Brian Neil Levine's Publications

@inproceedings{Soroush:2013,
Author = { Hamed Soroush and Keen Sung and Erik Learned-Miller and Brian Neil Levine and Marc Liberatore},
Booktitle = {Proc. Privacy Enhancing Technologies Symposium (PETS)},
Keywords = {Privacy; Cellular; Remote Inference},
Month = {July},
Pages = {103--122},
Sponsors = {CNS-0905349},
Title = {{Disabling GPS is Not Enough: Cellular location leaks over the Internet}},
Traces_Url = {brian.php/Network},
Url = {http://forensics.umass.edu/pubs/soroush.pets.2013.pdf},
Year = {2013}}

[link][PDF]

@inproceedings{Hurley:2013,
Author = { Ryan Hurley and Swagatika Prusty and Hamed Soroush and Robert J. Walls and Jeannie Albrecht and Emmanuel Cecchet and Brian Neil Levine and Marc Liberatore and Brian Lynn and Janis Wolak},
Booktitle = {Proc. Intl. World Wide Web Conference (WWW)},
Keywords = {forensics; peer-to-peer; Award Paper},
Month = {May},
Pages = {11},
Sponsors = {CNS-1018615; CNS-0905349; 2008-CE-CX-K005},
Techreport_Url = {http://web.cs.umass.edu/publication/docs/2013/UM-CS-2013-007.pdf},
Title = {{Measurement and Analysis of Child Pornography Trafficking on P2P Networks (Runner-Up, Best Paper Award)}},
Url = {http://forensics.umass.edu/pubs/hurley.www.2013.pdf},
Year = {2013}}

[link][PDF]

@techreport{Liberatore:2012,
Address = {Department of Computer Science},
Author = { Marc Liberatore and Brian Neil Levine and Clay Shields and Brian Lynn},
Institution = {University of Massachusetts Amherst},
Keywords = {forensics; peer-to-peer},
Month = {December},
Number = {UM-CS-2012-035},
Title = {{Efficient Tagging of Remote Peers During Child Pornography Investigations}},
Url = {http://web.cs.umass.edu/publication/docs/2012/UM-CS-2012-035.pdf},
Year = 2012}
[link][PDF]

@inproceedings{Prusty:2011,
Author = { Swagatika Prusty and Brian Neil Levine and Marc Liberatore},
Booktitle = {Proc. ACM Conference on Computer \& Communications Security (CCS)},
Keywords = {forensics; peer-to-peer; anonymity},
Month = {October},
Pages = {13},
Slides_Url = {http://forensics.umass.edu/pubs/slides/prusty.ccs.2011.slides.pdf},
Sponsors = {CNS-1018615},
Title = {{Forensic Investigation of the OneSwarm Anonymous Filesharing System}},
Url = {http://forensics.umass.edu/pubs/prusty.ccs.2011.pdf},
Year = {2011}}

[link][PDF]

@inproceedings{Walls:2011a,
Audio_Url = {http://forensics.umass.edu/pubs/Walls.hotsec.2011.mp3},
Author = { Robert J. Walls and Brian Neil Levine and Marc Liberatore and Clay Shields},
Booktitle = {Proc.\ USENIX Workshop on Hot Topics in Security (HotSec)},
Keywords = {forensics; security},
Month = {August},
Slides_Url = {http://forensics.umass.edu/pubs/rjwalls.hotsec.2011.slides.pdf},
Sponsors = {CNS-1018615, CNS-0905349, DUE-0830876, 2008-CE-CXK005},
Title = {{Effective Digital Forensics Research is Investigator-Centric}},
Url = {http://forensics.umass.edu/pubs/Walls.hotsec.2011.pdf},
Video_Url = {http://forensics.umass.edu/pubs/Walls.hotsec.2011.mp4},
Year = {2011}}

[link][PDF]

@article{Liberatore:2010a,
Author = { Marc Liberatore and Bikas Gurung and Brian Neil Levine and Matthew Wright},
Journal = {Elsevier Journal of Network and Computer Applications},
Keywords = {privacy; anonymity; peer-to-peer; Journal Paper},
Month = {January},
Number = 1, Pages = {341-350},
Title = {{Empirical Tests of Anonymous Voice Over IP}},
Url = {http://forensics.umass.edu/pubs/liberatore.JCNA.2010.pdf},
Volume = 34, Year = {2011}}

[link][PDF]

@inproceedings{Liberatore:2010b,
Author = { Marc Liberatore and Brian Neil Levine and Clay Shields},
Booktitle = {Proceedings of the ACM Conference on Future Networking Technologies (CoNEXT)},
Keywords = {forensics; peer-to-peer},
Month = {November},
Slides_Url = {http://forensics.umass.edu/pubs/liberatore.conext.2010.slides.pdf},
Sponsors = {DUE-0830876, CNS-1018615, and 2008-CE-CX-K005 CNS-0905349},
Title = {{Strengthening Forensic Investigations of Child Pornography on P2P Networks}},
Url = {http://forensics.umass.edu/pubs/liberatore.conext.2010.pdf},
Year = {2010}}

[link][PDF]

@inproceedings{Liberatore:2010,
Author = { Marc Liberatore and Robert Erdely and Thomas Kerle and Brian Neil Levine and Clay Shields},
Booktitle = {Proc.\ DFRWS Annual Digital Forensics Research Conference},
Keywords = {forensics; peer-to-peer},
Month = {August},
Sponsors = {2008-CE-CX-K005, CNS-0905349, and DUE-0830876},
Title = {{Forensic Investigation of Peer-to-Peer File Sharing Networks}},
Url = {http://forensics.umass.edu/pubs/liberatore.dfrws2010.pdf},
Year = {2010}}

[link][PDF]

@inproceedings{Levine:2009a,
Author = { Brian Neil Levine and Marc Liberatore},
Booktitle = {Proc. of DFRWS Annual Conference},
Conference_Url = {http://dfrws.org/2009/},
Keywords = {forensics},
Month = {August},
Sponsors = {DUE-0830876 and 2008-CE-CX-K005},
Title = {{DEX: Digital Evidence Provenance Supporting Reproducibility and Comparison}},
Url = {http://forensics.umass.edu/pubs/levine.dfrws.2009.pdf},
Year = {2009}}

[link][PDF]

@article{Baughman:2007,
Abstract = {We explore exploits possible for cheating in real-time, multiplayer games for both client-server and serverless architectures. We offer the first formalization of cheating in online games and propose an initial set of strong solutions. We propose a protocol that has provable anti-cheating guarantees, is provably safe and live, but suffers a performance penalty. We then develop an extended version of this protocol, called asynchronous synchronization, which avoids the penalty, is serverless, offers provable anti-cheating guarantees, is robust in the presence of packet loss, and provides for significantly increased communication performance. This technique is applicable to common game features as well as clustering and cell-based techniques for massively multiplayer games. Specifically, we provide a zero-knowledge proof protocol so that players are within a specific range of each other, and otherwise have no notion of their distance. Our performance claims are backed by analysis using a simulation based on real game traces.},
Author = {Baughman, Nathaniel E. and Liberatore, Marc and Levine, Brian Neil},
Journal = {IEEE/ACM Transactions on Networking},
Keywords = {security;gaming;peer-to-peer; Journal Paper},
Month = {February},
Number = {1},
Pages = {1--13},
Sponsors = {NSF-0133055},
Title = {{Cheat-Proof Playout for Centralized and Peer-to-Peer Gaming}},
Url = {http://forensics.umass.edu/pubs/baughman.ToN.pdf},
Volume = {15},
Year = {2007}}

[link][PDF]

@inproceedings{Liberatore:2006aMaximizing,
Abstract = {Devices in disruption tolerant networks (DTNs) must be able to communicate robustly in the face of short and infrequent connection opportunities. Unfortunately, one of the most inexpensive, energy-efficient and widely deployed peer-to-peer capable radios, Bluetooth, is not well-suited for use in a DTN. Bluetooth's half-duplex process of neighbor discovery can take tens of seconds to complete between two mutually undiscovered radios. This delay can be larger than the time that mobile nodes can be expected to remain in range, resulting in a missed opportunity and lower overall performance in a DTN. This paper proposes a simple, cost effective, and high performance modification to mobile nodes to dramatically reduce this delay: the addition of a second Bluetooth radio. We showed through analysis and simulation that this dual radio technique improves both connection frequency and duration. Moreover, despite powering two radios simultaneously, nodes using dual radios are more energy efficient, spending less energy on average per second of data transferred.},
Author = {Liberatore, Marc and Levine, Brian Neil and Barakat, Chadi},
Booktitle = {Proc. ACM Conference on Future Networking Technologies (CoNext)},
Keywords = {DTN; wireless; MAC Protocols; DOME},
Month = {December},
Presentation_Url = {http://forensics.umass.edu/pubs/slides/chadi.conext.2006.pdf},
Sponsors = {NSF-0519881 and NSF-0133055 and NSF-0325868 and W15P7T-05-C-P213},
Title = {{Maximizing Transfer Opportunities in Bluetooth DTNs}},
Url = {http://forensics.umass.edu/pubs/liberatore.conext.2006.pdf},
Year = {2006}}

[link][PDF]

@inproceedings{Liberatore:2006,
Abstract = {We examine the effectiveness of two traffic analysis techniques for identifying encrypted HTTP streams. The techniques are based upon classification algorithms, identifying encrypted traffic on the basis of similarities to features in a library of known profiles. We show that these profiles need not be collected immediately before the encrypted stream; these methods can be used to identify traffic observed both well before and well after the library is created. We give evidence that these techniques will exhibit the scalability necessary to be effective on the Internet. We examine several methods of actively countering the techniques, and we find that such countermeasures are effective, but at a significant increase in the size of the traffic stream. Our claims are substantiated by experiments and simulation on over 400,000 traffic streams we collected from 2,000 distinct web sites during a two month period.},
Author = {Liberatore, Marc and Levine, Brian Neil},
Booktitle = {Proc. ACM conference on Computer and Communications Security (CCS)},
Keywords = {security; privacy; anonymity; forensics},
Month = {October},
Pages = {255--263},
Slides_Url = {http://forensics.umass.edu/pubs/slides/liberatore.ccs2006.slides.pdf},
Sponsors = {NSF-0133055 and NSF-0325868},
Title = {{Inferring the Source of Encrypted HTTP Connections}},
Traces_Url = {http://traces.cs.umass.edu},
Url = {http://forensics.umass.edu/pubs/liberatore.ccs2006.pdf},
Year = {2006}}

[link][PDF]

@inproceedings{Bissias:2005,
Abstract = {Encrypting traffic does not prevent an attacker from performing some types of traffic analysis. We present a straightforward traffic analysis attack against encrypted HTTP streams that is surprisingly effective in identifying the source of the traffic. An attacker starts by creating a profile of the statistical characteristics of web requests from interesting sites, including distributions of packet sizes and inter-arrival times. Later, candidate encrypted streams are compared against these profiles. In our evaluations using real traffic, we find that many web sites are sub ject to this attack. With a training period of 24 hours and a 1 hour delay afterwards, the attack achieves only 23% accuracy. However, an attacker can easily pre-determine which of trained sites are easily identifiable. Accordingly, against 25 such sites, the attack achieves 40% accuracy; with three guesses, the attack achieves 100% accuracy for our data. Longer delays after training decrease accuracy, but not substantially. We also propose some countermeasures and improvements to our current method. Previous work analyzed SSL traffic to a proxy, taking advantage of a known flaw in SSL that reveals the length of each web object. In contrast, we exploit the statistical characteristics of web streams that are encrypted as a single flow, which is the case with WEP/WPA, IPsec, and SSH tunnels.},
Author = {Bissias, George and Liberatore, Marc and Jensen, David and Levine, Brian Neil},
Booktitle = {Proc. Privacy Enhancing Technologies Workshop (PET)},
Keywords = {security; anonymity; privacy},
Month = {May},
Pages = {1--11},
Sponsors = {NSF-0133055 and NSF-0325868 and NSF-0080199},
Title = {{Privacy Vulnerabilities in Encrypted HTTP Streams}},
Traces_Url = {http://traces.cs.umass.edu},
Url = {http://forensics.umass.edu/pubs/bissias.liberatore.pet.2005.pdf},
Year = {2005}}

[link][PDF]

Keywords