text: The American Waterways Operators AWO says that the tank barge industry is leading the way as American companies make the multi-billion dollar investment required to transform the nation's fleet of oil-carrying tank vessels into environmentally friendly double hulls. More than 65 percent of the U.S. tank barge fleet is double-hulled today, more than 13 years before the 2015 deadline set by Congress in the landmark Oil Pollution Act of 1990 (OPA 90). Even as government and industry sources agree that there is a surplus of tonnage on the market today - more vessels than are needed to meet U.S. demand for oil transportation - America's tank barge operators are leading the transition to an all-double hull fleet. According to U.S. Coast Guard data, U.S. tank barge operators have built 567 new double-hulled petroleum barges for inland and coastal service since the Oil Pollution Act was passed in 1990. The pace of new construction has accelerated in recent years, with 23 percent of this total - 134 double-hulled barges - built between 1999 and 2001. More new double hulls are on the order books, including at least eight oceangoing tank barges scheduled for delivery in 2002, plus options for 10 others and pending contracts for the conversion of seven oceangoing tank barges from single to double hull. The capital investment required to overhaul the U.S. tank barge fleet is significant: a 30,000 barrel inland tank barge costs some $1.45 million to build, while a 120,000-140,000 barrel coastal tank barge carries a price tag of $15-17 million. Because a double-hull barge is much larger than a single hull with the same carrying capacity, vessel owners must often invest an additional $9-10 million for a more powerful tugboat to move the larger barge. Retrofitting (adding a double hull to an existing single hull barge) is an option for some coastal tank barges and can shorten delivery time by several months, but the cost remains high: some $12-13 million for a 120,000-140,000 barrel barge. The cost of a state-of-the-art articulated tug-barge unit, or ATB, runs $26-27 million. Given the size of the capital outlay required, companies must weigh many factors in deciding when to build a new double-hulled vessel. Paramount is demand for oil transportation – how strong shipper demand is, and what the likelihood is that freight rates will be sufficient to offset the cost of such a major investment. If demand is there, building will follow. Building vessels of any kind in the absence of demand hurts the industry, artificially depressing freight rates and undermining the industry's ability to shoulder the investment in modern, environmentally friendly vessels to meet future needs. Government experts from the Coast Guard to the General Accounting Office to the Maritime Administration agree that U.S. tank vessel capacity today exceeds demand for oil transportation, and will continue to do so until at least 2004. As American companies strongly committed to the U.S. market, the members of the American Waterways Operators stand ready to make the investment in new double-hulled vessels to meet the nation's energy transportation needs, and to continue providing safe, environmentally friendly, and economically efficient service to U.S. shippers and consumers.


text:
Elections, Politics
Good reason to believe Romney will win
I have written extensively on the subject of the enthusiasm gap in the upcoming election, which I believe may very likely be the determining factor. The basics are simple. The polls are showing a close race. There are some undecideds, but many have already made up their minds. Romney will do better among independents than McCain did, but there is a good chance that Obama will hold on to a decent share. This election is going to come down to what voting cohorts are more enthusiastic about voting, and what cohorts are less enthusiastic. It's about turnout—who does, and who doesn't.
I have argued, both by reference to statistics and to common sense, that Obama voters will be less enthusiastic, and Romney/anti-Obama voters will be more so. In a close election, that gap can easily cover the distance and give Romney the win. If the election percentages do not turn out to be close, and Romney takes a larger share, then that gap turns a victory into a blowout, impacting down-ticket races across the country.
There are a lot of variables, and much can happen between now and the election, but data from Resurgent Republic, for the moment at least, is reinforcing my contention. In fact, the enthusiasm gap is pretty lopsided.
Observe . . .
(Click for a larger version)
If this gap holds, and if nothing major changes between now and Election Day, Romney may be in a very good position to become the 45th President of the United States.
Christopher Cook
Ardently devoted to the cause of human freedom, he has worked at the confluence of politics, activism, and public policy for more than a decade. He co-wrote a ten-part series of video shorts on economics, and has film credits as a researcher on 11 political documentaries, including Citizens United's notorious film on Hillary Clinton that became the subject of a landmark Supreme Court decision. He is the founder of several activist endeavors, including AnyStreet.org (now a part of Western Free Press) and Liberatchik.com. He is currently the managing editor of and principal contributor to WesternFreePress.com.
Latest posts by Christopher Cook (see all)
- Politico Poll on Republican Tax Plan Is Proof That Democracy, on Its Own, Does Not Work - November 15, 2017
- Why Won't The Turks Admit What They Did in the Armenian Genocide? - May 27, 2017
- BREAKING: Time Warner Cable Goes Down at the EXACT Moment When Trump Put His Hand on the Bible - January 20, 2017

subset: commoncrawl


text:
Khalifa University announced today that 15 of its students have accepted six week long internships at the Etisalat-BT Innovation Center (EBTIC).
EBTIC, which is the result of a partnership agreement between Etisalat, British Telecom (BT) and Khalifa University, focuses its research and innovation on Next Generation Networks and advanced ICT services and applications which are areas of strategic importance to its founding partners and to the UAE.
"The development of and the investment in local talent is at the core of EBTIC's vision and mission," said Professor Nader Azarmi, Director of EBTIC "The student internship program is one such initiative where EBTIC provides industrial placements for Khalifa University students to work on industrial projects with clear tangible deliverables and outcomes. The interns have the opportunity to work alongside EBTIC researchers and in some cases with EBTIC partners to develop solutions for real industry problems."
Students were selected for their ability to engage in research based projects. The students come from several different engineering backgrounds including: communication, computer, software, electronic and biomedical engineering.
Each student is assigned a supervisor from EBTIC that provides day to day guidance and support to achieve project objectives. The EBTIC supervisors work closely with their academic counterparts to effectively manage the students during the internship.
Some of the interns have been selected for a two week visit to the BT research labs in the United Kingdom to get a bigger exposure to the latest advances in ICT research.
"We are pleased to see our students accept such prestigious internships," said Dr. Mohammed Al Mualla, EBTIC Board Member and Senior Vice President of Research and Development at Khalifa University. "Interning at EBTIC will provide them with a wealth of experience that they will carry forward into their future careers."
He continued, "Partnerships, like the one Khalifa University enjoys with EBTIC, are an important part of providing our students with opportunities to engage with industry and fulfilling our mission to provide the future leaders of the UAE economy."
[1] https://www.albawaba.com/en/node/355857?nid=436088
[2] http://www.albawaba.com


text:
"duty of care?"
About: Bolton PCT Bolton PCT Bolton BL1 1PP Royal Bolton Hospital Royal Bolton Hospital Bolton BL4 0JR
Posted by patricia meehan (as ),
I have been through 6 months of hell: hospital tests and cancer treatment because a routine x-ray didn't give results for 5 months. The hospital insists my results were sent to g.p., who says they were never received. I am now waiting for radiotherapy results, another 3 weeks of terrible stress.
It is now 9 months since the first routine xray. We are told constantly how 'vital' early detection and treatment is, but if we cannot depend on the simple administration duties of staff, isn't it all rather laughable?
Response from Bolton NHS Foundation Trust 9 years ago
We're very sorry to hear of your concerns. Please would you or your relative contact our Radiology Department Manager on 01204 390940 if you would like to discuss them further.
- {{helpful}} {{helpful == 1 ? "person thinks" : "people think"}} this response is helpful
- Was this response helpful? Yes | No
Thank you for your feedback.
See more responses from Bolton NHS Foundation Trust


text: The last time we stayed at Ft. Wilderness was about three years ago. My memory of the park was that there was lots of vegetation between the sites giving you a feeling of wilderness and some sense of privacy. Today all of that growth has been cleared away and I have a good view of every other RV in the entire loop. What happened? Was this supposed to be some sort of improvement?


text:
Wash the day away with this Vero 1-Spray Wall-Mount Handshower in Venetian Bronze. Its sleek and minimalist design are just two reasons the ribbon-inspired Vero is the perfect urban oasis. This super functional handshower gives you water any way you need it, anywhere you want it. Buy with confidence, knowing that Delta backs all of its products with a lifetime limited warranty.
California residents: see Proposition 65 information
- Due to WaterSense regulations in the state of California, please confirm your shipping zip code is not restricted from use of items which do not meet WaterSense qualifications
- Coordinates perfectly with the Vero bath collection
- 1-setting full body spray handshower flows at 2.0 GPM
- Mounts to wall to maximize space
- Includes 69 in. long hose
- Lifetime limited warranty covers parts and finish defects


text:
No. 12 Michigan 84, UI 53: 'They played terrific'
CHAMPAIGN — It was supposed to be a night in which Joseph Bertrand and Jon Ekey were celebrated. Illinois' fifth-year seniors were playing the final home games of their careers at State Farm Center on Tuesday. It ended up being a celebration for Michigan.
A couple dozen maize-and-blue-clad fans made their way close to the court to send coach John Beilein off after the 12th-ranked Wolverines blitzed the Illini, claiming an 84-53 win, winning the outright Big Ten championship for the first time since 1986.
"Thank you, Blue!" Beilein yelled at the fans as he, his wife Kathleen and Big Ten Player of the Year candidate Nik Stauskas made their way to the festive Michigan locker room trailed by four camera crews.
As Michigan was making 16 of 23 three-pointers — seven from Stauskas (24 points) — Illini great Kenny Battle stood in the tunnel and shook his head with a laugh.
Illinois coach John Groce, looking on from the Illinois bench offered this: "I've never seen anybody shoot like that. I've been doing this a long time."
Even Beilein couldn't have imagined his squad tying the State Farm Center record for made threes by an opponent.
"I haven't seen that in practice even," he said.
The biggest issue Michigan (22-7, 14-3 Big Ten) had on the night was figuring out where to situate the Big Ten trophy on the table during the postgame news conference.
"It's kind of contagious," Stauskas said. "One guy gets going, we all feed off it and we did a good job tonight."
In the four games leading into Tuesday, Illinois opponents tried but failed to solve the Illini defense as Ohio State, Minnesota, Nebraska and Michigan State all failed to reach 50 points. The Wolverines did it Tuesday. In the first half.
"When you get an outcome like today, a good team like ours has to play really poor and a really good to great team like them has to play great, and that's what happened today," Groce said. "They played terrific ... give them credit."
The loss ended a three-game win streak for the Illini (17-13, 6-11) and halted the team's momentum — and folks' dreams of a run into the NCAA tournament. Wins against the Wolverines and at No. 20 Iowa on Saturday would have further added to the excitement of potentially receiving an improbable bid, but it's likely going to take a win next Sunday at the Big Ten tournament to get the Illini in the Dance, though that's not the focus.
"Right now, where we are, you can't control that. You have to worry about the process and playing well, and that other stuff takes care of itself," Groce said. "That's always a goal, every year that's goal for us."
The key is bouncing back from Tuesday's 31-point setback, the largest in the 51-year history of State Farm Center for the Illini.
"It's going to take a certain level of toughness, for sure. No one likes to get beat like that if you're a competitor," Groce said.
Rayvonte Rice scored a team-high 16 points to go along with nine rebounds, and two-time Big Ten Freshman of the Week Kendrick Nunn added 14 points.
It was a forgettable Senior Night for Bertrand, who was limited to nine minutes with a knee injury. Bertrand banged knees with another player, though he tried to continue playing.
"Paul Schmidt, our trainer and director of sports medicine, is going to take a look at Joe here. It's something knee. Paul does not think it's anything major at this juncture in his opinion, but we haven't obviously taken an X-ray or done anything like that," Groce said. "We'll do all those things to make sure we do right by Joe and make sure he's OK."
News-Gazette.com embraces discussion of both community and world issues. We welcome you to contribute your ideas, opinions and comments, but we ask that you avoid personal attacks, vulgarity and hate speech. We reserve the right to remove any comment at our discretion, and we will block repeat offenders' accounts. To post comments, you must first be a registered user, and your username will appear with any comment you post. Happy posting.


text:
|Publication number
|Publication type
|Application number
|Publication date
|Feb 12, 2008
|Filing date
|Sep 10, 2002
|Priority date
|Sep 10, 2001
|Fee status
|Publication number
|Livio Ricciulli
|Original Assignee
|Xangati, Inc.
|Export Citation
|BiBTeX, EndNote, RefMan
|Patent Citations (18), Non-Patent Citations (2), Referenced by (72), Classifications (8), Legal Events (6)
|External Links: USPTO, USPTO Assignment, Espacenet
This application claims priority of co-pending U.S. Provisional Patent Application Ser. No. 60/318,670 entitled "Dynamic DoS Flooding Protection" to L. Ricciulli, filed Sep. 10, 2001. Priority of the filing date of Sep. 10, 2001 is hereby claimed, and the disclosure of said Provisional Patent Application is hereby incorporated by reference in its entirety.
1. Field of the Invention
This invention relates generally to network denial of service attacks and, more particularly, to protecting against network denial of service flooding attacks.
2. Description of the Related Art
Society has become increasingly dependent on the Internet for daily activities as a result of the exponential growth of both government and business processes that make use of Internet technologies. The Internet's explosive growth is at least partially due to the scalability and fault-tolerance of its design principle, which pushes most of the complexity and state out toward the edges of the network, thereby making the network nodes relatively simple and easy to manage.
This simplicity, and a lack of built-in authentication, makes the Internet scalable and easy to manage but also very anonymous, as the configuration of the Internet makes it somewhat difficult to trace the source of transmitted packets. This has enabled the insurgence of network-based denial of service (DoS) attacks, in which packets are sent remotely and anonymously through the Internet with the goal of shutting down or greatly inhibiting a targeted end system from providing services over the Internet. The packets have adverse effects on the communication resources of targeted end-systems, thereby denying access to legitimate users that try to access the end systems.
Network-based DoS attacks can be generally classified in three categories: (1) implementation exploits; (2) protocol exploits; and (3) flooding exploits. Implementation exploits are DoS attacks that adversely take advantage of known deficiencies of certain implementations from specific end-system vendors in order to disable an end-system. Such implementation exploits are generally the least severe since they can be easily defeated by patching the vendor's implementation to overcome or resist the attack.
Protocol exploits are DoS attacks that misuse specific communication protocols and take advantage of the fact that many protocols are not designed to protect against hostile use of the protocols. For example, TCP SYN attacks or routing attacks are examples of protocol exploits that involve sending an excess number of TCP SYN packets to a targeted end-system. These attacks are not very easy to devise but are very severe, as they require changes or amendments to standards and therefore may be very expensive to fix.
Flooding exploits simply send large amounts of bogus traffic to a victim's end-system in an attempt to entirely consume the traffic capacity of the end-system and thereby shut down the victim's ability to service legitimate traffic. These exploits expose the lack of resource management in Internet Protocol (IP) networks and are very popular because of their relative simplicity and destructive outcomes. DoS flooding is facilitated by the general lack of Internet quality of service (QOS) control that permits uncontrolled, malicious acquisition and use of Internet bandwidth. Furthermore, the lack of security allows such destructive usage to be carried out anonymously.
Currently, DoS flooding attacks often are implemented through the wide availability and usage of several distributed DoS (DDoS) tools that allow attackers to anonymously and remotely control a number of attack hosts ("zombies") that send floods of packets toward the victim(s) on a network or at an end-system. The DDoS tools send attack packets in an uncontrolled fashion to consume all or a large portion of the bandwidth at the victim's network. Furthermore, attacker anonymity is achieved by inserting random packet header fields into the attack packets to thereby misidentify the source of the packets. As a result, the offending traffic cannot be distinguished from the legitimate traffic and cannot be traced on the basis of the contents of the protocol headers.
The end result of these types of attacks is to anonymously prevent legitimate users from reaching the victim's network services. The attacks also subject the victim's network to crippling load conditions, as the network's replies to randomly generated source addresses flush route caches in routers and overload the route lookup mechanisms, which further aggravates the situation.
There are a variety of available DDoS tools for implementing DoS attacks. Such tools basically use three types of flooding packets: (1) TCP packets (such as SYN, ACK, RST, NULL); (2) ICMP packets; and (3) UDP packets. A new breed of attacks based on reflection are also being used. These types of attacks use a plurality of compromised zombie hosts to send TCP, UDP or ICMP packets with the source addresses in the packets set to the victim's network address. The zombies iteratively send the packets to a very large number of legitimate network endpoints. The network endpoints then reply to the packets, resulting in a flood of packets being sent to the victim's network address. The replies typically include SYN ACKs, ICMP echo replies, or any other application responses (such as a Gnutella connection request). Such techniques allow attacks to be much more distributed and also render any forensic techniques more difficult, as the zombies are only involved indirectly.
There are currently several existing techniques that attempt to mitigate the Internet DDoS flooding problem. With the exception of rate limiting, all these techniques decrease the anonymity of flooding packets in order to aid in identification and capture of the attackers responsible for the attack. However, the techniques do not prevent or alleviate the effectiveness of the actual flooding attack.
Rate limiting is one technique that reduces the effectiveness of DDoS attacks. According to this technique, rate-limiting filters are administratively applied at network locations to effectively reduce the amount of bandwidth consumed by certain types of packets at the network location in response to a detected rate of receiving packets. This limits the exposure to bandwidth attacks that use these types of packets. Unfortunately, most conventional DDoS attack methods spoof protocol headers in a way that is indistinguishable from legitimate production traffic (so that DDDoS packets appear to be legitimate HTTP traffic). Consequently, rate limiting of bandwidth for DDoS flood protection also limits the legitimate traffic.
Most firewalls today offer a rate-limiting functionality. However, a rate limiting functionality is only marginally useful as it does not provide any benefits against randomly spoofed bandwidth attacks. Furthermore, it does not prevent an attacker from consuming the bandwidth on the network side of the firewall. Consequently, rate limiting is only useful if it can be applied close to the source of the attack, where most of the traffic is malicious. However, rate limiting close to the victim's network through the use of firewalls or traffic shapers has two very undesirable consequences. One such consequence is that, during normal operations, rate limiting effectively reduces the capacity of the victim's network. Another consequence is that, in the presence of an attack, rate limiting lowers the bandwidth threshold necessary for an adversary to force the rate limited system to start dropping legitimate packets.
Ingress filtering is another technique for countering DoS attacks. Ingress filtering does not directly eliminate DDoS flooding attacks, but rather prevents spoofing of source addresses through the use of preventive administrative filtering at a network ingress point. Spoofing source addresses is one of the techniques used to hide the origin of flooding packets or to control packets that can cause flooding to occur, thus making DDoS safer to be carried out from the attacker perspective. Ingress filtering uses a router that checks to ensure that each packet sent into the Internet by an Internet Service Provider (ISP) has a source IP address that belongs to the administrative domain of the router performing the check.
If ingress filtering were universally applied, source addresses of flooding packets could be used to track down the sending ISP and eventually the attackers. However, in practice, ingress filtering is very difficult to promote and adopt universally, as it requires ISPs to dedicate router computing resources to check all outgoing routed packets, thereby reducing the effective throughput of the ISP. Consequently, ingress filtering is not a viable solution to DDoS flooding because it may only reduce the number of available launch platforms (excluding the ones that apply ingress filtering), thus providing only a partial solution. Furthermore, ingress filtering may reduce the occurrence of only certain attacks and may not deter DDoS attacks that are carried out with the collusion of the ISP, such as in international electronic warfare or electronic terrorism.
Packet marking is another technique for countering DoS attacks. Packet marking requires the modification of some packets as they are being forwarded by routers. Packet marking helps in reconstructing the origin of a flood and thus could be used to trace attackers. This technique has the same general limitations of ingress filtering, but may be more useful in the short term, as packet marking could be applied in a more controlled way to a given protection domain without requiring cooperation of the Internet community as a whole. Several marking schemes have been proposed to probabilistically overload certain fields in the IP headers to provide enough information to the victim to reconstruct the forwarding paths. This can be accomplished in various ways, such as to use the offset bits in a packet to encode the ID number of a router used to route the packet and thereby permit reconstruction of the sequence of routers through which the packet traveled.
One drawback of packet marking is that it requires some additional amount of computation in the routers, thereby consuming computation resources and limiting throughput. Furthermore, the victim's network (end-system) must perform a significant amount of computation to extract from the marked packets enough information to be able to identify the forwarding path. Another drawback is that large amounts of bogus markings can be injected into the packet stream to either confuse the detection algorithm or create a disabling DoS condition on the hosts performing the path computation.
Thus, there are currently a variety of ways of dealing with DoS flooding attacks, but each has its own drawbacks. Rate limiting does not effectively work against packets with randomly-spoofed source addresses and can also limit the performance of legitimate traffic. Ingress filtering requires the cooperation of one or more ISPs, which is not practical. Packet marking is computationally expensive from the standpoint of the protected network. In view of the foregoing, there is a need for an improved method and apparatus for effectively detecting and protecting against DoS flooding attacks on a computer network.
Disclosed are devices and methods for detecting and protecting against DoS flooding attacks that are initiated against an end system on a computer network. In accordance with one aspect of the invention, a filter is established at a network location. The filter prevents data packets received at a first network location and deemed responsible for a DoS flooding condition from being forwarded to a subsequent network location. The flow of data packets received at the first network location is monitored to determine whether the flow of data packets exhibits a legitimate behavior, such that the flow of data packets that exhibit legitimate behavior is determined to originate from a legitimate source that is not responsible for the DoS flooding condition. Legitimate behavior can be characterized by the flow of data packets from a network source that exhibits backoff behavior. The filter is then modified to permit data packets that originate from the legitimate source to be forwarded from the first network location to a subsequent network location.
In another aspect of the invention, a DoS attack at a first network location is detected and an alarm signal is transmitted to a second network location in response to determining that the denial of service flooding condition is present at the first network location. The alarm signal identifies at least one characteristic of a data packet that has been determined to be at least partially responsible for the denial of service flooding condition. A network device that receives the alarm signal can use the alarm signal to identify data packets having the identified characteristic and inhibit such data packets from being forwarded to a subsequent network location.
Other features and advantages of the present invention should be apparent from the following description, which illustrates, by way of example, the principles of the invention.
At least one of the routers 140 is configured to detect and protect against denial of service (DoS) attacks in accordance with one aspect of the invention. In this regard, the routers can include or host what will be referred to as a network attached router coprocessor (NARC) 210 that enables the host router to detect and protect against denial of service (DoS) attacks. The NARC 210 is described herein as being separate from its host router 140 a, although it should be appreciated that the processes performed by a NARC 210 can be incorporated into the processing of its host router. The NARC 210 can function in various roles with respect to its host router. In one role, the NARC 210 functions as a "detector NARC" that examines network traffic passing through a host router to detect conditions in the host router that indicate the presence of a DoS attack. When conditions that indicate a DoS attack are detected, the detector NARC transmits an alarm signal that includes data that describes the offending network traffic that caused the DoS condition. The alarm signal is intended for receipt by at least one "network NARC". The role of the network NARC is to initiate one or more actions in response to receiving the alarm signal, such as, for example, checking for offending traffic in a host router and establishing a filter that inhibits the flow of offending traffic through the host router. The functionality of the NARCs can be implemented by a network device (such as a router, switch, or other computing device) that resides at a network location that receives and forwards data transmissions bound for the end-system.
A particular NARC 210 can function as a detector NARC, a network NARC, or as both a detector NARC and a network NARC, based upon programming instructions residing in memory of the NARC or based upon the hardware configuration of the NARC. The following nomenclature is used herein to differentiate references to NARCs operating in their various roles: a detector NARC is referred to as a "NARC[d] 210", a network NARC is referred to as a "NARC[n] 210", and a NARC is referred to generally as a "NARC 210". The NARC can be implemented as a separate hardware device hosted by the router, or it can be implemented as software in an otherwise conventional router, wherein the software implements the functionality described herein.
With reference still to
Data is provided into the router 140 and into the NARC 210 via network interface such as a data line 215 or other well-known network interface. Accordingly, all data packets that are transmitted to the router 140 are also transmitted to and received by the corresponding NARC 210. The data line 215 can be configured to transmit data according to a wide variety of protocols and standards, such as, for example, DS1, DS3, Ethernet, and Fast Ethernet. The NARC 210 can examine received data packets to perform denial-of-service protection, network monitoring, network traffic management, network traffic tracing, and metering and billing of network traffic. The NARC 210 can control operations of the router 140 through a control interface 225 with the router 140, as described further below.
Logging of Network Traffic Records for Host Router
The NARC 210 includes memory that permits data to be stored and retrieved. The NARC 210 maintains network traffic records in memory, wherein the network traffic records contain information regarding network traffic, such as data packets, that have passed through the NARC's host router 140. The recorded-information relates to attributes of the data packets, including attributes such as, for example, (1) source network address, such as source IP address; (2) destination network address, such as destination IP address; (3) source port; (4) destination port; (5) ICMP flags; (6) TCP flags for the data packets. Those skilled in the art will appreciate that a given data packet will typically contain such attributes in a header portion of the packet and that the attributes will each have specific values. For example, a first packet can have a source network address of 126.96.36.199. Thus, the value, or instance, of the source address attribute for the first packet will be 188.8.131.52.
The NARC 210 records the information by extracting and storing the specific instances of the attributes from packets received at the router 140 according to well-known methods. The NARC 210 can maintain network statistics pertaining to each attribute, such as how much bandwidth that a specific instance of an attribute has utilized, as described more fully below. It should be appreciated that the previously-mentioned attributes are merely exemplary and that the NARC 210 can store additional information, less information, or any combinations thereof regarding the data packets that were received by the router 140.
In one embodiment, the NARC 210 stores the source and destination addresses of the received data packets (and the associated statistical data) in one or more data structures comprised of binary trees. The NARC 210 maintains at least one binary tree that contains data relating to source addresses and maintains at least one binary tree that contains data relating to destination addresses. Each binary tree is comprised of data relating to a plurality of nodes, wherein each node represents and is associated with one or more possible network addresses. When the NARC 210 receives a data packet that has a specific source or destination address, the NARC 210 stores data relating to the data packet and associates the data with one or more nodes of the corresponding binary tree. This is described in more detail below with reference to an example shown in
This may be more easily understood with reference to the binary tree 410 shown in
For example, the node 420 branches into a node 430 (representing all network addresses that begin with 11) and a node 435 (representing all network addresses that begin with 10). Likewise, the node 430 branches into two separate leaf nodes: a node 440 that represents the specific network address 111 and a node 445 that represents the specific network address (110).
It should be appreciated that the illustrated binary tree 410 is exemplary and that similar binary tree data structures could be used to store information for network addresses of any configuration. For example, the network addresses may comprise IP addresses, wherein an IP address has 32-bits for IPv4 and 128 bits for IPv6, as will be known to those skilled in the art. For example, in the case of 32-bit IP addresses, the corresponding binary tree structure could have thirty-three levels of nodes, with the leaf nodes each representing a specific 32-bit IP address and the root node representing all possible 32-bit IP addresses in the received data packets.
As the NARC 210 receives data packets, it records and sorts observation data relating to the specific attributes in the data packets. For each received data packet, the NARC 210 stores the observation data according to the binary tree by associating the observation data with the node or nodes that represent the network address (or subset of addresses) with which the observation data is associated. The observation data includes a timestamp (LT) and a fill level (FL). The timestamp indicates the last time that the NARC 210 observed a data packet containing the associated network address. The fill level (FL) is a metric that indicates how many times the NARC 210 has encountered a packet with the associated network address (or sub-address). Thus, the fill level for a given node will increase as the NARC 210 encounters additional packets that have a network address associated with the node.
An example of how the NARC 210 records and stores observation data for a received network address is described with reference to
Use of NARC in DoS Attacks
The computer network 610 includes one or more networks that are operated by network service providers (NSPs) 625. The routers 140 route communication data packets between the various networks 625 in the computer network 610 by examining network destination addresses contained in the data packets according to well-known processes. A plurality of zombies 635 have access to the network 610, such as, for example, through respective telephone company (Telco) networks 640. As mentioned, the zombies 635 are computers that are operated in a malicious manner in an attempt to conduct DoS flooding attacks on an intended victim, such as on the local network 615 and the associated server 620. The network NARCs[n] 210 b, 210 c, 210 d, 210 e are deployed to protect the local network 615 and are located at various points in the communication path between the zombies 635 and the local network 615. It should be appreciated that data packets originating at the zombies 635 must pass through at least one of the network NARCs[n] 210 b, 210 c, 210 d, or 210 e in order to reach the server 620. It should be appreciated that a single NARC that functions as both a detector NARC and a network NARC could also be used, although a plurality of NARCs could also be distributed as shown in
Returning to the flow diagram of
In the next operation, the detector NARC[d] 210 detects a DoS flooding condition at the ingress to the local network, as represented by the flow diagram box numbered 510 of
After the detector NARC[d] 210 a has detected a DoS flooding condition, the detector NARC[d] 210 a transmits an alarm signal in an upstream direction of the network 610, as represented by the flow diagram box numbered 520 of
The alarm signal includes information that identifies one or more characteristics of the offending traffic. The identified characteristics can be in the form of attribute data comprised of one or more values for an attribute contained in the offending data packets, such as the type of protocol of the offending data packets (such as, for example, TCP, UDP, ICMP, or IP), the source and/or destination network addresses of the offending data packets, and the source and/or destination ports associated with the offending data packets, as well as other information. For example, the attribute data can define one or more source network addresses, wherein the detector NARC[d] 210 a extracts the source network address from an offending data packet and embeds the source address in the alarm signal, which thereby indicates to a receiving NARC that packets with the identified source address are offending traffic. The alarm signal may be implemented as a User Datagram Protocol (UDP) packet that contains data fields that indicate, for example, a timestamp, the IP address of the detector NARC[d] sending the packet, the characteristic of the offending traffic, a flag indicating the action to be performed by the network NARC[n] (filter or traceback message), and a digital encryption signature.
The data signal that is transmitted pursuant to the alarm signal operation 520 of
With reference again to
The network NARC[n] 210 (such as the network NARC 210 b in
The next operation is represented by the decision box numbered 540 in
If there is no match (a "No" result from the decision box numbered 540), then this result indicates that the offending data packets did not pass through the host router of the network NARC[n] 210 that received the alarm signal. In such a case, the network NARC[n] 210 simply ignores the alarm signal and need not take any action in response to the alarm signal, as represented by the flow diagram box numbered 550. Alternately, the network NARC[n] 210 can send a confirmation signal to the originator of the alarm signal notifying it that the offending traffic did not pass through the network NARC[n] 210.
If the network NARC[n] 210 that received the alarm signal determines that the attribute identified in the alarm signal indeed matches one or more attributes in its network traffic records, a "Yes" results from the decision box numbered 540. This result indicates that the offending data packets may have traveled through the host router 140 of the network NARC[n] 210 prior to arriving at the detector NARC[d] 210 that originated the alarm signal. It also indicates that at least one of the offending data packets originated at a location upstream of the network NARC[n] 210 that received the alarm signal. The network NARC[n] 210 that received the alarm signal then initiates one or more alarm signal response actions, as indicated by the flow diagram box numbered 560. The alarm signal response actions are described in more detail below with reference to the flow diagram shown in
Alternately, a NARC can send downstream identification messages to other NARCs to indicate the presence and location of the NARCs sending the identification message. This can be carried out at regular time intervals. The identification messages can be intercepted by downstream network NARC[n]s located between the sending NARC and the receiving NARC. The intercepted identification message can provide information to a downstream network NARC[n] regarding the presence of one or more upstream network NARC[n]s that recognize the same NARC[d] and can therefore be used for forwarding alarm signals.
With reference again to the flow diagram of
With reference again to the flow chart of
In the next operation, represented by the flow diagram box numbered 725, the network NARC[n] 210 that identified the presence of offending traffic establishes a filter at its host router 140. The filter limits or prevents the traffic that matches the attribute data in the received alarm message from exiting through the NARC's host router 140.
Detection of DoS Flooding Condition
As discussed above, the detector NARC[d] 210 a detects when a DoS flooding condition is present in an associated router 140 and sends out an alarm signal in response. In one embodiment, the detector NARC[d] 210 a detects a flooding condition based upon the observed accumulated appearance of data packets having predetermined attribute data, as reflected by the records that the detector NARC[d] 210 a maintains. As mentioned, a NARC[d] 210 a maintains such attribute records in one or more data structures, such as a binary tree for network addresses and arrays for ports and flags.
As noted above, for each specific instance of a data packet attribute (such as a specific source address or destination address), the detector NARC[d] 210 a maintains observation data, including a timestamp (LT) and a fill level (FL). A threshold value (T) and a leak rate (R) are also associated with the attributes. The threshold T and leak rate R are arbitrarily set by an operator, such as during router configuration. The timestamp indicates the last time that the detector NARC[d] 210 a encountered a data packet with a specific instance of that attribute. The fill level indicates the accumulated times that the detector NARC[d] 210 a has encountered a data packet with that attribute. In other words, the fill level indicates the bandwidth consumption over time for data packets with a specific attribute value. The threshold T is the point at which an alarm signal is sent. If the fill level for an attribute exceeds the threshold T for that attribute, then this is considered to be an indication of a DoS flooding condition and an alarm signal is sent. The NARC detector 210 can periodically decrease the fill level FL for an attribute at a leak rate R, as described below.
For example, assume that DoS flooding is detected based upon the detector NARC[d] 210 observing an increased flow of data packets having the same source address or the NARC[d] 210 observing an increased flow of data packets from a block of source addresses. Over time, the detector NARC[d] 210 will have recorded a fill level for certain source addresses as the detector NARC[d] 210 encounters data packets with the source address. On each observation of a data packet with that source address, the NARC[d] 210 increases the fill level FL of each corresponding node in the source address binary data tree to reflect the accumulated observance. However, the NARC[d] 210 also periodically decreases the fill level at a rate R, such as according to a "leaky bucket" algorithm. If the fill level FL for a source address exceeds the corresponding threshold T for a tree node, then the source addresses included in the node are considered harmful and are classified as an attribute to be filtered out. An alarm signal is then sent as described above. The alarm signal identifies the source addresses that are included in the node for which the fill level FL exceeded the threshold T.
This process is described in more detail with reference to
The next operation is represented by the flow diagram box numbered 1020, where the detector NARC[d] 210 updates the observation data in connection with the packet's specific attributes. Thus, every time the NARC[d] 210 receives a packet, it increases the fill level for the specific instances of the attributes in the packet. For example, the packet will have a specific source IP address that indicates the IP address where the packet originated. The detector NARC [d] 210 will increase the fill level associated with the specific source IP address in the received packet so that every time that the NARC[d] encounters a packet with that source IP address, it increases the fill level for that address. The fill level can therefore be considered a metric that indicates the accumulated usage over time of the corresponding attribute value. The detector NARC [d] can periodically decrease the fill levels at a rate R, so that the fill levels will decrease over time. Thus, the fill level for a given attribute value can decrease to zero if a packet with that attribute value is not encountered for a certain period of time.
In the case of source and destination addresses, the NARC[d] 210 updates the fill levels for the nodes in the binary tree that correspond to the addresses. Thus, when a NARC 210 encounters a data packet, it updates the fill levels of each applicable node in the data structures corresponding to the destination and source addresses in the packet. Thus, the fill levels for the destination address and source address attributes can be associated with a specific address or with a group of addresses, depending on the node, and each node will have a corresponding fill level that is indicative of the accumulated usage of the source addresses represented by that node. In order to simplify the maintenance and comparison of tree nodes at different levels, both the leak rate and the thresholds for each node are weighted by multiplying them by the a normalizing parameter that is based on the level of the node in the tree. In one embodiment, the normalizing parameter is the following:
where Base is a configurable parameter <2 and level is a number from 0 to 31 that indicates the level of the node in the tree. This normalization allows the direct comparison of the bandwidth utilization of leaf nodes (host addresses) with the utilization of higher-level nodes (network addresses). It has been determined that if Base=2, the normalization function would equalize all values in the tree and any intermediate node would have a value at most equal to the average of its leaves (in case all leaves have the same FL). This does not provide effective operation. By choosing a base value less than 2, the weighting of the tree is skewed toward intermediate nodes, thus offering a convenient way to control the sensitivity of the aggregation mechanism.
Referring still to
If the detector NARC[d] 210 determines that one of the fill levels has exceeded its corresponding threshold (a "Yes" result from the decision box numbered 1025), the process proceeds to the operation represented by the flow diagram box numbered 1030. In this operation, the detector NARC[d] 210 classifies the specific instance(s) of the attribute that exceeded the threshold as "harmful", which means that data packets that have the specific instance(s) of the attribute are responsible for the DoS flooding condition. The detector NARC[d] can classify a specific instance of an attribute as harmful or can classify a group of instances of an attribute s harmful. For example, the fill level that exceeded the threshold value could be associated with a node of a source address binary tree, wherein the node represents a group of source addresses. In this case, the entire group of source address represented by that node is classified as harmful.
In the next operation, the detector NARC[d] 210 sends an alarm message that identifies the specific instances of the attribute(s) that have been classified as harmful. This operation is represented by the flow diagram box numbered 1035.
The level of sensitivity of the detector NARC's flooding detection process is generally governed by the values of the two vectors T and R (the threshold value and the leak rate). The values for T can be administratively set through configuration, while R is determined at runtime through a training phase of the detector NARC[d] 210. R is computed by training the detector NARC[d] 210, wherein the detector NARC[d] 210 observes network traffic for a sufficient amount of time while adjusting (increasing or decreasing) the values of R so that no fill levels ever exceed the value T. Over time, the training accounts for network traffic regions that have an increased frequency of appearance.
Moreover, the T values can be heuristically determined to be progressively higher for the protocol attributes that, if filtered, could affect progressively larger numbers of clients. The T values can therefore progressively increase according to the following order (1) source port; (2) source IP address; (3) TCP flags; (4) ICMP flags; (5) destination port; and (6) destination IP address. This ordering has the effect of combining the detection of all types of floods, without loss of generality, from (1) less sophisticated (with fixed source addresses or fixed flags) to (2) the most sophisticated floods which can only be filtered by the upstream filtering of destination ports or addresses.
Establishment and Maintenance of Filters
When the filters are established, the network NARCs[n] 210 b intelligently manage the filters to distinguish legitimate packets from offending or harmful packets and thereby enable the legitimate packets to pass through the filter. As used herein, a "legitimate" packet is a packet that a NARC 210 has classified as not part of a DoS flooding attack.
As discussed, the NARC 210 can filter packets based on any of a variety of attributes associated with the data packets. In one embodiment, the NARC 210 filters the packets based upon a network address contained in the packet, such as, for example, a source address or block of source addresses that was previously associated with offending traffic, which source address(es) were specified in an alarm signal. Thus, the NARC 210 will prevent packets with the specified source addresses from passing through the host router. The NARC 210 can use its binary tree data structure of source network addresses to manage the filter by flagging as harmful the node in the binary tree that corresponds to the blocked addresses. Thus, a portion of the entire source network address space will be filtered, wherein the filtered address space is identified by a node of a binary tree structure.
After the filter has been activated, the NARC 210 will continuously re-assess the filter to determine whether any packets that fall within the filter parameters have attributes that indicate that the packets should not be blocked by the filter, as represented by the flow diagram box numbered 1115. For example, if the NARC 210 is using a block of source address as a basis for the filter, the network NARC[n] 210 b identifies the node in the data tree structure that corresponds to the network source addresses identified as harmful. The identified node may form the root of a subtree that includes legitimate source addresses as well as source addresses from offending packets. Pursuant to the operation of the flow diagram box 1115, the network NARC[n] 210 b then iteratively examines each node in the subtree to determine whether any of the nodes of the subtree include network source addresses that are determined to be legitimate.
In the next operation, the NARC 210 identifies one or more specific instances of the filtered attribute that exhibit behavior that indicates that packets with the specific instance of the attribute are not part of the DoS flooding attack. This operation is represented by the flow diagram box numbered 1120. In one embodiment, the NARC 210 identifies a legitimate source address (or other attribute) by examining the "backoff" behavior of the flow of data packets that contain the source address. After the filter is installed, the flow of data packets that originated at certain source addresses will exhibit a backoff behavior associated with reliable transport protocols such as TCP or FTP. Such transport protocols require a network host device to "backoff", or lower the rate at which data packets are sent, if an acknowledgment is not received from the receiving device. However, zombie devices generally do not exhibit backoff behavior. Where the filter is activated, the associated NARC[n] 210 b will detect that the stream of data packets that originated at legitimate network devices will exhibit backoff behavior, while the stream of data packets that originated from zombies will not backoff. The network NARC[n] 210 b classifies as legitimate those source addresses where backoff behavior is detected. The backoff behavior can be detected by examining, at regular time intervals, the accumulated flow of received data packets (as represented by fill level FL) of all of the binary tree nodes associated with source addresses that have been filtered. In one embodiment, the logarithms of the sampled values are then fitted to a linear decrease (slope) using a least squares algorithm. The slope, the intercept, and the error estimations of the linear fit are combined to provide a score for each of the tree nodes below the node associated with the filtered network address. A high score in a tree node below a filtered node indicates that the tree node is exhibiting consistent backoff behavior, as exhibited in a stable and decreasing linear fit.
The NARC 210 then excludes from the filter those packets that have the specific instances of the attribute that have been classified as legitimate, as represented by the flow diagram box numbered 1125. For example, in the case of source addresses, the network NARC 210 can exclude from the filter certain nodes in the source address binary tree that correspond to legitimate addresses, as well as the subtrees rooted at those nodes. The network NARC 210 modifies the filter to exclude the legitimate source addresses so that packets with the legitimate source address can pass through the filter, as these packets originated from a source that exhibited a backoff behavior. The network NARC[n] 210 continuously examines the nodes associated with the blocked source addresses in an attempt to identify source addresses that are legitimate. In this manner, the NARC[n] 210 continuously updates the filter so that legitimate network traffic is allowed through. The examination may be repeated, for example, at regular time intervals or after a certain quantity of packets have been processed.
The filter thus functions as a shield that prevents network packets with source addresses in certain regions of the network address space from passing through the router 140. However, the shield has "holes" that exclude from the filter those network packets with source address that were identified as legitimate. In this manner, the filter is continuously adjusted to allow traffic identified as legitimate to pass through the filter.
The NARC can eventually entirely remove a filter when it is determined that the filter is no longer necessary. The network NARC[n]s continuously examine the root nodes associated with blocked addresses to detect that the presence of the filter is no longer necessary. Such detection can be performed by continuously comparing the fill level FL of the root nodes associated with blocked addresses with the FL of those nodes immediately prior to establishment of the filter. The comparison (which can be weighted by a tolerance factor that takes into account the time difference) can indicate that the filtered traffic has subsided below the level that caused the detector NARC[d] to send the alarm messages. In such a case, the filter can be removed. This technique causes the removal of filters that have a decreasing effect on the sending rate of the sources. This mechanism can be used to both detect the stop of a flooding attack as well as detect the wrongful insertion of a filter that affects the communication of sources that exhibit a backoff behavior.
The present invention has been described above in terms of one or more embodiments so that an understanding of the present invention can be conveyed. There are, however, many configurations for the disclosed network attached router coprocessors not specifically described herein but with which the present invention is applicable. The present invention should therefore not be seen as limited to the particular embodiment described herein, but rather, it should be understood that the present invention has wide applicability with respect to network denial of service protection generally. All modifications, variations, or equivalent arrangements and implementations that are within the scope of the attached claims should therefore be considered within the scope of the invention.
|Cited Patent
|Filing date
|Publication date
|Mar 7, 1990
|Jul 7, 1992
|Advanced Micro Devices, Inc.
|Apparatus and method for allocation of resoures in programmable logic devices
|Apr 28, 1992
|Aug 3, 1993
|International Business Machines Corporation
|Methods and apparatus for optimum path selection in packet transmission networks
|Dec 2, 1993
|Aug 15, 1995
|Wellfleet Communications
|System for transmitting data between systems using selected subsets of plural interconnecting bus lines and including selection of a compatible transmission speed
|Jun 12, 1997
|Oct 19, 1999
|Northern Telecom Limited
|Real time control architecture for admission control in communications network
|May 4, 1998
|Apr 4, 2000
|Cabletron Systems, Inc.
|Method and apparatus for controlling the flow of variable-length packets through a multiport switch
|Apr 24, 1997
|Jun 13, 2000
|Xaqti Corporation
|Media access control receiver and network management system
|Nov 25, 1997
|Sep 5, 2000
|International Business Machines Corporation
|Scheduling of distributed agents in a dialup network
|Sep 5, 1997
|Dec 26, 2000
|Telcordia Technologies, Inc.
|Methods and apparatus for restoring connections in an ATM network
|May 8, 1998
|Feb 13, 2001
|Method for protecting a network from data packet overload
|Jun 14, 1999
|Mar 13, 2001
|Intel Corporation
|System and apparatus to provide a backchannel for a receiver terminal in a conference
|Jun 2, 1998
|Nov 6, 2001
|Nortel Networks Limited
|Traffic route finder in communications network
|Mar 31, 1997
|Nov 6, 2001
|Sony Corporation
|Communication control method
|Dec 1, 1998
|Feb 12, 2002
|Cisco Technology, Inc.
|Detecting an active network node using a login attempt
|Nov 16, 2000
|Sep 7, 2004
|Computing Services Support Solutions, Inc.
|Packet flooding defense system
|Feb 20, 2001
|Nov 9, 2004
|Netzentry, Inc.
|Method and apparatus for limiting network connection resources
|Jun 6, 2001
|Aug 16, 2005
|Deep Nines, Inc.
|System and method for traffic management control in a data transmission network
|Mar 13, 2001
|Dec 6, 2005
|Netzentry, Inc.
|Method of maintaining lists of network characteristics
|Jul 7, 2000
|Mar 14, 2006
|802 Systems Llc
|Methods for packet filtering including packet invalidation if packet validity determination not timely made
|S. Deering et al, "RFC1883", Internet Protocol, Version 6 (IPv6) Specification (available at URL of http://www.faqs./org/rfcs/rfc1883.html), pp. 1-27, Dec. 1995.
|Steinke, S., "IP Addresses and Subnet Masks", Network Magazine, Oct. 1995 (available at URL of http://www.networkmagazine.com/shared/printableArticle.jhtml?articleID=17601068), pp. 1-3 and Table 1 and Table 3.
|Citing Patent
|Filing date
|Publication date
|Nov 12, 2004
|Dec 29, 2009
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
|Jun 3, 2005
|Feb 16, 2010
|Sprint Communications Company L.P.
|Detecting and addressing network attacks
|Sep 21, 2005
|Jul 13, 2010
|Fujitsu Limited
|Intrusion detection and prevention system
|Dec 14, 2005
|Sep 14, 2010
|At&T Corp.
|System and method for avoiding and mitigating a DDoS attack
|Oct 30, 2006
|Jan 25, 2011
|At&T Intellectual Property I, Lp
|Methods, systems, and computer program products for automatically configuring firewalls
|Mar 30, 2007
|Oct 18, 2011
|Amazon Technologies, Inc.
|Providing continuing service for a third-party network site during adverse network conditions
|Nov 6, 2009
|Apr 3, 2012
|Sprint Communications Company L.P.
|Detecting and addressing network attacks
|Jul 25, 2008
|Jun 12, 2012
|Xangati, Inc.
|Parallel distributed network monitoring
|Mar 30, 2007
|Jun 26, 2012
|Amazon Technologies, Inc.
|Protecting network sites during adverse network conditions
|Feb 12, 2010
|Jul 24, 2012
|Sprint Communications Company L.P.
|Shared tap DOS-attack protection
|Nov 12, 2004
|Aug 7, 2012
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for tracing the origin of network transmissions using n-gram distribution of data
|Jan 14, 2008
|Oct 9, 2012
|Hewlett-Packard Development Company, L.P.
|Method and system for protecting a computer network against packet floods
|Mar 30, 2007
|Nov 13, 2012
|Amazon Technologies, Inc.
|Monitoring a network site to detect adverse network conditions
|Aug 1, 2007
|Jan 1, 2013
|Alaxala Networks Corporation
|Traffic analysis apparatus and analysis method
|Mar 1, 2007
|Jan 15, 2013
|Alcatel Lucent
|Method and apparatus for filtering data packets
|Oct 4, 2007
|Mar 19, 2013
|Cisco Technology, Inc.
|Distributing policies to protect against voice spam and denial-of-service
|Jul 25, 2008
|May 28, 2013
|Xangati, Inc.
|Network monitoring using virtual packets
|Oct 3, 2006
|Oct 22, 2013
|Georgia Tech Research Corporation
|Method and system for detecting and responding to attacking networks
|Jan 5, 2011
|Nov 5, 2013
|Damballa, Inc.
|Method and system for detecting malware
|Jun 1, 2011
|Nov 26, 2013
|Raytheon Bbn Technologies Corp.
|Systems and methods for decoy routing and covert channel bonding
|Jan 25, 2012
|Jan 14, 2014
|Damballa, Inc.
|Method and system for detecting malicious domain names at an upper DNS hierarchy
|Jul 25, 2008
|Jan 28, 2014
|Xangati, Inc.
|Network monitoring of behavior probability density
|Nov 10, 2009
|Feb 4, 2014
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for detecting payload anomaly using N-gram distribution of normal data
|Jul 25, 2008
|Feb 4, 2014
|Xangati, Inc.
|Network monitoring using bounded memory data structures
|Oct 5, 2011
|May 13, 2014
|Mcafee, Inc.
|Distributed system and method for tracking and blocking malicious internet hosts
|Jan 18, 2011
|Sep 2, 2014
|Damballa, Inc.
|Method and system for network-based detecting of malware from behavioral clustering
|Jul 17, 2012
|Apr 7, 2015
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for tracing the origin of network transmissions using N-gram distribution of data
|Apr 11, 2014
|Jul 21, 2015
|Level 3 Communications, Llc
|Incremental application of resources to network traffic flows based on heuristics and business policies
|Mar 30, 2007
|Sep 22, 2015
|Amazon Technologies, Inc.
|Protecting a network site during adverse network conditions
|Mar 30, 2007
|Sep 29, 2015
|Amazon Technologies, Inc.
|Detecting adverse network conditions for a third-party network site
|Aug 30, 2013
|Oct 20, 2015
|Damballa, Inc.
|Automation discovery to identify malicious activity
|Jan 2, 2014
|Mar 1, 2016
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for detecting payload anomaly using N-gram distribution of normal data
|Aug 30, 2013
|Apr 5, 2016
|Georgia Tech Research Corporation
|Method and systems for detecting compromised networks and/or computers
|Feb 20, 2013
|May 10, 2016
|Markport Limited
|Message flooding prevention in messaging networks
|May 13, 2014
|Jul 5, 2016
|Mcafee, Inc.
|Distributed system and method for tracking and blocking malicious internet hosts
|Jul 16, 2015
|Oct 18, 2016
|Level 3 Communications, Llc
|Incremental application of resources to network traffic flows based on heuristics and business policies
|May 9, 2016
|Nov 8, 2016
|Markport Limited
|Message flooding prevention in messaging networks
|Aug 9, 2011
|Dec 6, 2016
|Damballa, Inc.
|Method and system for determining whether domain names are legitimate or malicious
|Sep 30, 2013
|Dec 20, 2016
|Damballa, Inc.
|Method and system for detecting malware
|Sep 28, 2015
|Jan 17, 2017
|Amazon Technologies, Inc.
|Detecting adverse network conditions for a third-party network site
|Aug 30, 2013
|Jun 13, 2017
|Damballa, Inc.
|Historical analysis to identify malicious activity
|Dec 4, 2013
|Jun 20, 2017
|Damballa, Inc.
|Method and system for detecting malicious domain names at an upper DNS hierarchy
|Mar 25, 2015
|Aug 29, 2017
|Amazon Technologies, Inc.
|Network packet prioritization
|Mar 11, 2014
|Sep 26, 2017
|Amazon Technologies, Inc.
|Dynamically deploying a network traffic filter
|Nov 12, 2004
|Dec 1, 2005
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for tracing the origin of network transmissions using n-gram distribution of data
|Nov 12, 2004
|Dec 22, 2005
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
|Nov 12, 2004
|Jan 19, 2006
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for identifying files using n-gram distribution of data
|Jan 27, 2006
|Aug 3, 2006
|Zur Uri E
|Method and system for mitigating denial of service in a communication network
|Apr 14, 2005
|Oct 19, 2006
|International Business Machines Corporation
|System, method and program product to identify a distributed denial of service attack
|Sep 23, 2005
|Dec 14, 2006
|Fujitsu Limited
|Frame-transfer control device, DoS-attack preventing device, and DoS-attack preventing system
|Sep 21, 2005
|Dec 21, 2006
|Fujitsu Limited
|Intrusion detection and prevention system
|Dec 21, 2005
|Jun 21, 2007
|Lu Hongqian K
|System and method for detecting network-based attacks on electronic devices
|Oct 3, 2006
|Jan 31, 2008
|Damballa, Inc.
|Method and system for detecting and responding to attacking networks
|Aug 1, 2007
|May 29, 2008
|Yoshinori Watanabe
|Traffic analysis apparatus and analysis method
|Oct 30, 2006
|Jun 19, 2008
|Jeffrey Aaron
|Methods, systems, and computer program products for automatically configuring firewalls
|Jan 14, 2008
|Jul 24, 2008
|Hewlett-Packard Development Company, L.P.
|Method and system for protecting a computer network against packet floods
|Mar 1, 2007
|Sep 4, 2008
|Yuliy Baryshnikov
|Method and apparatus for filtering data packets
|Jul 5, 2007
|Jan 8, 2009
|Alcatel Lucent
|Distributed defence against DDoS attacks
|Oct 4, 2007
|Apr 9, 2009
|Cisco Technology, Inc.
|Distributing policies to protect against voice spam and denial-of-service
|Sep 19, 2008
|Oct 8, 2009
|Avaya Inc.
|Multi-tier security event correlation and mitigation
|Aug 10, 2009
|Feb 11, 2010
|Perdisci Roberto
|Method and system for detecting malicious and/or botnet-related domain names
|Nov 10, 2009
|Mar 4, 2010
|Stolfo Salvatore J
|Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
|Nov 2, 2007
|Jun 3, 2010
|Tao Peng
|System and process for detecting anomalous network traffic
|Jan 5, 2011
|Jul 7, 2011
|Antonakakis Emmanouil
|Method and system for detecting malware
|Jun 1, 2011
|Dec 6, 2012
|Raytheon Bbn Technologies Corp.
|Systems and methods for decoy routing and covert channel bonding
|Oct 5, 2011
|Apr 11, 2013
|Mcafee, Inc.
|Distributed System and Method for Tracking and Blocking Malicious Internet Hosts
|Jul 17, 2012
|Jul 4, 2013
|The Trustees Of Columbia University In The City Of New York
|Apparatus method and medium for tracing the origin of network transmissions using n-gram distribution of data
|Jun 27, 2013
|Jan 2, 2014
|Tellabs Oy
|Method and a device for detecting originators of data frame storms
|Feb 20, 2013
|Jan 15, 2015
|Markport Limited
|Message flooding prevention in messaging networks
|Feb 20, 2015
|Aug 13, 2015
|Netflow Logic Corporation
|Method and system for confident anomaly detection in computer network traffic
|Mar 30, 2012
|Oct 29, 2015
|Nokia Corporation
|Identity based ticketing
|Feb 19, 2016
|Jun 16, 2016
|Manuel Diaz
|Ddos protection infrastructures using ip sharing across wide area networks
|U.S. Classification
|726/22, 709/227, 726/23, 726/13, 726/24
|International Classification
|Cooperative Classification
|European Classification
|Nov 15, 2002
Owner name: REACTIVE NETWORK SOLUTIONS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RICCIULLI, LIVIO;REEL/FRAME:013498/0083
Effective date: 20021105
|Oct 14, 2003
Owner name: J9 CORPORATION, CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:REACTIVE NEWORK SOLUTIONS, INC.;REEL/FRAME:014581/0882
Effective date: 20030630
Owner name: NETZENTRY INC., CALIFORNIA
Free format text: CHANGE OF NAME;ASSIGNOR:J9 CORPORATION;REEL/FRAME:014587/0744
Effective date: 20030807
|Jul 13, 2011
|Fee payment
Year of fee payment: 4
|Jul 29, 2015
|Fee payment
Year of fee payment: 8
|Oct 11, 2016
Owner name: WESTERN ALLIANCE BANK, CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:XANGATI, INC.;REEL/FRAME:039989/0821
Effective date: 20161011
|Oct 12, 2016
Owner name: TRIPLEPOINT VENTURE GROWTH BDC CORP., CALIFORNIA
Free format text: SECURITY INTEREST;ASSIGNOR:XANGATI, INC.;REEL/FRAME:039995/0825
Effective date: 20161011


text:
View the Latest Version of Qube Horizon
Start increasing your income potential with advanced business intelligence.
What could more advanced business intelligence do for your income potential? Our demo shows how Qube Horizon can help you:
- Manage your cross-border real estate portfolio with multi-language and multi-currency functionality
- Enhance your revenue with advanced business intelligence
- Streamline processes and increase efficiency
- Envision your KPIs with integrated dashboard reporting tools
Book your demo now to see how companies like LaSalle Investment Management, Redevco, Hammerson and Cadogan are using Qube Horizon to better increase their income potential.


text: This updated bestseller offers aspiring project managers a unique and inspiring way to prepare for the latest PMBOK exams, using the highly effective Head First method. With its visually rich format designed for the way the brain works, this book is ideal for Project Management Professionals (PMPs) who want to obtain or renew their certification. Using the Head First learning concept, this new edition provides much-needed coverage of the latest PMBOK (Project Management Body of Knowledge) objectives and certification exam. The book teaches underlying concepts so that anyone can understand the PMBOK principles and pass the certification exam with flying colors.


text: Will be at the Wickanninnish for 2 nts. A friend told me to have lunch at the Pointe to appreciate the view is better than dinner as it gets dark. But we are going in June, so if we have dinner around 7 or 7:30 is the view gone? Also, where to eat the second night?


text:
Investor Contacts
Investor enquiries
Telephone: 01277 286931
E-mail: email@example.com
Shareholder enquiries
Capita Registrars are McColl's share registrars and should be able to help with any queries relating to dividend payments and the buying and selling of shares.
Telephone: 0871 664 0300 (calls cost 10 pence per minute plus network extras)
Lines are open Monday - Friday, 9:00am - 5.30pm (from outside the UK: +44 (0) 208 639 3399)
E-mail: email@example.com
Media enquiries
For media related queries please view our Media contacts web-page.
Customer enquiries
For customer service queries please contact our Customer Service team.


text:
Organizing. What does it seem that managers over-delegate responsibility or pawn off their jobs to people below them? Who do you handle complaints form employee that they might have about upper management and how they are treated by them?.
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Rondell--high tech company with rapidly changing Tech. Frank was recently hired. Predecessor lasted 10 months and one before him took to drinking. Problem in ES.
ES does pre-production lay out and design. Doc Reeves has many new ideas (over 900/year) and ES expected to modify pre-production changes quickly. Reeves underestimates time to implement.
Production complains about sloppy work in ES (Schwab). Forbus gets "a sack" for a Christmas present. Reason--costly delays that influenced customer satisfaction.
What would you do with Rondell. Are the problems Forbus or the structure? Assume you are on the management team and will make a recommendation.
HOW TO IMPROVE the structure? Assume you are on the management team and will make a recommendation.
SUBSYSTEM Integration
Rules and procedures
Direct contact among managers
Liaison roles
Task forces
Matrix organizations


text:
Cloud Platform: A Business Priority Summary Solution
By leveraging the SAP HANA Cloud Platform, companies can engage customers, optimize business processes, and unleash new revenue streams by quickly building innovative, consumer-grade, and industry-specific cloud applications. With SAP HANA Cloud Platform companies can extend and integrate current cloud solutions. Download the Document


text:
U.S. Representative Kevin Brady (R-TX), chairman of the U.S. Congress Joint Economic Committee, today re-introduced the Sound Dollar Act to reform the Federal Reserve. He also introduced the Centennial Monetary Commission Act which - on the 100th anniversary of the Federal Reserve - establishes a national bi-partisan commission to review the institution's conduct of monetary policy over the past century and make recommendations to Congress on its future role.
"In order to preserve the strongest economy in the world throughout the 21st Century, we need to get the role of the Federal Reserve right," Brady said. "A sound dollar is the best foundation for creating jobs and growing America's economy. And, frankly, keeping prices stable over the long term is truly the only outcome that monetary policy can impact."
The Sound Dollar Act, which has 51original sponsors in the House, focuses the Fed on a single mandate of price stability to grow the economy, imposes credit neutrality on the Fed by limiting future purchases to U.S. treasuries except in emergencies and expands the voting membership of the Federal Open Market Committee to all 12 regional presidents to ensure all voices of the U.S. economy are heard.
"We need to make sure that the Federal Reserve is representing the interests of the entire nation, not just those of Washington and Wall Street."
Other reforms include speeding the public release of FOMC transcripts from five years to three, closing the Exchange Rate Stabilization slush fund and returning $50 billion to the U.S. treasury and placing the new Consumer Financial Protection Bureau back under regular congressional funding and oversight.
"A Fed independent of political interference is critical. Since subsidies die hard in Washington,it's important to limit future Fed purchases to U.S. treasuries, remove the politically charged CFPB from Fed funding and make sure the entire U.S. economy is represented in decisions regarding open market actions," said Brady.
Of the monetary commission, which Brady is introducing with representatives Jim Jordan of Ohio and Marcia Blackburn of Tennessee, "The purpose is to conduct a full and objective evaluation of the Federal Reserve System with an eye to making recommendations to modernize the Federal Reserve and its operations. Since this year marks the 100th anniversary of the creation of the Federal Reserve System, it's the right time to examine the Federal Reserve and our monetary system to make sure they're operating in the best interests of the nation."
Source: http://kevinbrady.house.gov/brady-news-releases/brady-reintroduces-sound-dollar-act-to-reform-federal-reserve/


text:
December 24, 2012 BY John Kim
Much discussion regarding the new Air Jordan XX8 and its funky zipper construction has been one of the hot debates for kicks this month, but let's not forget that the glove-like fit for bball kicks was a concept done years ago! Gary Payton's Nike Zoom Flight '98 'The Glove' is the shoe we're talking about and after some rumors regarding a re-release came about roughly a year ago, we got some confirmation from the loud-mouth himself; 'The Glove' is making a comeback this March 2013, so let us know what your thoughts are on this Retro release and stay tuned to Sneaker News for more updates.
Filed under: Basketball Nike Retro Upcoming Sneakers


text:
Texas Medicare is health insurance program which covers mostly your health care costs. Texas Medicare is offered by the Federal government.
Texas Medicare Prescription drug coverage is also called Part D in Medicare.
Texas Prescription drug coverage is offered to those who already have enrolled in Medicare Part A and/or Medicare Part B.
Texas Medicare Advantage Plan is also called Part C Plan provided by private insurance companies approved by Medicare.
It covers all of Part A (Hospital insurance) and all of Part B (Medical insurance) health care services.
Medicare Advantage Plan covers all except hospice care.
Texas Medicare Supplement Insurance or Medigap policy is the health care insurance policy offered by private insurance companies. It covers the services which Original Medicare does not provide.
These gaps in the original Medicare are filled in by Medicare supplement insurance policies.
Texas Medicaid is a program that helps coverage for people with low monthly income, disabled people, pregnant women and limited assets .It is a joint Federal and state program.
Texas Medicaid is the national health care program which compensates health care cost by paying doctors, hospitals and pharmacy stores who accept the Medicaid service.
Texas long term care insurance provides people long term cost compensation of care. Texas long term care helps senior people to perform their activities of daily living (ADLs).


text:
Registered University of Hartford Student Organizations and Departments only. Non-University of Hartford Clients must contact (860) 768-4283 for further assistance.
Please add a detailed description of what your event is or what the space is being used for. This description will determine the necessary steps to move forward with your request and maybe used for the University calendar.
Please enter your 6-digit fund number here.
Please enter your 4-digit organization number here.
Please enter your 5-digit subaccount number here.
Ex. Every Second Tuesday, Once a month, etc. Please list the dates of your event
Please note that setup times are for you to perform soundchecks, rehearse, set up decorations, etc. SCA will have the room set up by the time you indicate here.
Please note that breakdown times are for you to remove decorations, clean up after your event, etc. SCA will start setting for the next event after the time you indicate here.
If yes, once request is completed please contact Catering Services at 860.768.5017 or email:
Please note that if your food is not being catered by Dining Services you must request a food wavier by contacting the Director of Catering at 860.768.5017 or email:
South Cafe can be reserved after 3:00 p.m. Monday - Thursday.
North Cafe can be reserved all day Monday - Friday.
North and South can be reserved after 3:00 p.m. Friday
Note: Hawk Hall classrooms are available to be reserved after 5 pm Monday -Thursday
Note: All Konover reservations MUST be made at least two (2) weeks prior to the event date.
PLEASE NOTE: The Private Dining Room in the University Commons will not be available during the following times: Monday through Friday: 11:00 a.m. - 3:00 p.m. Monday through Friday: 5:00 p.m. - 9:00 p.m. Saturday and Sunday: 11:00 a.m. - 3:00 p.m. Saturday and Sunday: 5:00 p.m. - 8:00 p.m.
If you have a special set up, please upload your diagram for it below.
Note: 4ft Black Tables are commonly used for Tabling Events in Suisman Lounge
Note: 6ft Black Tables are commonly used for Tabling Events in Suisman Lounge
Note: Konover Round tables are stored and used for events in the Konover Great Room
Note: Cocktail tables can be transported to different locations for a small delivery fee
Note: Marble tables are stored on the third floor of GSU for meeting spaces. Marble tables are also located in Konover Great Room for events as well.
*** Please provide a detailed description of your event if you would like your event posted on UNotes or the University Calendar
You are required to use the HawkHub and Student Centers Guest Services if the event includes an entry fee or any transfer of funds.
If yes, please the following information to build the event on Hawk Hub: sales/end time/date, number of tickets to be sold, ticket pricing and information to be printed on ticket.
Ex. SCA Information Session
Sales Start 8/21
Sales End 8/29
Student Price $5
Guest Price $7
Info Ticket: SCA Information
All Conference Rooms in Gengras Student Union are equipped with a Projector and Projector Screen. Please indicate what equipment should be provided for your event. **Larger setups that require event staff could be subject to a fee. **
Please add any additional information about your event or your needs to ensure that we can provide you the best service possible. For example, stage size, orientation of tables, additional event volunteers/chaperones, etc.


text:
Systems Planning Office
About Quality/Level of Service Measurement
FDOT's Quality/Level of Service (Q/LOS) Handbook and accompanying software are intended to be used by engineers, planners, and decision makers in the development and review of roadway capacity and quality/level of service for planning-level analysis.
Quality/Level of Service
Materials based on the 2010 HCM and the use of Standard K
- 2013 QLOS Handbook
- 2012 Generalized Service Volume Tables (pdf file - 946 kb)
- 2012 LOSPLAN Software
Florida DOT Guidelines
FDOT adopted an internal policy on the application of Level of Service standards and calculation procedures for the many FDOT offices. It is FDOT's statutory authority to maintain operating standards for the State Highway System and adequate mobility through the implementation of LOS standards.
- LOS Policy (April 2017)
Level of Service Information by District
In support of the Strategic Intermodal Systems (SIS) Planning Process and other statewide planning applications, each District prepares Level of Service (LOS) information. This information is maintained by each District. All available information is posted on this webpage. If information for a District is not shown, please contact the appropriate District Coordinator, provided in the links below, to request LOS information.
District Information


text:
Rating agencies' signals during the European sovereign debt crisis: Market impact and spillovers
The ongoing financial crisis has drawn considerable attention to the role of credit rating agencies in the financial system. We examine how the foreign exchange market reacts to sovereign credit events prior to (2000–2006) and during the crisis (2006–2010). The sample includes a broad set of countries in Europe and Central Asia in order to investigate spillover effects. We find that rating agencies' signals do affect the own-country exchange rate and we identify strong spillover effects to other countries' exchange rates in the region. In both cases, the impact of outlook and watch signals is stronger than the impact of actual rating changes. Market reactions and spillovers are far stronger during the financial crisis period than pre-crisis. Negative news from all three major agencies has an impact, whereas only Moody's positive news produces a reaction. Negative news from Fitch tends to have the strongest effect. The findings are important in enhancing understanding of the role of rating agencies and the market response to their signals.
If you experience problems downloading a file, check if you have the proper application to view it first. In case of further problems read the IDEAS help page. Note that these files are not on the IDEAS site. Please be patient as the files may be large.
As the access to this document is restricted, you may want to look for a different version under "Related research" (further below) or search for a different version of it.
Volume (Year): 85 (2013)
Issue (Month): C ()
Pages: 144-162
|Contact details of provider:
| Web page: http://www.elsevier.com/locate/jebo
References listed on IDEAS
Please report citation or reference errors to , or , if you are the registered author of the cited work, log in to your RePEc Author Service profile, click on "citations" and make appropriate adjustments.:
- Bertrand Candelon & Amadou N Sy & Rabah Arezki, 2011.
"Sovereign Rating News and Financial Markets Spillovers; Evidence from the European Debt Crisis,"
IMF Working Papers
11/68, International Monetary Fund.
- Rabah Arezki & Bertrand Candelon & Amadou Sy, 2011. "Sovereign Rating News and Financial Markets Spillovers: Evidence from the European Debt Crisis," CESifo Working Paper Series 3411, CESifo Group Munich.
- Edda Zoli & Silvia Sgherri, 2009. "Euro Area Sovereign Risk During the Crisis," IMF Working Papers 09/222, International Monetary Fund.
- Suk‐Joong Kim & Eliza Wu, 2011. "International Bank Flows To Emerging Markets: Influence Of Sovereign Credit Ratings And Their Regional Spillover Effects," Journal of Financial Research, Southern Finance Association;Southwestern Finance Association, vol. 34(2), pages 331-364, 06.
- Afonso, António & Furceri, Davide & Gomes, Pedro, 2012. "Sovereign credit ratings and financial markets linkages: Application to European data," Journal of International Money and Finance, Elsevier, vol. 31(3), pages 606-638.
- António Afonso & Davide Furceri & Pedro Gomes, 2011. "Sovereign credit ratings and financial markets linkages: application to European data," Working Papers Department of Economics 2011/14, ISEG - School of Economics and Management, Department of Economics, University of Lisbon.
- Afonso, António & Furceri, Davide & Gomes, Pedro, 2011. "Sovereign credit ratings and financial markets linkages: application to European data," Working Paper Series 1347, European Central Bank.
- Arnoud W. A. Boot & Todd T. Milbourn & Anjolein Schmeits, 2006. "Credit Ratings as Coordination Mechanisms," Review of Financial Studies, Society for Financial Studies, vol. 19(1), pages 81-118.
- Arnoud W.A. Boot & Todd T. Milbourn, 2002. "Credit Ratings as Coordination Mechanisms," Tinbergen Institute Discussion Papers 02-058/2, Tinbergen Institute.
- Arnoud W. A. Boot & Todd T. Milbourn, 2002. "Credit Ratings as Coordination Mechanisms," William Davidson Institute Working Papers Series 457, William Davidson Institute at the University of Michigan.
- Boot, Arnoud W A & Milbourn, Todd, 2002. "Credit Ratings as Coordination Mechanism," CEPR Discussion Papers 3331, C.E.P.R. Discussion Papers.
- Paula Hill & Robert Faff, 2010. "The Market Impact of Relative Agency Activity in the Sovereign Ratings Market," Journal of Business Finance & Accounting, Wiley Blackwell, vol. 37(9-10), pages 1309-1347, November/.
- Ferreira, Miguel A. & Gama, Paulo M., 2007. "Does sovereign debt ratings news spill over to international stock markets?," Journal of Banking & Finance, Elsevier, vol. 31(10), pages 3162-3182, October.
- Ejsing, Jacob & Lemke, Wolfgang, 2011. "The Janus-headed salvation: Sovereign and bank credit risk premia during 2008-2009," Economics Letters, Elsevier, vol. 110(1), pages 28-31, January.
- Evangelia Kasimati, 2011. "Did the climb on the Greek sovereign spreads cause the devaluation of euro?," Applied Economics Letters, Taylor & Francis Journals, vol. 18(9), pages 851-854.
- Brooks, Robert & Faff, Robert W. & Hillier, David & Hillier, Joseph, 2004. "The national market impact of sovereign rating changes," Journal of Banking & Finance, Elsevier, vol. 28(1), pages 233-250, January.
- Phylaktis, Kate & Ravazzolo, Fabiola, 2005. "Stock prices and exchange rate dynamics," Journal of International Money and Finance, Elsevier, vol. 24(7), pages 1031-1053, November.
- Mathis, Jérôme & McAndrews, James & Rochet, Jean-Charles, 2009. "Rating the raters: Are reputation concerns powerful enough to discipline rating agencies?," Journal of Monetary Economics, Elsevier, vol. 56(5), pages 657-674, July.
- Sy, Amadou N.R., 2004. "Rating the rating agencies: Anticipating currency crises or debt crises?," Journal of Banking & Finance, Elsevier, vol. 28(11), pages 2845-2867, November.
- Amadou N Sy, 2003. "Rating the Rating Agencies; Anticipating Currency Crises or Debt Crises?," IMF Working Papers 03/122, International Monetary Fund.
- Dubas, Justin M. & Lee, Byung-Joo & Mark, Nelson C., 2010. "A multinomial logit approach to exchange rate policy classification with an application to growth," Journal of International Money and Finance, Elsevier, vol. 29(7), pages 1438-1462, November.
- Hildegart A. Ahumada & Maria Lorena Garegnani, 2005. "Testing the Exogeneity of Argentine Devaluation and Default Risks in Retrospect," Oxford Bulletin of Economics and Statistics, Department of Economics, University of Oxford, vol. 67(5), pages 647-672, October.
- Eduardo Borensztein & Patricio A Valenzuela & Kevin Cowan, 2007. "Sovereign Ceilings "Lite"? The Impact of Sovereign Ratings on Corporate Ratings in Emerging Market Economies," IMF Working Papers 07/75, International Monetary Fund.
- Amadou N.R. Sy, 2009. "The Systemic Regulation of Credit Rating Agencies and Rated Markets," World Economics, World Economics, 1 Ivory Square, Plantation Wharf, London, United Kingdom, SW11 3UE, vol. 10(4), pages 69-108, October.
- Amadou N Sy, 2009. "The Systemic Regulation of Credit Rating Agencies and Rated Markets," IMF Working Papers 09/129, International Monetary Fund.
- Fama, Eugene F. & French, Kenneth R., 1989. "Business conditions and expected returns on stocks and bonds," Journal of Financial Economics, Elsevier, vol. 25(1), pages 23-49, November.
- Gande, Amar & Parsley, David C., 2005. "News spillovers in the sovereign debt market," Journal of Financial Economics, Elsevier, vol. 75(3), pages 691-734, March.
- Amar Gande & David Parsley, 2003. "News Spillovers in the Sovereign Debt Market," Working Papers 062003, Hong Kong Institute for Monetary Research.
- Benmelech, Efraim & Dlugosz, Jennifer, 2009. "The alchemy of CDO credit ratings," Journal of Monetary Economics, Elsevier, vol. 56(5), pages 617-634, July.
- Efraim Benmelech & Jennifer Dlugosz, 2009. "The Alchemy of CDO Credit Ratings," NBER Working Papers 14878, National Bureau of Economic Research, Inc.
- Alsakka, Rasha & ap Gwilym, Owain, 2010. "Leads and lags in sovereign credit ratings," Journal of Banking & Finance, Elsevier, vol. 34(11), pages 2614-2626, November.
- Hooper, Vince & Hume, Timothy & Kim, Suk-Joong, 2008. "Sovereign rating changes--Do they provide new information for stock markets?," Economic Systems, Elsevier, vol. 32(2), pages 142-166, June.
- Bannier, Christina E. & Hirsch, Christian W., 2010. "The economic function of credit rating agencies - What does the watchlist tell us?," Journal of Banking & Finance, Elsevier, vol. 34(12), pages 3037-3049, December.
- Ashoka Mody, 2009. "From Bear Stearns to Anglo Irish; How Eurozone Sovereign Spreads Related to Financial Sector Vulnerability," IMF Working Papers 09/108, International Monetary Fund.
- Hui, Cho-Hoi & Chung, Tsz-Kin, 2011. "Crash risk of the euro in the sovereign debt crisis of 2009-2010," Journal of Banking & Finance, Elsevier, vol. 35(11), pages 2945-2955, November.
- Adrian Blundell-Wignall & Patrick Slovik, 2010. "The EU Stress Test and Sovereign Debt Exposures," OECD Working Papers on Finance, Insurance and Private Pensions 4, OECD Publishing. Full references (including those not matched with items on IDEAS)
This item is not listed on Wikipedia, on a reading list or among the top items on IDEAS.
When requesting a correction, please mention this item's handle: RePEc:eee:jeborg:v:85:y:2013:i:c:p:144-162. See general information about how to correct material in RePEc.
For technical questions regarding this item, or to correct its authors, title, abstract, bibliographic or download information, contact: (Dana Niculescu)
If you have authored this item and are not yet registered with RePEc, we encourage you to do it here. This allows to link your profile to this item. It also allows you to accept potential citations to this item that we are uncertain about.
If references are entirely missing, you can add them using this form.
If the full references list an item that is present in RePEc, but the system did not link to it, you can help with this form.
If you know of missing items citing this one, you can help us creating those links by adding the relevant references in the same way as above, for each refering item. If you are a registered author of this item, you may also want to check the "citations" tab in your profile, as there may be some citations waiting for confirmation.
Please note that corrections may take a couple of weeks to filter through the various RePEc services.This information is provided to you by IDEAS at the Research Division of the Federal Reserve Bank of St. Louis using RePEc data.