {en} } @misc{SanderRuethHohlfeldetal., author = {Sander, Constantin and R{\"u}th, Jan and Hohlfeld, Oliver and Wehrle, Klaus}, title = {DeePCCI: Deep Learning-based Passive Congestion Control Identification}, series = {In Proceedings of the ACM SIGCOMM Workshop on Network Meets AI \& ML (NetAI '19), August 19-24, 2019, Beijing, China}, journal = {In Proceedings of the ACM SIGCOMM Workshop on Network Meets AI \& ML (NetAI '19), August 19-24, 2019, Beijing, China}, publisher = {ACM}, address = {New York}, isbn = {978-1-4503-6872-8}, doi = {10.1145/3341216.3342211}, pages = {37 -- 43}, language = {en} } @misc{FestHeilmannHohlfeldetal., author = {Fest, Jennifer and Heilmann, Arndt and Hohlfeld, Oliver and Neumann, Stella and Reelfs, Jens Helge and Schmitt, Marco and Vogelgesang, Alina}, title = {Determining Response-generating Contexts on Microblogging Platforms}, series = {Proceedings of the 15th Conference on Natural Language Processing (KONVENS), October 9-11, 2019, Erlangen}, journal = {Proceedings of the 15th Conference on Natural Language Processing (KONVENS), October 9-11, 2019, Erlangen}, pages = {171 -- 182}, language = {en} } @misc{WolsingRuethWehrleetal., author = {Wolsing, Konrad and R{\"u}th, Jan and Wehrle, Klaus and Hohlfeld, Oliver}, title = {A Performance Perspective on Web Optimized Protocol Stacks: TCP+TLS+HTTP/2 vs. QUIC}, series = {Proceedings of the Applied Networking Research Workshop (ANRW '19), July 22, 2019, Montreal, QC, Canada}, journal = {Proceedings of the Applied Networking Research Workshop (ANRW '19), July 22, 2019, Montreal, QC, Canada}, publisher = {ACM}, address = {New York}, isbn = {978-1-4503-6848-3}, doi = {10.1145/3340301.3341123}, pages = {1 -- 7}, language = {en} } @misc{CwalinskiRietzVogeletal., author = {Cwalinski, Radoslaw and Rietz, Ren{\´e} and Vogel, Michael and K{\"o}nig, Hartmut}, title = {An SDN-based Approach to Protect Communication Between Virtual Machines}, series = {IEEE 44th Conference on Local Computer Networks (LCN), October 14-17, 2019, Osnabr{\"u}ck, Germany.}, journal = {IEEE 44th Conference on Local Computer Networks (LCN), October 14-17, 2019, Osnabr{\"u}ck, Germany.}, publisher = {IEEE}, isbn = {978-1-7281-1028-8}, pages = {465 -- 468}, language = {en} } @misc{HohlfeldKrudeReelfsetal., author = {Hohlfeld, Oliver and Krude, Johannes and Reelfs, Jens Helge and R{\"u}th, Jan and Wehrle, Klaus}, title = {Demystifying the Performance of XDP BPF}, series = {IEEE Conference on Network Softwarization, 24-28 June 2019, Paris, France}, journal = {IEEE Conference on Network Softwarization, 24-28 June 2019, Paris, France}, doi = {10.1109/NETSOFT.2019.8806651}, pages = {5}, abstract = {High packet rates at ≥ 10 GBit/s challenge the packet processing performance of network stacks. A common solution is to offload (parts of) the user-space packet processing to other execution environments, e.g., into the device driver (kernel-space), the NIC or even from virtual machines into the host operating system (OS), or any combination of those. While common wisdom states that offloading optimizes performance, neither benefits nor negative effects are comprehensively studied. In this paper, we aim to shed light on the benefits and shortcomings of eBPF/XDP-based offloading from the user-space to i) the kernel-space or ii) a smart NIC-including VM virtualization. We show that offloading can indeed optimize packet processing, but only if the task is small and optimized for the target environment. Otherwise, offloading can even lead to detrimental performance.}, language = {en} } @misc{RuethKunzeHohlfeld, author = {R{\"u}th, Jan and Kunze, Ike and Hohlfeld, Oliver}, title = {TCP's Initial Window - Deployment in the Wild and its Impact on Performance}, series = {IEEE Transactions on Network and Service Management}, volume = {16}, journal = {IEEE Transactions on Network and Service Management}, number = {2}, issn = {1932-4537}, doi = {10.1109/TNSM.2019.2896335}, pages = {389 -- 402}, language = {en} } @misc{RuethZimmermannHohlfeld, author = {R{\"u}th, Jan and Zimmermann, Torsten and Hohlfeld, Oliver}, title = {Hidden Treasures - Recycling Large-Scale Internet Measurements to Study the Internet's Control Plane}, series = {Passive Active Measurement Conference (PAM 2019), 27-29 March 2019, Puerto Varas, Chile}, journal = {Passive Active Measurement Conference (PAM 2019), 27-29 March 2019, Puerto Varas, Chile}, publisher = {Springer}, address = {New York}, isbn = {978-3-030-15985-6}, doi = {10.1007/978-3-030-15986-3_4}, pages = {67}, language = {en} } @misc{ReelfsMohauptHohlfeldetal., author = {Reelfs, Jens Helge and Mohaupt, Timon and Hohlfeld, Oliver and Henckell, Niklas}, title = {Hashtag Usage in a Geographically-Local Microblogging App}, series = {Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion), 9th International Workshop on Location and the Web (LocWeb '19), May 13-17, 2019, San Francisco, CA, USA}, journal = {Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion), 9th International Workshop on Location and the Web (LocWeb '19), May 13-17, 2019, San Francisco, CA, USA}, publisher = {ACM}, address = {New York}, isbn = {978-1-4503-6675-5}, doi = {10.1145/3308560.3316537}, pages = {919 -- 927}, language = {en} } @misc{GuseOreficeReimersetal., author = {Guse, Dennis and Orefice, Henrique R. and Reimers, Gabriel and Hohlfeld, Oliver}, title = {TheFragebogen: A Web Browser-based Questionnaire Framework for Scientific Research}, series = {2019 Eleventh International Conference on Quality of Multimedia Experience (QoMEX 2019), June 5-7 2019, Berlin}, journal = {2019 Eleventh International Conference on Quality of Multimedia Experience (QoMEX 2019), June 5-7 2019, Berlin}, pages = {3}, language = {en} } @incollection{SchusterMehner, author = {Schuster, Franka and Mehner, Stefan}, title = {Das SICIA-Verfahren: Messung \& Bewertung der IT-Sicherheit - mit oder ohne ISMS}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nche}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {98 -- 99}, language = {de} } @misc{SchusterPaulMehneretal., author = {Schuster, Franka and Paul, Andreas and Mehner, Stefan and K{\"o}nig, Hartmut and Kanisch, Heiko}, title = {IT-Sicherheit im Kraftwerk - Methoden zur automatisierten Sicherheitsbewertung und Anomalieerkennung in hochsensiblen Netzen}, series = {51. Kraftwerkstechnisches Kolloquium, 21. - 23. Oktober 2019, Dresden}, journal = {51. Kraftwerkstechnisches Kolloquium, 21. - 23. Oktober 2019, Dresden}, publisher = {SAXONIA Standortentwicklungs- und -verwaltungsgesellschaft mbH}, address = {Freiberg}, isbn = {978-3-934409-94-1}, pages = {680 -- 703}, abstract = {Die zunehmende Digitalisierung auch in Kraftwerken erfordert entsprechend auf diesen Bereich zugeschnittene IT-Sicherheitsverfahren und -technologien. Aktuell stellt die obligatorische Implementierung eines angemessenen Sicherheitsprozesses, wie eines Informationssicherheitsmanagementsystems (ISMS), Betreiber von Erzeugungsanlagen, Energienetzen und anderen kritischen Infrastrukturen vor eine große Herausforderung, denn es gilt, zahlreiche Anforderungen bei der Implementierung zu erf{\"u}llen, ohne dass konkrete Methoden zur Umsetzung verf{\"u}gbar sind. Gleichzeitig ist derEinsatz von IT-Sicherheitstechnologien aus der B{\"u}rowelt aufgrund g{\"a}nzlich anderer Eigenschaften und Anforderungen industrieller Netze kaum m{\"o}glich. Zur Adressierung dieser Problematik wurden von der Brandenburgischen Technischen Universit{\"a}t Cottbus-Senftenberg (BTU) und der Lausitz Energie Kraftwerke AG (LEAG) innovative Verfahren zur (1) systematischen Bewertung sowie (2) Verbesserung der IT-Sicherheit in hochsensiblen Netzen konzipiert und prototypisch implementiert, die ein diesem Beitrag mit den zugeh{\"o}rigen Forschungsprojekten vorgestellt werden. Um eine Beeinflussung empfindlicher Kraftwerksanlagen auszuschließen, wurde f{\"u}r alle Methoden ein nichtintrusiver Entwicklungsansatz verfolgt, der sich durch eine passive und vom jeweiligen industriellen Prozess vollst{\"a}ndig entkoppelte Analyse auszeichnet und sich daher f{\"u}r einen breiten Einsatz in Netzen mit hohen Verf{\"u}gbarkeitsanforderungen eignet.}, language = {de} } @incollection{RieckWressneggerKoenigetal., author = {Rieck, Konrad and Wressnegger, Christian and K{\"o}nig, Hartmut and Paul, Andreas and Schuster, Franka and Kanisch, Heiko and Moder, Christoph}, title = {INDI - Intelligente Intrusion-Detection-Systeme f{\"u}r Industrienetze}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {S. 19}, language = {de} } @incollection{RieckWressneggerKoenigetal., author = {Rieck, Konrad and Wressnegger, Christian and K{\"o}nig, Hartmut and Paul, Andreas and Schuster, Franka and Kanisch, Heiko and Moder, Christoph}, title = {Prozessnahe Kommunikation als besondere Herausforderung}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {S. 57}, language = {de} } @incollection{KanischSchusterKoenig, author = {Kanisch, Heiko and Schuster, Franka and K{\"o}nig, Hartmut}, title = {Informationstechnik in der Energieversorgung - Besonderheiten und Regularien}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {67 -- 68}, language = {de} } @misc{ReelfsHohlfeldPoese, author = {Reelfs, Jens Helge and Hohlfeld, Oliver and Poese, Ingmar}, title = {Corona-Warn-App: Tracing the Start of the Official COVID-19 Exposure Notification App for Germany}, doi = {0.1145/3405837.3411378}, pages = {3}, abstract = {On June 16, 2020, Germany launched an open-source smartphone contact tracing app ("Corona-Warn-App") to help tracing SARS-CoV-2 (coronavirus) infection chains. It uses a decentralized, privacy-preserving design based on the Exposure Notification APIs in which a centralized server is only used to distribute a list of keys of SARS-CoV-2 infected users that is fetched by the app once per day. Its success, however, depends on its adoption. In this poster, we characterize the early adoption of the app using Netflow traces captured directly at its hosting infrastructure. We show that the app generated traffic from allover Germany---already on the first day. We further observe that local COVID-19 outbreaks do not result in noticeable traffic increases.}, language = {en} } @misc{ReelfsHohlfeldStrohmaieretal., author = {Reelfs, Jens Helge and Hohlfeld, Oliver and Strohmaier, Markus and Henckell, Niklas}, title = {Word-Emoji embeddings from large scale messaging data reflect real world semantic associations of expressive icons}, series = {Conference: ICWSM Workshop on Emoji Understanding and Applications in Social Media 2020}, journal = {Conference: ICWSM Workshop on Emoji Understanding and Applications in Social Media 2020}, pages = {10}, abstract = {We train word-emoji embeddings on large scale messagingdata obtained from the Jodel online social network. Our dataset contains more than 40 million sentences, of which 11 million sentences are annotated with a subset of the Unicode13.0 standard Emoji list. We explore semantic emoji associations contained in this embedding by analyzing associations between emojis, between emojis and text, and betweentext and emojis. Our investigations demonstrate anecdotallythat word-emoji embeddings trained on large scale messaging data can reflect real-world semantic associations. To enable further research we release the Jodel Emoji EmbeddingDataset (JEED1488) containing 1488 emojis and their embeddings along 300 dimensions.}, language = {en} } @misc{HasslingerNtougiasHasslingeretal., author = {Hasslinger, Gerhard and Ntougias, Konstantinos and Hasslinger, Frank and Hohlfeld, Oliver}, title = {General Knapsack Bounds of Web Caching Performance Regarding the Properties of each Cacheable Object}, series = {2020 IFIP Networking Conference (Networking), 22-26 June 2020, Paris, France}, journal = {2020 IFIP Networking Conference (Networking), 22-26 June 2020, Paris, France}, publisher = {IEEE}, isbn = {978-3-903176-28-7}, pages = {6}, abstract = {Caching strategies have been evaluated and compared in many studies, most often via simulation, but also in analytic methods. Knapsack solutions provide a general analytical approach for upper bounds on web caching performance. They assume objects of maximum (value/size) ratio being selected as cache content, with flexibility to define the caching value. Therefore the popularity, cost, size, time-to-live restrictions etc. per object can be included an overall caching goal, e.g., for reducing delay and/or transport path length in content delivery. The independent request model (IRM) leads to basic knapsack bounds for static optimum cache content. We show that a 2-dimensional (2D-)knapsack solution covers arbitrary request pattern, which selects dynamically changing content yielding maximum caching value for any predefined request sequence. Moreover, Belady's optimum strategy for clairvoyant caching is identified as a special case of our 2D-knapsack solution when all objects are unique. We also summarize a comprehensive picture of the demands and efficiency criteria for web caching, including updating speed and overheads. Our evaluations confirm significant performance gaps from LRU to advanced GreedyDual and score-based web caching methods and to the knapsack bounds.}, language = {en} } @misc{KosekBloecherRuethetal., author = {Kosek, Mike and Bl{\"o}cher, Leo and R{\"u}th, Jan and Zimmermann, Torsten and Hohlfeld, Oliver}, title = {MUST, SHOULD, DON'T CARE: TCP conformance in the Wild}, series = {Passive and Active Measurement : 21st International Conference, PAM 2020, Eugene, Oregon, USA, March 30-31, 2020, Proceedings}, journal = {Passive and Active Measurement : 21st International Conference, PAM 2020, Eugene, Oregon, USA, March 30-31, 2020, Proceedings}, editor = {Sperotto, Anna and Dainotti, Alberto and Stiller, Burkhard}, publisher = {Springer}, address = {Cham}, isbn = {978-3-030-44080-0}, issn = {0302-9743}, doi = {10.1007/978-3-030-44081-7_8}, pages = {122 -- 138}, abstract = {Standards govern the SHOULD and MUST requirements for protocol implementers for interoperability. In case of TCP that carries the bulk of the Internets' traffic, these requirements are defined in RFCs. While it is known that not all optional features are implemented and nonconformance exists, one would assume that TCP implementations at least conform to the minimum set of MUST requirements. In this paper, we use Internet-wide scans to show how Internet hosts and paths conform to these basic requirements. We uncover a non-negligible set of hosts and paths that do not adhere to even basic requirements. For example, we observe hosts that do not correctly handle checksums and cases of middlebox interference for TCP options. We identify hosts that drop packets when the urgent pointer is set or simply crash. Our publicly available results highlight that conformance to even fundamental protocol requirements should not be taken for granted but instead checked regularly.}, language = {en} } @misc{HillerAmannHohlfeld, author = {Hiller, Jens and Amann, Johanna and Hohlfeld, Oliver}, title = {The Boon and Bane of Cross-Signing: Shedding Light on a Common Practice in Public Key Infrastructures}, series = {CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, October 2020}, journal = {CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, October 2020}, doi = {10.1145/3372297.3423345}, pages = {1289 -- 1306}, abstract = {Public Key Infrastructures (PKIs) with their trusted Certificate Authorities (CAs) provide the trust backbone for the Internet: CAs sign certificates which prove the identity of servers, applications, or users. To be trusted by operating systems and browsers, a CA has to undergo lengthy and costly validation processes. Alternatively, trusted CAs can cross-sign other CAs to extend their trust to them. In this paper, we systematically analyze the present and past state of cross-signing in the Web PKI. Our dataset (derived from passive TLS monitors and public CT logs) encompasses more than 7 years and 225 million certificates with 9.3 billion trust paths. We show benefits and risks of cross-signing. We discuss the difficulty of revoking trusted CA certificates where, worrisome, cross-signing can result in valid trust paths to remain after revocation; a problem for non-browser software that often blindly trusts all CA certificates and ignores revocations. However, cross-signing also enables fast bootstrapping of new CAs, e.g., Let's Encrypt, and achieves a non-disruptive user experience by providing backward compatibility. In this paper, we propose new rules and guidance for cross-signing to preserve its positive potential while mitigating its risks.}, language = {en} } @misc{HillerHenzeZimmermannetal., author = {Hiller, Jens and Henze, Martin and Zimmermann, Torsten and Hohlfeld, Oliver and Wehrle, Klaus}, title = {The Case for Session Sharing: Relieving Clients from TLS Handshake Overheads}, series = {2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 14-17 Oct. 2019, Osnabr{\"u}ck, Germany}, journal = {2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 14-17 Oct. 2019, Osnabr{\"u}ck, Germany}, publisher = {IEEE}, isbn = {978-1-7281-2561-9}, doi = {10.1109/LCNSymposium47956.2019.9000667}, pages = {9}, abstract = {In recent years, the amount of traffic protected with Transport Layer Security (TLS) has significantly increased and new protocols such as HTTP/2 and QUIC further foster this emerging trend. However, protecting traffic with TLS has significant impacts on network entities. While the restrictions for middleboxes have been extensively studied, addressing the impact of TLS on clients and servers has been mostly neglected so far. Especially mobile clients in emerging 5G and IoT deployments suffer from significantly increased latency, traffic, and energy overheads when protecting traffic with TLS. In this paper, we address this emerging topic by thoroughly analyzing the impact of TLS on clients and servers and derive opportunities for significantly decreasing latency of TLS communication and downsizing TLS management traffic, thereby also reducing TLSinduced server load. We propose a protocol compatible redesign of TLS session management to use these opportunities and showcase their potential based on mobile device traffic and mobile web-browsing traces. These show promising potentials for latency improvements by up to 25.8\% and energy savings of up to 26.3\%.}, language = {en} } @misc{FeldmannGasserLichtblauetal., author = {Feldmann, Anja and Gasser, Oliver and Lichtblau, Franziska and Pujol, Enric and Poese, Ingmar and Dietzel, Christoph and Wagner, Daniel and Wichtlhuber, Matthias and Tapiador, Juan and Vallina-Rodriguez, Narseo and Hohlfeld, Oliver and Smaragdakis, Georgios}, title = {A Year in Lockdown: How the Waves of COVID-19 Impact Internet Traffic}, series = {Communications of the ACM}, volume = {64}, journal = {Communications of the ACM}, number = {7}, issn = {1557-7317}, doi = {10.1145/3465212}, pages = {9}, language = {en} } @misc{FealVallinaGambaetal., author = {Feal, {\´A}lvaro and Vallina, Pelayo and Gamba, Julien and Pastrana, Sergio and Nappa, Antonio and Hohlfeld, Oliver and Vallina-Rodriguez, Narseo and Tapiador, Juan}, title = {Blocklist Babel: On the Transparency and Dynamics of Open Source Blocklisting}, series = {IEEE Transactions on Network and Service Management}, journal = {IEEE Transactions on Network and Service Management}, publisher = {IEEE}, issn = {1932-4537}, doi = {10.1109/TNSM.2021.3075552}, pages = {16}, abstract = {Blocklists constitute a widely-used Internet security mechanism to filter undesired network traffic based on IP/domain reputation and behavior. Many blocklists are distributed in open source form by threat intelligence providers who aggregate and process input from their own sensors, but also from thirdparty feeds or providers. Despite their wide adoption, many open-source blocklist providers lack clear documentation about their structure, curation process, contents, dynamics, and interrelationships with other providers. In this paper, we perform a transparency and content analysis of 2,093 free and open source blocklists with the aim of exploring those questions. To that end, we perform a longitudinal 6-month crawling campaign yielding more than 13.5M unique records. This allows us to shed light on their nature, dynamics, inter-provider relationships, and transparency. Specifically, we discuss how the lack of consensus on distribution formats, blocklist labeling taxonomy, content focus, and temporal dynamics creates a complex ecosystem that complicates their combined crawling, aggregation and use. We also provide observations regarding their generally low overlap as well as acute differences in terms of liveness (i.e., how frequently records get indexed and removed from the list) and the lack of documentation about their data collection processes, nature and intended purpose. We conclude the paper with recommendations in terms of transparency, accountability, and standardization.}, language = {en} } @misc{ReelfsBergmannHohlfeldetal., author = {Reelfs, Jens Helge and Bergmann, Max and Hohlfeld, Oliver and Henckell, Niklas}, title = {Understanding \& Predicting User Lifetime with Machine Learning in an Anonymous Location-Based Social Network}, series = {Companion Proceedings of the Web Conference 2021}, volume = {2021}, journal = {Companion Proceedings of the Web Conference 2021}, publisher = {ACM}, address = {Ljubljana, Slovenia}, isbn = {978-1-4503-8313-4}, doi = {10.1145/3442442.3451887}, pages = {8}, abstract = {In this work, we predict the user lifetime within the anonymous and location-based social network Jodel in the Kingdom of Saudi Arabia. Jodel's location-based nature yields to the establishment of disjoint communities country-wide and enables for the first time the study of user lifetime in the case of a large set of disjoint communities. A user's lifetime is an important measurement for evaluating and steering customer bases as it can be leveraged to predict churn and possibly apply suitable methods to circumvent potential user losses. We train and test off the shelf machine learning techniques with 5-fold crossvalidation to predict user lifetime as a regression and classification problem; identifying the Random Forest to provide very strong results. Discussing model complexity and quality trade-offs, we also dive deep into a time-dependent feature subset analysis, which does not work very well; Easing up the classification problem into a binary decision (lifetime longer than timespan ) enables a practical lifetime predictor with very good performance. We identify implicit similarities across community models according to strong correlations in feature importance. A single countrywide model generalizes the problem and works equally well for any tested community; the overall model internally works similar to others also indicated by its feature importances.}, language = {en} } @misc{KoppDietzelHohlfeld, author = {Kopp, Daniel and Dietzel, Christoph and Hohlfeld, Oliver}, title = {DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks}, series = {Proceedings of the Passive and Active Measurement (PAM) conference 2021}, journal = {Proceedings of the Passive and Active Measurement (PAM) conference 2021}, pages = {17}, abstract = {DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97\% of the attack traffic.}, language = {en} } @misc{FeldmannGasserLichtblauetal., author = {Feldmann, Anja and Gasser, Oliver and Lichtblau, Franziska and Pujol, Enric and Poese, Ingmar and Dietzel, Christoph and Wagner, Daniel and Wichtlhuber, Matthias and Tapiador, Juan and Vallina-Rodriguez, Narseo and Hohlfeld, Oliver and Smaragdakis, Georgios}, title = {Implications of the COVID-19 Pandemic on the Internet Traffic}, series = {ITG-Fb. 295: Breitbandversorgung in Deutschland : Beitr{\"a}ge der 15. ITG-Fachkonferenz, 2. - 3. M{\"a}rz 2021, Online-Veranstaltung}, journal = {ITG-Fb. 295: Breitbandversorgung in Deutschland : Beitr{\"a}ge der 15. ITG-Fachkonferenz, 2. - 3. M{\"a}rz 2021, Online-Veranstaltung}, publisher = {VDE}, isbn = {978-3-8007-5474-8}, abstract = {In this paper, we report on a measurement study by researchers from several institutions that collected and analyzed network data to assess the impact of the first wave of COVID-19 (February-June 2020) on the Internet traffic. The datasets from Internet Service Providers, Internet Exchange Points, and academic networks, primarily in Europe, provide a unique view on the changes of Internet traffic due to pandemic and the lockdown that forced hundreds of millions of citizens to stay and work from home. The analysis shows that the increase of Internet traffic was about 15-20 \% within a couple of weeks, an increase that is typically spread over multiple months under typical operation. However, traffic during peak hours does not increase by more than 5 \%. The increase was noticeably higher for specific applications, e.g., remote work applications, teleconferencing, video on demand; in some cases up to 200 \%. However, overall, the Internet reacted well to these unprecedented times.}, language = {en} } @misc{DoanvanRijswijkDeijHohlfeldetal., author = {Doan, Trinh Viet and van Rijswijk-Deij, Roland and Hohlfeld, Oliver and Bajpai, Vaibhav}, title = {An Empirical View on Consolidation of the Web}, series = {ACM Transactions on Internet Technology (TOIT)}, volume = {22}, journal = {ACM Transactions on Internet Technology (TOIT)}, number = {3}, issn = {1557-6051}, doi = {10.1145/3503158}, pages = {1 -- 30}, abstract = {The majority of Web content is delivered by only a few companies that provide Content Delivery Infrastructuress (CDIss) such as Content Delivery Networkss (CDNss) and cloud hosts. Due to increasing concerns about trends of centralization, empirical studies on the extent and implications of resulting Internet consolidation are necessary. Thus, we present an empirical view on consolidation of the Web by leveraging datasets from two different measurement platforms. We first analyze Web consolidation around CDIs at the level of landing webpages, before narrowing down the analysis to a level of embedded page resources. The datasets cover 1(a) longitudinal measurements of DNS records for 166.5 M Web domains over five years, 1(b) measurements of DNS records for Alexa Top 1 M over a month and (2) measurements of page loads and renders for 4.3 M webpages, which include data on 392.3 M requested resources. We then define CDIs penetration as the ratio of CDI-hosted objects to all measured objects, which we use to quantify consolidation around CDIs. We observe that CDI penetration has close to doubled since 2015, reaching a lower bound of 15\% for all .com, .net, and .org Web domains as of January 2020. Overall, we find a set of six CDIss to deliver the majority of content across all datasets, with these six CDIss being responsible for more than 80\% of all 221.9 M CDI-delivered resources (56.6\% of all resources in total). We find high dependencies of Web content on a small group of CDIss, in particular, for fonts, ads, and trackers, as well as JavaScript resources such as jQuery. We further observe CDIss to play important roles in rolling out IPv6 and TLS 1.3 support. Overall, these observations indicate a potential oligopoly, which brings both benefits but also risks to the future of the Web.}, language = {en} } @misc{ReelfsHohlfeldStrohmaieretal., author = {Reelfs, Jens Helge and Hohlfeld, Oliver and Strohmaier, Markus and Henckell, Niklas}, title = {Characterizing the country-wide adoption and evolution of the Jodel messaging app in Saudi Arabia}, series = {arXiv}, journal = {arXiv}, doi = {10.48550/arXiv.2205.04544}, pages = {14}, abstract = {Social media is subject to constant growth and evolution, yet little is known about their early phases of adoption. To shed light on this aspect, this paper empirically characterizes the initial and country-wide adoption of a new type of social media in Saudi Arabia that happened in 2017. Unlike established social media, the studied network Jodel is anonymous and location-based to form hundreds of independent communities country-wide whose adoption pattern we compare. We take a detailed and full view from the operators perspective on the temporal and geographical dimension on the evolution of these different communities—from their very first the first months of establishment to saturation. This way, we make the early adoption of a new type of social media visible, a process that is often invisible due to the lack of data covering the first days of a new network.}, language = {en} } @misc{BajpaiHohlfeldCrowcroftetal., author = {Bajpai, Vaibhav and Hohlfeld, Oliver and Crowcroft, Jon and Keshav, Srinivasan and Schulzrinne, Henning and Ott, J{\"o}rg and Ferlin, Simone and Carle, Georg and Hines, Andrew and Raake, Alexander}, title = {Recommendations for Designing Hybrid Conferences}, series = {ACM SIGCOMM Computer Communication Review}, volume = {52}, journal = {ACM SIGCOMM Computer Communication Review}, number = {2}, issn = {0146-4833}, doi = {10.1145/3544912.3544920}, pages = {63 -- 69}, abstract = {During the COVID-19 pandemic, many smaller conferences have moved entirely online and larger ones are being held as hybrid events. Even beyond the pandemic, hybrid events reduce the carbon footprint of conference travel and makes events more accessible to parts of the research community that have difficulty traveling long distances, while preserving most advantages of in-person gatherings. While we have developed a solid understanding of how to design virtual events over the last two years, we are still learning how to properly run hybrid events. We present guidelines and considerations-spanning technology, organization and social factors-for organizing successful hybrid conferences. This paper summarizes and extends the discussions held at the Dagstuhl seminar on "Climate Friendly Internet Research" held in July 2021.}, language = {en} } @misc{SchweissguthParzyjeglaDanielisetal., author = {Schweissguth, Eike and Parzyjegla, Helge and Danielis, Peter and M{\"u}hl, Gero and Timmermann, Dirk and Mehner, Stefan and Hohlfeld, Oliver and Hellmanns, David and Falk, Jonathan}, title = {TSN Scheduler Benchmarking}, series = {2023 IEEE 19th International Conference on Factory Communication Systems (WFCS)}, journal = {2023 IEEE 19th International Conference on Factory Communication Systems (WFCS)}, publisher = {IEEE}, isbn = {978-1-6654-6432-1}, issn = {2835-8414}, doi = {10.1109/WFCS57264.2023.10144227}, abstract = {Time-Sensitive Networking (TSN) disrupts realtime communication technology by making IEEE Ethernet realtime-capable. For time-triggered, hard realtime traffic, TSN provides standardized mechanisms to reserve communication paths as well as individual transmission time slots for data frames. By leveraging these means in a precomputed network schedule, TSN allows for bounded end-to-end delays and minimal jitter. Not being part of the IEEE standard, corresponding scheduling algorithms are an active field of research. Unfortunately, due to differing model assumptions, evaluation setups, and key metrics, a fair comparison of schedulers is impossible so far. In this paper, we present a systematic and reproducible approach to benchmark TSN schedulers. First, we provide a scheduler taxonomy that enables to cluster schedulers by their characteristics. Second, we analyze interactions of input parameters and scheduler results to derive a benchmarking parcour for quantitative comparisons. Finally, we use the approach to benchmark existing schedulers and show subtle interaction effects. This way, our approach enables—for the first time-comparability between schedulers, fueled by the public availability of our benchmarking scenarios.}, language = {en} } @inproceedings{SchusterPaulKoppetal., author = {Schuster, Franka and Paul, Andreas and Kopp, Fabian Malte and K{\"o}nig, Hartmut}, title = {Catching Intrusions: Classifier Performances for Detecting Network-specific Anomalies in Energy Systems}, series = {2018 International Conference on Smart Energy Systems and Technologies (SEST), Seville, Spain, September 2018}, booktitle = {2018 International Conference on Smart Energy Systems and Technologies (SEST), Seville, Spain, September 2018}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-5386-5326-5}, doi = {10.1109/SEST.2018.8495702}, pages = {6}, language = {en} } @inproceedings{CwalinskiKoenig, author = {Cwalinski, Radoslaw and K{\"o}nig, Hartmut}, title = {SDN-based Attack Detection in Wireless Local Area Networks}, series = {4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, 2018}, booktitle = {4th IEEE Conference on Network Softwarization and Workshops (NetSoft), Montreal, QC, 2018}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-5386-4633-5}, doi = {10.1109/NETSOFT.2018.8460121}, pages = {207 -- 211}, language = {en} } @inproceedings{SchusterKoppPauletal., author = {Schuster, Franka and Kopp, Fabian Malte and Paul, Andreas and K{\"o}nig, Hartmut}, title = {Attack and Fault Detection in Process Control Communication Using Unsupervised Machine Learning}, series = {IEEE 16th International Conference on Industrial Informatics (INDIN), Porto, Portugal, 18-20 July 2018}, booktitle = {IEEE 16th International Conference on Industrial Informatics (INDIN), Porto, Portugal, 18-20 July 2018}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-5386-4829-2}, doi = {10.1109/INDIN.2018.8472054}, pages = {433 -- 438}, language = {en} } @inproceedings{BoehmKirsche, author = {B{\"o}hm, Sebastian and Kirsche, Michael}, title = {Unifying Radio-in-the-Loop Channel Emulation and Network Protocol Simulation to Improve Wireless Sensor Network Evaluation}, series = {Simulation Science, First International Workshop, SimScience 2017, G{\"o}ttingen, Germany, April 27-28, 2017}, booktitle = {Simulation Science, First International Workshop, SimScience 2017, G{\"o}ttingen, Germany, April 27-28, 2017}, editor = {Baum, Marcus and Brenner, Gunther and Grabowski, Jens and Hanschke, Thomas and Hartmann, Stefan and Sch{\"o}bel, Anita}, publisher = {Springer International Publishing}, address = {Cham}, isbn = {978-3-319-96271-9}, doi = {10.1007/978-3-319-96271-9_14}, pages = {219 -- 238}, abstract = {Evaluations of Internet of Things (IoT) and Wireless Sensor Network (WSN) applications demonstrate the significant and still existing gap between examinations with generic simulation environments and real-life (e.g., field test) or controlled (e.g., testbed) sensor network deployments in terms of realistic and accurate results. The separated use of single examination approaches is often not enough to overcome all evaluation challenges. We therefore propose a combination of discrete-event simulation, radio-channel emulation, and real hardware working together on different layers of the protocol stack of the system-under-test. Our combined approach reduces the gap between abstract simulations and network testbed experiments by providing adjustable radio conditions for repeatable evaluations of WSN and IoT networks.}, language = {en} } @inproceedings{CwalinskiKoenig, author = {Cwalinski, Radoslaw and K{\"o}nig, Hartmut}, title = {Identifying Malicious Traffic in Software-Defined Wireless Local Area Networks}, series = {2018 International Conference on Computing, Networking and Communications (ICNC), Maui, HI, USA, 2018}, booktitle = {2018 International Conference on Computing, Networking and Communications (ICNC), Maui, HI, USA, 2018}, publisher = {IEEE}, isbn = {978-1-5386-3652-7}, doi = {10.1109/ICCNC.2018.8390307}, pages = {195 -- 199}, language = {en} } @misc{PennekampHenzeHohlfeldetal., author = {Pennekamp, Jan and Henze, Martin and Hohlfeld, Oliver and Panchenko, Andriy}, title = {Hi Doppelg{\"a}nger: Towards Detecting Manipulation in News Comments}, series = {Companion Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion), 4th Workshop on Computational Methods in Online Misbehavior (CyberSafety '19), May 13-17, 2019, San Francisco, CA, USA}, journal = {Companion Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion), 4th Workshop on Computational Methods in Online Misbehavior (CyberSafety '19), May 13-17, 2019, San Francisco, CA, USA}, publisher = {ACM}, address = {New York}, isbn = {978-1-4503-6675-5}, doi = {10.1145/3308560.3316496}, pages = {197 -- 205}, language = {en} } @inproceedings{DacierKarglKoenigetal., author = {Dacier, Marc C. and Kargl, Frank and K{\"o}nig, Hartmut and Valdes, Alfonso}, title = {Network Attack Detection and Defense: Securing Industrial Control Systems for Critical Infrastructures}, series = {Report from Dagstuhl Seminar 14292, 13. - 16. Juli 2014,}, booktitle = {Report from Dagstuhl Seminar 14292, 13. - 16. Juli 2014,}, publisher = {Dagstuhl Publishing}, address = {Schloss Dagstuhl, Wadern}, doi = {10.4230/DagRep.4.7.62}, pages = {62 -- 79}, abstract = {This report documents the program and the outcomes of Dagstuhl Seminar 14292 "Network Attack Detection and Defense: Securing Industrial Control Systems for Critical Infrastructures". The main objective of the seminar was to discuss new approaches and ideas for securing industrial control systems. It is the sequel of several previous Dagstuhl seminars: (1) the series "Network Attack Detection and Defense" held in 2008 and 2012, and (2) the Dagstuhl seminar "Securing Critical Infrastructures from Targeted Attacks", held in 2012. At the seminar, which brought together members from academia an industry, appropriate methods for detecting attacks on industrial control systems (ICSs) and for limiting the impact on the physical components were considered. A central question was whether and how reactive security mechanisms can be made more ICS- and process-aware. To some extent it seems possible to adopt existing security approaches from other areas (e. g., conventional networks, embedded systems, or sensor networks). The main question is whether adopting these approaches is sufficient to reach the desired level of security for ICSs. Detecting attacks to the physical components and appropriate reactions to attacks are new aspects that need to be considered as well. The main result of the seminar is a list of recommendations for future directions in ICS security that is presented in this report.}, language = {en} } @inproceedings{SchusterGrubitzschRenzeletal., author = {Schuster, Daniel and Grubitzsch, Philipp and Renzel, Dominik and Klauck, Ronny and Kirsche, Michael}, title = {Global-scale Federated Access to Smart Objects Using XMPP}, series = {2014 IEEE International Conference on Internet of Things (iThings 2014), and IEEE green computing and communications (GreenCom 2014) and IEEE cyber, physical and social computing (CPSCom 2014), Taipei, Taiwan, 1 - 3 September 2014}, booktitle = {2014 IEEE International Conference on Internet of Things (iThings 2014), and IEEE green computing and communications (GreenCom 2014) and IEEE cyber, physical and social computing (CPSCom 2014), Taipei, Taiwan, 1 - 3 September 2014}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-4799-5967-9}, pages = {185 -- 192}, abstract = {Communication with smart objects currently only works in isolated, sometimes even proprietary islands. This lack of interoperability limits the value of smart objects connected to the Internet of Things (IoT). We propose to use the eXtensible Messaging and Presence Protocol (XMPP) to connect IoT islands. XMPP is inherently federated, secure, globally scalable and designed for collaboration. We use XMPP Multi-User Chat (MUC) to build a secure and accessible platform for sensor data exchange between organizations. We demonstrate a scenario of three distributed and interconnected XMPP-driven sites, whereas different client types access sensor data from all sites. Our evaluation results confirm that the architectural pattern presented in this work can easily be used in any XMPP-based system without the need to enhance or to extend the standards.}, language = {en} } @phdthesis{Langendoerfer, author = {Langend{\"o}rfer, Peter}, title = {Gestaltung konfigurierbarer Codegeneratoren f{\"u}r die automatische Erzeugung effizienter Protokollimplementierungen}, publisher = {Shaker}, address = {Aachen}, isbn = {3-8265-8539-9}, language = {de} } @inproceedings{PinkSprejzKoenig, author = {Pink, Mario and Sprejz, Michael and K{\"o}nig, Hartmut}, title = {A Coordinated Group Decision for Vertical Handovers in Heterogeneous Wireless Networks}, series = {2013 International Conference on MOBILe Wireless MiddleWARE, Operating Systems, and Applications, Bologna, Italy, November 11-13, 2013}, booktitle = {2013 International Conference on MOBILe Wireless MiddleWARE, Operating Systems, and Applications, Bologna, Italy, November 11-13, 2013}, publisher = {IEEE}, address = {Piscataway, NJ}, doi = {10.1109/Mobilware.2013.20}, pages = {130 -- 137}, abstract = {Cooperation and interactions of mobile users is a characteristic feature of mobile collaborative applications. The users are located in different mobile communication networks or move in or among them, respectively. This requires horizontal and vertical handovers. The latter is required when the networks use different network technologies. Usually each mobile device independently chooses the most appropriate network for its purposes to switch to. In group-oriented applications this may lead to an uncoordinated network selection and as consequence to increased energy consumption. In this paper, we present a distributed vertical handover decision algorithm that coordinates the selection of the network among the mobile devices in order to ensure an optimal quality of service for the collaborative application and a low energy consumption of the involved mobile devices. The network selection is based on the calculation of a group benefit for each alternative network using the Simple Additive Weighting (SAW) algorithm. The feasibility of the algorithm is evaluated regarding varying group sizes and resource requirements.}, language = {en} } @inproceedings{GaeblerKoenig, author = {G{\"a}bler, Jan and K{\"o}nig, Hartmut}, title = {Enhancing Group Communication Systems with Mobility Support}, series = {Proceedings of the 19th IEEE International Conference on Networks (ICON 2013), Singapore, December 2013}, booktitle = {Proceedings of the 19th IEEE International Conference on Networks (ICON 2013), Singapore, December 2013}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-4799-2085-3}, pages = {342 -- 347}, language = {en} } @inproceedings{MehnerKlauckKoenig, author = {Mehner, Stefan and Klauck, Ronny and K{\"o}nig, Hartmut}, title = {Location-independent fall detection with smartphone}, series = {The 6th International Conference on PErvasive Technologies Related to Assistive Environments, PETRA '13, Island of Rhodes, Greece, May 29-31, 2013}, booktitle = {The 6th International Conference on PErvasive Technologies Related to Assistive Environments, PETRA '13, Island of Rhodes, Greece, May 29-31, 2013}, editor = {Makedon, Fillia and Betke, Margrit and Seif El-Nasr, Magy and Maglogiannis, Ilias}, publisher = {ACM}, address = {New York, NY}, isbn = {978-1-4503-1973-7}, doi = {10.1145/2504335.2504346}, pages = {8}, abstract = {Due to demographic changes in developed industrial countries and a better medical care system, the number of elderly people who still live in their home environment is rapidly growing because there they feel more comfortable and independent as in a clinical environment or in a residential care home. The elderly often live alone and receive only irregular visits. Due to impaired physical skills the probability of falls significantly increases. The detection of falls is a crucial aspect in the care of elderly. Falls are often detected very late with severe consequential damages. There are existing approaches for automatic fall detection. They usually deploy special external devices. Elderly people often do not accept these devices because they expose their frailty. In this paper, we present a location-independent fall detection method implemented as a smartphone application for an inconspicuous use in nearly every situation of the daily life. The difficulty of our approach is in the low resolution range of integrated acceleration sensors and the limited energy supply of the smartphone. As solution, we apply a modular threshold-based algorithm which uses the acceleration sensor with moderate energy consumption. Its fall detection rate is in the average of current relevant research.}, language = {en} } @inproceedings{GaeblerKlauckPinketal., author = {G{\"a}bler, Jan and Klauck, Ronny and Pink, Mario and K{\"o}nig, Hartmut}, title = {uBeeMe - a Platform to Enable Mobile Collaborative Applications}, series = {Proceedings of the 9th International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom 2013), Austin, Texas, USA, October, 2013}, booktitle = {Proceedings of the 9th International Conference on Collaborative Computing: Networking, Applications and Worksharing (CollaborateCom 2013), Austin, Texas, USA, October, 2013}, publisher = {IEEE}, address = {Piscataway, NJ}, pages = {188 -- 196}, language = {en} } @inproceedings{KlauckKirsche, author = {Klauck, Ronny and Kirsche, Michael}, title = {Enhanced DNS Message Compression - Optimizing mDNS/DNS-SD for the Use in 6LoWPANs}, series = {Proceedings,9th IEEE International Workshop on Sensor Networks and Systems for Pervasive Computing 2013 (PerSeNS 2013), co-located with the 11th IEEE Conference on Pervasive Computing and Communication (PerCom 2013), San Diego, Calif., USA, 2013}, booktitle = {Proceedings,9th IEEE International Workshop on Sensor Networks and Systems for Pervasive Computing 2013 (PerSeNS 2013), co-located with the 11th IEEE Conference on Pervasive Computing and Communication (PerCom 2013), San Diego, Calif., USA, 2013}, publisher = {IEEE}, isbn = {978-1-4673-5075-4}, doi = {10.1109/PerComW.2013.6529565}, pages = {596 -- 601}, language = {en} } @incollection{RieckWressneggerKoenigetal., author = {Rieck, Konrad and Wressnegger, Christian and K{\"o}nig, Hartmut and Paul, Andreas and Schuster, Franka and Kanisch, Heiko and Moder, Christoph}, title = {Werkzeuge und Ver{\"o}ffentlichungen}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {S. 85}, language = {de} } @incollection{RieckWressneggerKoenigetal., author = {Rieck, Konrad and Wressnegger, Christian and K{\"o}nig, Hartmut and Paul, Andreas and Schuster, Franka and Kanisch, Heiko and Moder, Christoph}, title = {Implementierung und Umsetzung}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {122 -- 124}, language = {de} } @incollection{SchusterPaulKoenig, author = {Schuster, Franka and Paul, Andreas and K{\"o}nig, Hartmut}, title = {SICIA - IT-Sicherheit in kritischen Netzen messen und systematisch verbessern}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {27 -- 28}, language = {de} } @incollection{SchusterPaulKoenig, author = {Schuster, Franka and Paul, Andreas and K{\"o}nig, Hartmut}, title = {Anwendung des SICIA-Verfahrens in der Praxis - am Beispiel eines ISMS}, series = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, booktitle = {IT-Sicherheit f{\"u}r Kritische Infrastrukturen - State of the Art : Ergebnisse des F{\"o}rderschwerpunkts IT-Sicherheit f{\"u}r Kritische Infrastrukturen ITS/KRITIS des BMBF}, editor = {Rudel, Steffi and Lechner, Ulrike}, edition = {1. Auflage}, publisher = {Professur f{\"u}r Wirtschaftsinformatik, Universit{\"a}t der Bundeswehr M{\"u}nchen}, address = {Neubiberg}, isbn = {978-3-943207-33-0}, pages = {139 -- 144}, language = {de} } @inproceedings{GaeblerKoenig, author = {G{\"a}bler, Jan and K{\"o}nig, Hartmut}, title = {Moversight: A Group Communication Protocol for Mobile Collaborative Applications}, series = {Proceedings of the 6th Joint IFIP Wireless and Mobile Networking Conference (WMNC 2013), Dubai, United Arab Emirates, 23 - 25th April 2013}, booktitle = {Proceedings of the 6th Joint IFIP Wireless and Mobile Networking Conference (WMNC 2013), Dubai, United Arab Emirates, 23 - 25th April 2013}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-4673-5615-2}, pages = {72 -- 79}, language = {en} } @inproceedings{SchmerlRietzKoenig, author = {Schmerl, Sebastian and Rietz, Ren{\´e} and K{\"o}nig, Hartmut}, title = {Systematische Ableitung von Signaturen durch Wiederverwendung am Beispiel von Snort}, series = {Sicherheit 2008, Konferenzband der 4. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft f{\"u}r Informatik e.V.(GI), 2. - 4. April 2008 im Saarbr{\"u}cker Schloss}, booktitle = {Sicherheit 2008, Konferenzband der 4. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft f{\"u}r Informatik e.V.(GI), 2. - 4. April 2008 im Saarbr{\"u}cker Schloss}, editor = {Alkassar, Ammar}, publisher = {Ges. f{\"u}r Informatik}, address = {Bonn}, isbn = {978-3-88579-222-2}, pages = {367 -- 379}, language = {de} } @inproceedings{SchusterPaulRietzetal., author = {Schuster, Franka and Paul, Andreas and Rietz, Ren{\´e} and K{\"o}nig, Hartmut}, title = {Potentials of Using One-class SVM for Detecting Protocol-specific Anomalies in Industrial Networks}, series = {Proceedings of the 2015 IEEE Symposium on Computational Intelligence in Cyber Security (IEEE CICS 2015)}, booktitle = {Proceedings of the 2015 IEEE Symposium on Computational Intelligence in Cyber Security (IEEE CICS 2015)}, publisher = {IEEE Press}, address = {New York}, doi = {10.1109/SSCI.2015.22}, pages = {83 -- 90}, language = {en} } @inproceedings{GaeblerKoenig, author = {G{\"a}bler, Jan and K{\"o}nig, Hartmut}, title = {Distributed latency estimation using global knowledge for mobile collaborative applications}, series = {International Wireless Communications and Mobile Computing Conference (IWCMC) 2015, Dubrovnik, Croatia, 24-28 Aug. 2015}, booktitle = {International Wireless Communications and Mobile Computing Conference (IWCMC) 2015, Dubrovnik, Croatia, 24-28 Aug. 2015}, publisher = {IEEE}, doi = {10.1109/IWCMC.2015.7289130}, pages = {474 -- 479}, language = {en} } @inproceedings{KirscheKremmer, author = {Kirsche, Michael and Kremmer, Roman}, title = {uIP Support for the Network Simulation Cradle}, series = {Proceedings of the 2nd International OMNeT++ Community Summit (OMNeT 2015)}, booktitle = {Proceedings of the 2nd International OMNeT++ Community Summit (OMNeT 2015)}, abstract = {We introduce the ongoing integration of Contiki's uIP stack into the OMNeT++ port of the Network Simulation Cradle (NSC). The NSC utilizes code from real world stack implementations and allows for an accurate simulation and comparison of different TCP/IP stacks and a validation of thereby connected simulation models. uIP(v6) provides resource-constrained devices with an RFC-compliant TCP/IP stack and promotes the use of IPv6 in the vastly growing field of Internet of Things scenarios. This work-in-progress report discusses our motivation to integrate uIP into the NSC, our chosen approach and possible use cases for the simulation of uIP in OMNeT++.}, language = {en} } @inproceedings{OpitzTodtenbergKoenig, author = {Opitz, Stefanie Judith and Todtenberg, Nicole and K{\"o}nig, Hartmut}, title = {Mobile bandwidth prediction in the context of emergency medical service}, series = {Proceedings of the 7th International Conference on PErvasive Technologies Related to Assistive Environments (PETRA '14)}, booktitle = {Proceedings of the 7th International Conference on PErvasive Technologies Related to Assistive Environments (PETRA '14)}, publisher = {ACM}, address = {New York, NY}, isbn = {978-1-4503-2746-6}, doi = {10.1145/2674396.2674411}, language = {en} } @inproceedings{RietzVogelSchusteretal., author = {Rietz, Ren{\´e} and Vogel, Michael and Schuster, Franka and K{\"o}nig, Hartmut}, title = {Parallelization of Network Intrusion Detection Systems under Attack Conditions}, series = {Detection of Intrusions and Malware, and Vulnerability Assessment, 11th International Conference, DIMVA 2014, Egham, UK, July 10-11, 2014}, booktitle = {Detection of Intrusions and Malware, and Vulnerability Assessment, 11th International Conference, DIMVA 2014, Egham, UK, July 10-11, 2014}, editor = {Dietrich, Sven}, publisher = {Springer International Publishing}, address = {Cham}, isbn = {978-3-319-08508-1}, pages = {172 -- 191}, language = {en} } @inproceedings{MeierSchmerl, author = {Meier, Michael and Schmerl, Sebastian}, title = {Effiziente Analyseverfahren f{\"u}r Intrusion-Detection Systeme}, series = {Sicherheit 2005, Sicherheit, Schutz und Zuverl{\"a}ssigkei, 5. - 8. April 2005 in Regensburg, 2. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft f{\"u}r Informatik e.V.}, booktitle = {Sicherheit 2005, Sicherheit, Schutz und Zuverl{\"a}ssigkei, 5. - 8. April 2005 in Regensburg, 2. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft f{\"u}r Informatik e.V.}, editor = {Federrath, Hannes}, publisher = {Ges. f{\"u}r Informatik}, address = {Bonn}, isbn = {3-88579-391-1}, pages = {209 -- 220}, language = {de} } @misc{SchusterPaulKoenig, author = {Schuster, Franka and Paul, Andreas and K{\"o}nig, Hartmut}, title = {Messung der technischen IT-Sicherheit in Energieversorgungsanlagen zur Erf{\"u}llung des IT-Sicherheitsgesetzes}, series = {International Journal for Electricy and Heat Generation, VGB Powertech}, volume = {97}, journal = {International Journal for Electricy and Heat Generation, VGB Powertech}, number = {3}, issn = {1435-3199}, pages = {76 -- 82}, language = {de} } @inproceedings{SchusterPaulKoenig, author = {Schuster, Franka and Paul, Andreas and K{\"o}nig, Hartmut}, title = {Towards Learning Normality for Anomaly Detection in Industrial Control Networks}, series = {Proceedings of the 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security (AIMS 2013), Barcelona, Spain, June 25-28, 2013}, booktitle = {Proceedings of the 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security (AIMS 2013), Barcelona, Spain, June 25-28, 2013}, publisher = {Heidleberg}, address = {Berlin [u.a.]}, isbn = {978-3-642-38997-9}, pages = {61 -- 72}, language = {en} } @inproceedings{PaulSchusterKoenig, author = {Paul, Andreas and Schuster, Franka and K{\"o}nig, Hartmut}, title = {Towards the Protection of Industrial Control Systems - Conclusions of a Vulnerability Analysis of Profinet IO}, series = {Detection of Intrusions and Malware, and Vulnerability Assessment, 10th International Conference, DIMVA 2013, Berlin, Germany, July 18-19, 2013, proceedings}, booktitle = {Detection of Intrusions and Malware, and Vulnerability Assessment, 10th International Conference, DIMVA 2013, Berlin, Germany, July 18-19, 2013, proceedings}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {978-3-642-39234-4}, pages = {160 -- 176}, language = {en} } @inproceedings{Vogel, author = {Vogel, Michael}, title = {P2P-basierte Analyseverteilung f{\"u}r Intrusion Detection Systeme.}, series = {Proceedings of the 3rd GI Graduate Workshop on Reactive Security (SPRING), Mannheim, August 2008, SIDAR-Report SR-2008-01}, booktitle = {Proceedings of the 3rd GI Graduate Workshop on Reactive Security (SPRING), Mannheim, August 2008, SIDAR-Report SR-2008-01}, editor = {Flegel, Ulrich and Holz, Thorsten}, pages = {S. 12}, language = {de} } @inproceedings{SchusterPaulKoenig, author = {Schuster, Franka and Paul, Andreas and K{\"o}nig, Hartmut}, title = {A Distributed Intrusion Detection System for Industrial Automation Networks}, series = {Proceedings of the 17th International Conference on Emerging Technologies \& Factory Automation, Krakau, Polen, September 2012}, booktitle = {Proceedings of the 17th International Conference on Emerging Technologies \& Factory Automation, Krakau, Polen, September 2012}, publisher = {IEEE}, isbn = {978-1-4673-4736-5}, doi = {10.1109/ETFA.2012.6489703}, pages = {1 -- 4}, abstract = {Modern automation is measured in terms of interoperability and easy administration. Introducing technology focussing on these criteria, however, induce new security risks to existing and future automation installations. Current security approaches in automation do not keep pace with the rising security challenges. Prevalent in automation is the use of access control to protect the system from malicious activity, such as extern attacks. Means to inspect the automation traffic to identify attacks that already have overcome access control or are initiated from inside the automation system are not available, yet. For filling this gap, we investigate in the application of intrusion detection techniques on industrial automation. In this paper, we present the current state of an intrusion detection system tailored to the analysis of operation down to traffic between automation devices on field layer.}, language = {en} } @inproceedings{Paul, author = {Paul, Andreas}, title = {Verwundbarkeitsanalyse des Industrial-Ethernet Protokolls Profinet IO}, series = {Proceedings of the Seventh GI SIG SIDAR Graduate Workshop on Reactive Security (SPRING)}, booktitle = {Proceedings of the Seventh GI SIG SIDAR Graduate Workshop on Reactive Security (SPRING)}, editor = {Stewin, Patrick and Mulliner, Collin}, publisher = {GI FG SIDAR}, address = {Berlin}, pages = {S. 10}, language = {de} } @inproceedings{BrachmannGarciaMorchonKirsche, author = {Brachmann, Martina and Garcia-Morchon, Oscar and Kirsche, Michael}, title = {Security for Practical CoAP Applications: Issues and Solution Approaches}, series = {10. Fachgespr{\"a}ch Sensornetze der GI/ITG Fachgruppe Kommunikation und Verteilte Systeme, 15. - 16. September 2011}, booktitle = {10. Fachgespr{\"a}ch Sensornetze der GI/ITG Fachgruppe Kommunikation und Verteilte Systeme, 15. - 16. September 2011}, editor = {Frey, Hannes}, address = {Paderborn}, pages = {69 -- 72}, language = {en} } @inproceedings{KaliappanKoenig, author = {Kaliappan, Prabhu Shankar and K{\"o}nig, Hartmut}, title = {An Approach to Synchronize UML-basedDesign Components for Model-Driven Protocol Development}, series = {Proceedings, 2011 34th IEEE Software Engineering Workshop, 20-21 June 2011, Limerick, Ireland}, booktitle = {Proceedings, 2011 34th IEEE Software Engineering Workshop, 20-21 June 2011, Limerick, Ireland}, publisher = {IEEE}, address = {Los Alamitos, Calif.}, isbn = {978-1-4673-0245-6}, pages = {27 -- 35}, language = {en} } @inproceedings{Kaliappan, author = {Kaliappan, Prabhu Shankar}, title = {Uncertainty, Protocol Behavior Prediction Through Chaos Theory?}, series = {2011 International Conference on Uncertainty Reasoning and Knowledge Engineering, Bali, Indonesia 4-7 August 2011, Vol. 1}, booktitle = {2011 International Conference on Uncertainty Reasoning and Knowledge Engineering, Bali, Indonesia 4-7 August 2011, Vol. 1}, publisher = {IEEE}, isbn = {978-1-4244-9985-4}, pages = {20 -- 24}, language = {en} } @misc{WichtlhuberStrehleKoppetal., author = {Wichtlhuber, Matthias and Strehle, Eric and Kopp, Daniel and Prepens, Lars and Stegmueller, Stefan and Rubina, Alina and Dietzel, Christoph and Hohlfeld, Oliver}, title = {IXP Scrubber: Learning from Blackholing Traffic for ML-Driven DDoS Detection at Scale}, series = {ACM SIGCOMM 2022 Conference, 2022}, journal = {ACM SIGCOMM 2022 Conference, 2022}, pages = {707 -- 722}, abstract = {Distributed Denial of Service (DDoS) attacks are among the most critical cybersecurity threats, jeopardizing the stability of even the largest networks and services. The existing range of mitigation services predominantly filters at the edge of the Internet, thus creating unnecessary burden for network infrastructures. Consequently, we present IXP Scrubber, a Machine Learning (ML) based system for detecting and filtering DDoS traffic at the core of the Internet at Internet Exchange Points (IXPs) which see large volumes and varieties of DDoS. IXP Scrubber continuously learns DDoS traffic properties from neighboring Autonomous Systems (ASes). It utilizes BGP signals to drop traffic for certain routes (blackholing) to sample DDoS and can thus learn new attack vectors without the operator's intervention and on unprecedented amounts of training data. We present three major contributions: i) a method to semi-automatically generate arbitrarily large amounts of labeled DDoS training data from IXPs' sampled packet traces, ii) the novel, controllable, locally explainable and highly precise two-step IXP Scrubber ML model, and iii) an evaluation of the IXP Scrubber ML model, including its temporal and geographical drift, based on data from 5 IXPs covering a time span of up to two years.}, language = {en} } @incollection{Koenig, author = {K{\"o}nig, Hartmut}, title = {Zur Entwicklung der Module "Grundlagen der Rechnernetze" und "High Performance Communication - Multimedia"}, language = {de} } @inproceedings{Schmerl, author = {Schmerl, Sebastian}, title = {Verifikation von Signaturen - Spezifikationsfehlern auf der Spur}, series = {Proceedings of the 3rd GI Graduate Workshop on Reactive Security (SPRING)}, booktitle = {Proceedings of the 3rd GI Graduate Workshop on Reactive Security (SPRING)}, editor = {Flegel, Ulrich and Holz, Thorsten}, address = {Mannheim}, pages = {S. 15}, language = {de} } @inproceedings{KirscheKlauck, author = {Kirsche, Michael and Klauck, Ronny}, title = {Unify to Bridge Gaps: Bringing XMPP into the Internet of Things}, series = {2012 IEEE International Conference on Pervasive Computing and Communications (PerCom 2012), Lugano, Switzerland, 19 - 23 March 2012}, booktitle = {2012 IEEE International Conference on Pervasive Computing and Communications (PerCom 2012), Lugano, Switzerland, 19 - 23 March 2012}, publisher = {Institute of Electrical and Electronics Engineers (IEEE )}, address = {Piscataway, NJ}, isbn = {978-1-467-30256-2}, pages = {455 -- 458}, language = {en} } @misc{MehnerSchusterHohlfeld, author = {Mehner, Stefan and Schuster, Franka and Hohlfeld, Oliver}, title = {Lights on Power Plant Control Networks}, series = {Passive and Active Measurement : 23rd International Conference, PAM 2022, Virtual Event, March 28-30, 2022, Proceedings}, journal = {Passive and Active Measurement : 23rd International Conference, PAM 2022, Virtual Event, March 28-30, 2022, Proceedings}, publisher = {Springer}, isbn = {978-3-030-98784-8}, issn = {0302-9743}, doi = {10.1007/978-3-030-98785-5_21}, pages = {470 -- 484}, abstract = {Industrial Control Systems (ICS) are critical systems to our society. Yet they are less studied given their closed nature and often the unavailability of data. While few studies focus on wide-area SCADA systems, e.g., power or gas distribution networks, mission critical networks that control power generation are not yet studied. To address this gap, we perform the first measurement study of Distributed Control System (DCS) by analyzing traces from all network levels from several operational power plants. We show that DCS networks feature a rather rich application mix compared to wide-area SCADA networks and that applications and sites can be fingerprinted with statistical means. While traces from operational power plants are hard to obtain, we analyze to which extent easier to access training facilities can be used as vantage points. Our study aims to shed light on traffic properties of critical industries that were not yet analyzed given the lack of data.}, language = {en} } @misc{ReelfsHohlfeldHenckell, author = {Reelfs, Jens Helge and Hohlfeld, Oliver and Henckell, Niklas}, title = {Geographic Differences in Social Media Interactions Exist Between Western and Middle-East Countries}, series = {Passive and Active Measurement Conference 2022}, journal = {Passive and Active Measurement Conference 2022}, publisher = {Springer}, address = {Cham}, isbn = {978-3-030-98785-5}, doi = {10.1007/978-3-030-98785-5_18}, pages = {411 -- 425}, abstract = {In this paper, we empirically analyze two examples of a Western (DE) versus Middle-East (SA) Online Social Messaging App. By focusing on the system interactions over time in comparison, we identify inherent differences in user engagement. We take a deep dive and shed light onto differences in user attention shifts and showcase their structural implications to the user experience. Our main findings show that in comparison to the German counterparts, the Saudi communities prefer creating content in longer conversations, while voting more conservative.}, language = {en} } @misc{ReelfsMohauptSikdaretal., author = {Reelfs, Jens Helge and Mohaupt, Timon and Sikdar, Sandipan and Strohmaier, Markus and Hohlfeld, Oliver}, title = {Interpreting Emoji with Emoji: 🏖️ => ☀️😎🌊}, series = {5th International Workshop on Emoji Understanding and Applications in Social Media 2022}, journal = {5th International Workshop on Emoji Understanding and Applications in Social Media 2022}, pages = {10}, abstract = {We study the extent to which emoji can be used to add interpretability to embeddings of text and emoji. To do so, we extend the POLAR-framework that transforms word embeddings to interpretable counterparts and apply it to word-emoji embeddings trained on four years of messaging data from the Jodel social network. We devise a crowdsourced human judgement experiment to study six usecases, evaluating against words only, what role emoji can play in adding interpretability to word embeddings. That is, we use a revised POLAR approach interpreting words and emoji with words, emoji or both according to human judgement. We find statistically significant trends demonstrating that emoji can be used to interpret other emoji very well.}, language = {en} } @misc{ReelfsHohlfeldHenckell, author = {Reelfs, Jens Helge and Hohlfeld, Oliver and Henckell, Niklas}, title = {Anonymous Hyperlocal Communities: What do they talk about?}, series = {12th International Workshop on Location and the Web (LocWeb'22)}, journal = {12th International Workshop on Location and the Web (LocWeb'22)}, doi = {10.48550/arXiv.2203.05657}, pages = {9}, abstract = {In this paper, we study what users talk about in a plethora of independent hyperlocal and anonymous online communities in a single country: Saudi Arabia (KSA). We base this perspective on performing a content classification of the Jodel network in the KSA. To do so, we first contribute a content classification schema that assesses both the intent (why) and the topic (what) of posts. We use the schema to label 15k randomly sampled posts and further classify the top 1k hashtags. We observe a rich set of benign (yet at times controversial in conservative regimes) intents and topics that dominantly address information requests, entertainment, or dating/flirting. By comparing two large cities (Riyadh and Jeddah), we further show that hyperlocality leads to shifts in topic popularity between local communities. By evaluating votes (content appreciation) and replies (reactions), we show that the communities react differently to different topics; e.g., entertaining posts are much appreciated through votes, receiving the least replies, while beliefs \& politics receive similarly few replies but are controversially voted.}, language = {en} } @misc{KunzeRuethHohlfeld, author = {Kunze, Ike and R{\"u}th, Jan and Hohlfeld, Oliver}, title = {Congestion Control in the Wild - Investigating Content Provider Fairness}, series = {IEEE Transactions on Network and Service Management}, volume = {17}, journal = {IEEE Transactions on Network and Service Management}, number = {2}, issn = {1932-4537}, doi = {10.1109/TNSM.2019.2962607}, pages = {1224 -- 1238}, abstract = {Congestion control (CC) is an indispensable com-ponent of transport protocols to prevent congestion collapseas it distributes the available bandwidth among all competingflows, ideally in a fair manner. It thus has a large impact onperformance and there exists a constantly evolving set of CCalgorithms, each addressing different performance needs. Whilethe algorithms are commonly tested regarding the problemsunderlying their implementation, the interaction with existingalgorithms is often not considered. Additionally considering thefact that content providers (CPs) such as content distributionnetworks (CDNs) are known to tune TCP stacks for performancegains, the large assortment of algorithms opens the door for cus-tom parametrization and potentially unfair bandwidth sharing.In this paper, we thus empirically investigate if current Internettraffic generated by CPs still adheres to the conventional under-standing of fairness. For this, we compare fairness propertiesof testbed hosts to actual traffic of six major CPs subject todifferent queue sizes and queueing disciplines in a home-usersetting. Additionally, we investigate how mice and elephant flowsfrom the different CPs interact. We find that some employedCC algorithms lead to significantly asymmetric bandwidth sharesand very poor flow completion times for mice flows. Fortunately,AQMs such as FQ_CoDel are able to alleviate such unfairness.}, language = {en} } @misc{HolzHillerAmannetal., author = {Holz, Ralph and Hiller, Jens and Amann, Johanna and Razaghpanah, Abbas and Jost, Thomas and Vallina-Rodriguez, Narseo and Hohlfeld, Oliver}, title = {Tracking the deployment of TLS 1.3 on the Web: A story of experimentation and centralization}, series = {ACM SIGCOMM Computer Communication Review}, volume = {50}, journal = {ACM SIGCOMM Computer Communication Review}, number = {3}, issn = {0146-4833}, doi = {10.1145/3411740.3411742}, pages = {12}, language = {en} } @inproceedings{SchmerlFlegelMeier, author = {Schmerl, Sebastian and Flegel, Ulrich and Meier, Michael}, title = {Vereinfachung der Signaturentwicklung durch Wiederverwendung}, editor = {Dittmann, Jana}, language = {de} } @misc{MisaGuseHohlfeldetal., author = {Misa, Chris and Guse, Dennis and Hohlfeld, Oliver and Durairajan, Ramakrishnan and Sperotto, Anna and Dainotti, Alberto and Rejaie, Reza}, title = {Lessons Learned Organizing the PAM 2020 Virtual Conference}, series = {ACM SIGCOMM Computer Communication Review}, volume = {50}, journal = {ACM SIGCOMM Computer Communication Review}, number = {3}, issn = {0146-4833}, doi = {10.1145/3411740.3411747}, pages = {9}, language = {en} } @misc{HohlfeldGuseDeMoor, author = {Hohlfeld, Oliver and Guse, Dennis and De Moor, Katrien}, title = {A Questionnaire to Assess Virtual Conference Participation Experience}, series = {2021 Thirteenth International Conference on Quality of Multimedia Experience (QoMEX)}, journal = {2021 Thirteenth International Conference on Quality of Multimedia Experience (QoMEX)}, publisher = {IEEE}, isbn = {978-1-6654-3589-5}, issn = {2472-7814}, doi = {10.1109/QoMEX51781.2021.9465406}, pages = {4}, abstract = {This tools track paper presents the design of a questionnaire methodology to assess the participants experience of virtual conferences. This survey approach consists of a preconference questionnaire assessing participation goals and expectations and a post-conference questionnaire assessing the actual participation and related experiences. It enables a data-driven investigation of participants' expectations, goals, attitudes, actual experiences, and general feedback about virtual conferences. As such, it can help to better understand how virtual conference experiences can be improved in the future and how the virtual format can become a more attractive alternative, also in non-pandemic times. The questionnaire was used at three conferences and two workshops. Despite a missing validation, we released it early to foster research on virtual conferences.}, language = {en} } @misc{WagnerKoppWichtlhuberetal., author = {Wagner, Daniel and Kopp, Daniel and Wichtlhuber, Matthias and Dietzel, Christoph and Hohlfeld, Oliver and Smaragdakis, Georgios and Feldmann, Anja}, title = {United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale}, series = {ACM CCS 2021 - November 15-19, Virtual Conference}, journal = {ACM CCS 2021 - November 15-19, Virtual Conference}, doi = {10.1145/3460120.3485385}, language = {en} } @inproceedings{SchmerlVogelRietzetal., author = {Schmerl, Sebastian and Vogel, Michael and Rietz, Ren{\´e} and K{\"o}nig, Hartmut}, title = {Explorative Visualization of Log Data to Support Forensic Analysis and Signature Development}, series = {2010 Fifth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE 2010), Oakland, California, USA, 20 May 2010}, booktitle = {2010 Fifth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE 2010), Oakland, California, USA, 20 May 2010}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-424-47220-8}, pages = {109 -- 118}, language = {en} } @misc{KoppStrehleHohlfeld, author = {Kopp, Daniel and Strehle, Eric and Hohlfeld, Oliver}, title = {CyberBunker 2.0 - A Domain and Traffic Perspective on a Bullet Proof Hoster}, series = {CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021}, journal = {CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021}, doi = {10.1145/3460120.3485352}, pages = {3}, language = {en} } @inproceedings{Kirsche, author = {Kirsche, Michael}, title = {IEEE 802.15.4 Performance Analysis}, series = {Modeling and tools for network simulation}, booktitle = {Modeling and tools for network simulation}, editor = {Wehrle, Klaus}, isbn = {978-3-642-12330-6}, pages = {317 -- 325}, language = {en} } @misc{HasslingerNtougiasHasslingeretal., author = {Hasslinger, Gerhard and Ntougias, Konstantinos and Hasslinger, Frank and Hohlfeld, Oliver}, title = {Fast and Efficient Web Caching Methods Regarding the Size and Performance Measures per Data Object}, series = {2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 11-13 Sept. 2019, Limassol, Cyprus}, journal = {2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 11-13 Sept. 2019, Limassol, Cyprus}, publisher = {IEEE}, isbn = {978-1-7281-1016-5}, issn = {2378-4873}, doi = {10.1109/CAMAD.2019.8858459}, pages = {7}, abstract = {Caching methods are developed since 50 years for paging in CPU and database systems, and since 25 years for web caching as main application areas among others. Pages of unique size are usual in CPU caches, whereas web caches are storing data chunks of different size in a widely varying range. We study the impact of different object sizes on the performance and the overhead of web caching. This entails different caching goals, starting from the byte and object hit ratio to a generalized value hit ratio for optimized costs and benefits of caching regarding traffic engineering (TE), reduced delays and other QoS measures. The selection of the cache contents turns out to be crucial for the web cache efficiency with awareness of the size and other properties in a score for each object. We introduce a new class of rank exchange caching methods and show how their performance compares to other strategies with extensions needed to include the size and scores for QoS and TE caching goals. Finally, we derive bounds on the object, byte and value hit ratio for the independent request model (IRM) based on optimum knapsack solutions of the cache content.}, language = {en} } @misc{VallinaLePochatFealetal., author = {Vallina, Pelayo and Le Pochat, Victor and Feal, {\´A}lvaro and Paraschiv, Marius and Gamba, Julien and Burke, Tim and Hohlfeld, Oliver and Tapiador, Juan and Vallina-Rodriguez, Narseo}, title = {Mis-shapes, Mistakes, Misfits: An Analysis of Domain Classification Services}, series = {ACM Internet Measurement Conference 2020, IMC '20, October 27-29, 2020, Virtual Event, USA}, journal = {ACM Internet Measurement Conference 2020, IMC '20, October 27-29, 2020, Virtual Event, USA}, isbn = {978-1-4503-8138-3}, doi = {10.1145/3419394.3423660}, pages = {598 -- 618}, abstract = {Domain classification services have applications in multiple areas,including cybersecurity, content blocking, and targeted advertising.Yet, these services are often a black box in terms of their method-ology to classifying domains, which makes it difficult to assesstheir strengths, aptness for specific applications, and limitations. Inthis work, we perform a large-scale analysis of 13 popular domainclassification services on more than 4.4M hostnames. Our studyempirically explores their methodologies, scalability limitations,label constellations, and their suitability to academic research aswell as other practical applications such as content filtering. Wefind that the coverage varies enormously across providers, rangingfrom over 90\% to below 1\%. All services deviate from their docu-mented taxonomy, hampering sound usage for research. Further,labels are highly inconsistent across providers, who show littleagreement over domains, making it difficult to compare or combinethese services. We also show how the dynamics of crowd-sourcedefforts may be obstructed by scalability and coverage aspects aswell as subjective disagreements among human labelers. Finally,through case studies, we showcase that most services are not fitfor detecting specialized content for research or content-blockingpurposes. We conclude with actionable recommendations on theirusage based on our empirical insights and experience. Particularly,we focus on how users should handle the significant disparitiesobserved across services both in technical solutions and in research.}, language = {en} } @misc{FeldmannGasserLichtblauetal., author = {Feldmann, Anja and Gasser, Oliver and Lichtblau, Franziska and Pujol, Enric and Poese, Ingmar and Dietzel, Christoph and Wagner, Daniel and Wichtlhuber, Matthias and Tapiador, Juan and Vallina-Rodriguez, Narseo and Hohlfeld, Oliver and Smaragdakis, Georgios}, title = {The Lockdown Effect: Implications of the COVID-19 Pandemic on Internet Traffic}, series = {ACM Internet Measurement Conference 2020, Proceedings of the 2020 Internet Measurement Conference (IMC '20)}, journal = {ACM Internet Measurement Conference 2020, Proceedings of the 2020 Internet Measurement Conference (IMC '20)}, doi = {10.1145/3419394.3423658}, pages = {18}, abstract = {Due to the COVID-19 pandemic, many governments imposed lock downs that forced hundreds of millions of citizens to stay at home. The implementation of confinement measures increased Internet traffic demands of residential users, in particular, for remote working, entertainment, commerce, and education, which, as a result, caused traffic shifts in the Internet core. In this paper, using data from a diverse set of vantage points (one ISP, three IXPs, and one metropolitan educational network), we examine the effect of these lockdowns on traffic shifts. We find that the traffic volume increased by 15-20\% almost within a week--while overall still modest, this constitutes a large increase within this short time period. However, despite this surge, we observe that the Internet infrastructure is able to handle the new volume, as most traffic shifts occur outside of traditional peak hours. When looking directly at the traffic sources, it turns out that, while hypergiants still contribute a significant fraction of traffic, we see (1) a higher increase in traffic of non-hypergiants, and (2) traffic increases in applications that people use when at home, such as Web conferencing, VPN, and gaming. While many networks see increased traffic demands, in particular, those providing services to residential users, academic networks experience major overall decreases. Yet, in these networks, we can observe substantial increases when considering applications associated to remote working and lecturing.}, language = {en} } @inproceedings{SchmerlVogelKoenig, author = {Schmerl, Sebastian and Vogel, Michael and K{\"o}nig, Hartmut}, title = {Cooperating Intrusion Detection Overlay Structures}, series = {4th GI/ITG KuVS Workshop on Future Internet and 2nd Workshop on Economic Traffic Management (ETM), Z{\"u}rich, Switzerland, 9 - 10. November 2009}, booktitle = {4th GI/ITG KuVS Workshop on Future Internet and 2nd Workshop on Economic Traffic Management (ETM), Z{\"u}rich, Switzerland, 9 - 10. November 2009}, language = {en} } @inproceedings{SchmerlVogelKoenig, author = {Schmerl, Sebastian and Vogel, Michael and K{\"o}nig, Hartmut}, title = {Identifying Modeling Errors in Signatures by Model Checking.}, language = {en} } @inproceedings{KlauckKirsche, author = {Klauck, Ronny and Kirsche, Michael}, title = {Integrating P2PSIP into Collaborative P2P Applications: A Case Study with the P2P Videoconferencing System BRAVIS}, series = {Proceedings of the 5th International ICST Conference on Collaborative Computing: Networking, Applications and Worksharing, CollaborateCom, 11 - 14 November 2009, Crystal City, Washington D.C., USA}, booktitle = {Proceedings of the 5th International ICST Conference on Collaborative Computing: Networking, Applications and Worksharing, CollaborateCom, 11 - 14 November 2009, Crystal City, Washington D.C., USA}, isbn = {978-963-979976-9}, language = {en} } @book{Klauck, author = {Klauck, Ronny}, title = {Integration von P2PSIP in eine kollaborative Anwendung: Am Beispiel des P2P-Videokonferenzsystems BRAVIS}, publisher = {Saarbr{\"u}cken : VDM Verl. Dr. M{\"u}ller}, isbn = {978-3-639-36714-0}, language = {de} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Efficient Key Distribution for ClosedMeetings in the Internet}, series = {Communications and Multimedia Security, 9th IFIP TC-6 TC-11 International Conference, CMS 2005, Salzburg, Austria, September 19 - 21, 2005}, booktitle = {Communications and Multimedia Security, 9th IFIP TC-6 TC-11 International Conference, CMS 2005, Salzburg, Austria, September 19 - 21, 2005}, editor = {Dittmann, Jana}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-28791-4}, pages = {271 -- 272}, language = {en} } @misc{MehnerKoenig, author = {Mehner, Stefan and K{\"o}nig, Hartmut}, title = {No Need to Marry to Change Your Name! Attacking Profinet IO Automation Networks Using DCP}, series = {Detection of Intrusions and Malware, and Vulnerability Assessment 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19-20, 2019, Proceedings}, journal = {Detection of Intrusions and Malware, and Vulnerability Assessment 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19-20, 2019, Proceedings}, editor = {Perdisci, Roberto and Maurice, Cl{\´e}mentine and Giacinto, Giorgio and Almgren, Magnus}, publisher = {Springer}, isbn = {978-3-030-22037-2}, doi = {10.1007/978-3-030-22038-9_19}, pages = {396 -- 414}, abstract = {Current developments in digitization and industry 4.0 bear new challenges for automation systems. In order to enable interoperability and vertical integration of corporate management systems, these networks have evolved from formerly proprietary solutions to the application of Ethernet-based communication and internet standards. This development is accompanied by an increase in the number of threats. Although the most critical IT protection objective for automation systems is availability, usually no security mechanisms have been integrated into automation protocols. Also Ethernet offers no protection by design for these protocols. One of the most popular real-time protocols for industrial applications is Profinet IO. In this paper, we describe a Denial-of-Service attack on Profinet IO that exploits a vulnerability in the Discovery and Basic Configuration Protocol (DCP) which interrupts the Application Relationship between an IO Controller and an IO Device, and thus prevents the system from being repaired by the operator. The attack combines port stealing with the sending of forged DCP packets and causes a system downtime, which in affected production networks probably lead to a serious financial damage and, in case of critical infrastructures, even represents a high risk for the supply of society. We demonstrate the practical feasibility of the attack using realistic hardware and scenarios and discuss its significance for also other setups.}, language = {en} } @misc{BoehmKoenig, author = {B{\"o}hm, Sebastian and K{\"o}nig, Hartmut}, title = {SEmulate: Seamless Network Protocol Simulation and Radio Channel Emulation for Wireless Sensor Networks}, series = {15th Annual Conference on Wireless On-demand Network Systems and Services (WONS), 22-24 Jan. 2019, Wengen, Switzerland.}, journal = {15th Annual Conference on Wireless On-demand Network Systems and Services (WONS), 22-24 Jan. 2019, Wengen, Switzerland.}, publisher = {IEEE}, isbn = {978-3-903176-13-3}, doi = {10.23919/WONS.2019.8795495}, pages = {8}, abstract = {Low-rate and low-power wireless communications are still the main drivers for innovative industrial automation and the Internet of Things (IoT). Physical mobility is one of the most important challenges for them. Common wireless technologies and protocols, e.g., WirelessHART and ISA100.11a Wireless for industrial process plants, ZigBee for building automation, or 6LoWPAN and 6TiSCH in context of the IoT, are based on the IEEE 802.15.4 standard. Event-based simulation is the method of choice for analyzing network protocols and algorithmic applications of such distributed sensor applications. Performance measurements and holistic evaluations, however, are greatly influenced by the underlying hardware resources, physical layer protocols, and radio channel conditions, which are usually not considered or highly abstracted in network simulations. In this paper we present SEmulate, a hybrid system for seamless (network) simulation and hardware-based emulation for wireless sensor networks based on the IEEE 802.15.4 protocol standard, which takes the hardware aspects into account by applying an Hardware-in-the-Loop (HIL) approach.}, language = {en} } @inproceedings{LiuKoenig, author = {Liu, Fuwen and K{\"o}nig, Hartmut}, title = {Puzzle - A Novel Video Encryption Algorithm}, editor = {Dittmann, Jana and Katzenbeisser, Stefan and Uhl, Andreas}, isbn = {3-540-28791-4}, language = {en} } @misc{RuethKunzeHohlfeld, author = {R{\"u}th, Jan and Kunze, Ike and Hohlfeld, Oliver}, title = {An Empirical View on Content Provider Fairness}, series = {Proceedings of the Network Traffic Measurement and Analysis Conference (TMA '19), June 17-21, 2019, Paris, France}, journal = {Proceedings of the Network Traffic Measurement and Analysis Conference (TMA '19), June 17-21, 2019, Paris, France}, publisher = {IFIP/IEEE}, doi = {10.23919/TMA.2019.8784684}, language = {en} } @misc{KoppWichtlhuberPoeseetal., author = {Kopp, Daniel and Wichtlhuber, Matthias and Poese, Ingmar and Cardoso de Santanna, Jos{\´e} Jair and Hohlfeld, Oliver and Dietzel, Christoph}, title = {DDoS Hide \& Seek: On the Effectiveness of a Booter Services Takedown}, series = {Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, Netherlands — October 21 - 23, 2019}, journal = {Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, Netherlands — October 21 - 23, 2019}, publisher = {ACM}, address = {New York, NY, USA}, isbn = {978-1-4503-6948-0}, doi = {10.1145/3355369.3355590}, pages = {65 -- 72}, language = {en} } @misc{RuethWolsingWehrleetal., author = {R{\"u}th, Jan and Wolsing, Konrad and Wehrle, Klaus and Hohlfeld, Oliver}, title = {Perceiving QUIC: Do Users Notice or Even Care?}, series = {CoNEXT '19: International Conference On Emerging Networking Experiments And Technologies, December 9-12, 2019, Orlando, FL, USA. ACM, New York, NY, USA}, journal = {CoNEXT '19: International Conference On Emerging Networking Experiments And Technologies, December 9-12, 2019, Orlando, FL, USA. ACM, New York, NY, USA}, publisher = {ACM}, address = {New York, NY, USA}, doi = {10.1145/3359989.3365416}, pages = {7}, language = {en} } @inproceedings{ZuehlkeKoenig, author = {Z{\"u}hlke, Mario and K{\"o}nig, Hartmut}, title = {A Signalling Protocol for Small Closed Dynamic Multi-peer Groups}, series = {High speed networks and multimedia communications, 7th IEEE international conference, HSNMC 2004, Toulouse, France, June 30 - July 2, 2004, proceedings}, booktitle = {High speed networks and multimedia communications, 7th IEEE international conference, HSNMC 2004, Toulouse, France, June 30 - July 2, 2004, proceedings}, editor = {Mammeri, Zoubir}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-22262-6}, pages = {973 -- 984}, language = {en} } @inproceedings{MeierSchmerlKoenig, author = {Meier, Michael and Schmerl, Sebastian and K{\"o}nig, Hartmut}, title = {Improving the efficiency of misuse detection}, series = {Detection of intrusions and malware, and vulnerability assessment, second international conference, DIMVA 2005, Vienna, Austria, July 7-8, 2005, proceedings}, booktitle = {Detection of intrusions and malware, and vulnerability assessment, second international conference, DIMVA 2005, Vienna, Austria, July 7-8, 2005, proceedings}, editor = {Julisch, Klaus}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-26613-5}, pages = {S. 188}, language = {en} } @inproceedings{PopoviciMahloZuehlkeetal., author = {Popovici, Eduard and Mahlo, Ralf and Z{\"u}hlke, Mario and K{\"o}nig, Hartmut}, title = {Consistency Support for a Decentralized Management in Closed Multiparty Conferences Using SIP}, language = {en} } @misc{OPUS4-8770, title = {Network Attack Detection and Defense Early Warning Systems - Challenges and Perspectives}, editor = {Carle, Georg and Debar, Herv{\´e} and Dressler, Falko and K{\"o}nig, Hartmut}, publisher = {DROPS}, address = {Schloss Dagstuhl}, doi = {10.4230/DagRep.2.2.1}, url = {http://nbn-resolving.de/urn:nbn:de:0030-drops-34761}, abstract = {The increasing dependence of human society on information technology (IT) systems requires appropriate measures to cope with their misuse. The growing potential of threats, which make these systems more and more vulnerable, is caused by the complexity of the technologies themselves. The potential of threats in networked systems will further grow as well as the number of individuals who are able to abuse these systems. It becomes increasingly apparent that IT security cannot be achieved by prevention alone. Preventive measures and reactive aspects need to complement one another. A major challenge of modern IT security technologies is to cope with an exploding variability of attacks which stems from a significant commercial motivation behind them. Increasingly proactive measures are required to ward off these threats. Increased efforts in research and society are required to protect critical civil infrastructures, such as the health care system, the traffic system, power supply, trade, military networks, and others in developed countries. This is a consequence of the increasing shift of industrial IT systems to the IP protocol leading to sensible IT infrastructures which are more vulnerable as the proprietary systems used in the past. The abundance of services of modern infrastructures critically depends on information and communication technologies. Though, being key enablers of critical infrastructures, these technologies are, at the same time, reckoned among the most vulnerable elements of the whole system. The cooperative information exchange between institutions is mandatory in order to detect distributed and coordinated attacks. Based on a large-scale acquisition of pertinent information, Early Warning Systems are a currently pursued approach to draw up situation pictures that allows the detection of trends and upcoming threats, allowing furthermore taking appropriate measures. The Dagstuhl seminar brought together researchers from academia and industry. The objective of the seminar was to further discuss challenges and methods in the area of attack detection and defense. The seminar was supposed to focus on design aspects of early warning systems and related monitoring infrastructures, e.g., intrusion detection overlays, to protect computer systems, networks, and critical infrastructures. The seminar was jointly organized by Georg Carle, Herv{\´e} Debar, Hartmut K{\"o}nig, and Jelena Mirkovic. It was attended by 34 participants from nine countries.}, language = {en} } @misc{GaeblerKoenig, author = {G{\"a}bler, Jan and K{\"o}nig, Hartmut}, title = {Moversight: An Approach to Support Mobility in Collaborative Applications}, publisher = {IEEE}, isbn = {978-1-4799-0747-2}, pages = {110 -- 112}, language = {en} } @misc{OPUS4-17925, title = {Proceedings of the 3rd International OMNeT++ Community Summit (OMNeT 2016), Brno University of Technology, Czech Republic, September 15-16, 2016}, editor = {F{\"o}rster, Anna and Vesel{\´y}, Vladim{\´i}r and Virdis, Antonio and Kirsche, Michael}, publisher = {Brno University of Technology, Czech Republic}, address = {Brno}, language = {en} } @misc{OPUS4-14954, title = {Proceedings of the 2nd International OMNeT++ Community Summit (OMNeT 2015), Zurich, Switzerland on September 3-4, 2015}, editor = {F{\"o}rster, Anna and Minkenberg, Cyriel and Herrera, German Rodriguez and Kirsche, Michael}, language = {en} } @misc{OPUS4-20972, title = {Proceedings of the 4th OMNeT++ Community Summit, University of Bremen - Germany, September 7-8, 2017}, editor = {F{\"o}rster, Anna and Udugama, Asanga and K{\"o}nsgen, Andreas and Virdis, Antonio and Kirsche, Michael}, publisher = {arXiv}, language = {en} } @misc{KirscheHartwig, author = {Kirsche, Michael and Hartwig, Jonas}, title = {A 6LoWPAN Model for OMNeT++}, isbn = {978-1-4503-2464-9}, pages = {330 -- 333}, language = {en} } @misc{KlauckKirscheGaebleretal., author = {Klauck, Ronny and Kirsche, Matthias and G{\"a}bler, Jan and Sch{\"o}pke, Sebastian}, title = {Mobile XMPP and Cloud Service Collaboration: An Alliance for Flexible Disaster Management}, series = {7th International Conference on Collaborative Computing, Networking, Applications and Worksharing (CollaborateCom 2011), Orlando, Florida, USA, 15 - 18 October 2011}, journal = {7th International Conference on Collaborative Computing, Networking, Applications and Worksharing (CollaborateCom 2011), Orlando, Florida, USA, 15 - 18 October 2011}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-467-30683-6}, pages = {201 -- 211}, language = {en} } @book{LaPortaRamjeeKoenig, author = {La Porta, Tom and Ramjee, Ram and K{\"o}nig, Hartmut}, title = {Proceedings of the 12th IEEE International Conference on Network Protocols, ICNP 2004 : 4 - 8 October 2004, Berlin, Germany}, publisher = {Los Alamitos, Calif. [u.a.] : IEEE Computer Society}, isbn = {0-7695-2161-4}, language = {en} } @misc{MeierFlegelSchmerl, author = {Meier, Michael and Flegel, Ulrich and Schmerl, Sebastian}, title = {Efficiency Issues of Rete-based, Expert Systems for Misuse Detection}, series = {Proceedings, Twenty-Third Annual Computer Security Applications Conference, ACSAC 2007, 10 - 14 December 2007, Miami Beach, Florida}, journal = {Proceedings, Twenty-Third Annual Computer Security Applications Conference, ACSAC 2007, 10 - 14 December 2007, Miami Beach, Florida}, publisher = {IEEE Computer Society}, address = {Los Alamitos, Calif.}, isbn = {978-0-7695-3060-4}, pages = {151 -- 160}, language = {en} } @phdthesis{Liu, author = {Liu, Fuwen}, title = {A security architecture for a peer-to-peer video conference system}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus-445}, language = {en} } @article{LangendoerferKraemerKoenig, author = {Langend{\"o}rfer, Peter and Kraemer, Rolf and K{\"o}nig, Hartmut}, title = {Evaluation of Well-Known Protocol Implementation Techniques for Application in Wireless Networks}, series = {The Journal of Supercomputing}, volume = {20}, journal = {The Journal of Supercomputing}, number = {2}, issn = {0920-8542}, pages = {161 -- 173}, language = {en} } @article{OpitzKoenigSzamlewska, author = {Opitz, Alek and K{\"o}nig, Hartmut and Szamlewska, Sebastian}, title = {What Does Grid Computing Cost?}, language = {en} } @article{LiuKoenigWang, author = {Liu, Fuwen and K{\"o}nig, Hartmut and Wang, W.}, title = {Designing a Security Architecture for a P2P Video Conference System}, language = {en} } @misc{OPUS4-2328, title = {Formal techniques for networked and distribution systems - FORTE 2003}, editor = {K{\"o}nig, Hartmut and Heiner, Monika and Wolisz, Adam}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {3-540-20175-0}, pages = {XII, 429}, language = {en} } @book{Koenig, author = {K{\"o}nig, Hartmut}, title = {Protocol Engineering}, publisher = {Springer}, address = {Berlin [u.a.]}, isbn = {978-3-642-29144-9}, pages = {XV, 525}, language = {en} } @misc{GuseHohlfeldWunderlichetal., author = {Guse, Dennis and Hohlfeld, Oliver and Wunderlich, Anna and Weiss, Benjamin and M{\"o}ller, Sebastian}, title = {Multi-episodic Perceived Quality of an Audio-on-Demand Service}, series = {2020 Twelfth International Conference on Quality of Multimedia Experience (QoMEX)}, journal = {2020 Twelfth International Conference on Quality of Multimedia Experience (QoMEX)}, isbn = {978-1-7281-5965-2}, issn = {2472-7814}, doi = {10.1109/QoMEX48832.2020.9123070}, pages = {6}, abstract = {Quality of Experience is traditionally evaluated byusing short stimuli usually representing parts orsingleusageepisodes. This opens the question on how the overall serviceperception involvingmultipleusage episodes can be evaluated—a question of high practical relevance to service operators.Despite initial research on this challenging aspect of multi-episodic perceived quality, the question of the underlying qualityformation processes and its factors are still to be discovered.We present a multi-episodic experiment of an Audio-on-Demand service over a usage period of 6 days with 93 par-ticipants. Our work directly extends prior work investigating theimpact of time between usage episodes. The results show similareffects — also the recency effect is not statistically significant.In addition, we extend prediction of multi-episodic judgments byaccounting for the observed saturation.}, language = {en} }