<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en-CA">
	<id>https://nmsl.cs.sfu.ca/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Mma105</id>
	<title>NMSL - User contributions [en-ca]</title>
	<link rel="self" type="application/atom+xml" href="https://nmsl.cs.sfu.ca/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Mma105"/>
	<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php/Special:Contributions/Mma105"/>
	<updated>2026-04-30T22:02:26Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.35.1</generator>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4325</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4325"/>
		<updated>2011-03-29T05:57:10Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 29 ===&lt;br /&gt;
* I've addressed the questions and  I've applied the comments of the examining committee.&lt;br /&gt;
* I'm reviewing the report line by line to do a final check up and any necessary revisions.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 23 ===&lt;br /&gt;
* My defense will take place in Room 3580 Surrey. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 15 ===&lt;br /&gt;
* I submitted the report to the Examining Committee last week.&lt;br /&gt;
* I distributed hard copies as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 08 ===&lt;br /&gt;
* I submitted the revised and final draft report to the Prof after applying all the comments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 01 ===&lt;br /&gt;
* Incremental mode has been implemented and tested. The results show 65%~94% reduction of execution time.&lt;br /&gt;
* Previous set of comments have been applied.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4276</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4276"/>
		<updated>2011-03-15T00:32:14Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 15 ===&lt;br /&gt;
* I submitted the report to the Examining Committee last week.&lt;br /&gt;
* I distributed hard copies as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 08 ===&lt;br /&gt;
* I submitted the revised and final draft report to the Prof after applying all the comments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 01 ===&lt;br /&gt;
* Incremental mode has been implemented and tested. The results show 65%~94% reduction of execution time.&lt;br /&gt;
* Previous set of comments have been applied.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4260</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4260"/>
		<updated>2011-03-08T17:57:24Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 08 ===&lt;br /&gt;
* I submitted the revised and final draft report to the Prof after applying all the comments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 01 ===&lt;br /&gt;
* Incremental mode has been implemented and tested. The results show 65%~94% reduction of execution time.&lt;br /&gt;
* Previous set of comments have been applied.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4232</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4232"/>
		<updated>2011-03-01T02:20:13Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 01 ===&lt;br /&gt;
* Incremental mode has been implemented and tested. The results show 65%~94% reduction of execution time.&lt;br /&gt;
* Previous set of comments have been applied.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4231</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4231"/>
		<updated>2011-03-01T02:19:53Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== March 01 ===&lt;br /&gt;
* Incremental mode has been implemented and tested. The results show 65%~94% reduction of execution time.&lt;br /&gt;
* Previous set of comments have been applied.&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4198</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4198"/>
		<updated>2011-02-14T19:44:34Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their lengths, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4197</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4197"/>
		<updated>2011-02-14T19:44:09Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions in the order of their length, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4196</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4196"/>
		<updated>2011-02-14T19:43:02Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 15 ===&lt;br /&gt;
* All figures on the report are on eps format.&lt;br /&gt;
* I implemented and tested &amp;quot;`Tracking IP-flows&amp;quot;' instead of SIP sessions (To avoid the need to the application layer content which could be encrypted). I ran number of experiments, which showed unstable precision (low, mild, high, very high FP/FN), so I discard it.&lt;br /&gt;
* In order to improve the performance of calculating the similarity between two users from $O(N^2)$ into O(N), I redesigned the correlation\&amp;amp;detection engine to insert sessions on order of their length, then implemented 3 types of similarity/distance algorithms: Cosine Similarity, Normalized Euclidean distance, and Canberra distance. Sessions are inserted in order so that we can eliminate the session time factor. The experiments showed that I could not find a threshold value that would minimize  both FP/FN to the minimum.&lt;br /&gt;
* I almost implement incremental processing mode to improve the performance, so instead of processing the whole data within a time window, over again at every sliding window, I tried to take advantage of what has been built from the previous time window, and integrate only those new users/sessions in the new sliding time window into it. Next is to test the code, and I'm sure that it will need quite refinements.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4162</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4162"/>
		<updated>2011-02-08T01:07:08Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 08 ===&lt;br /&gt;
* Rewrite the experiments and evaluation results in a formal manner under &amp;quot;`Experimental Evaluation&amp;quot;' chapter.  (Done)&lt;br /&gt;
* Implementing \&amp;amp; Testing Identifying Sip-Botnet controllers.  (Done)&lt;br /&gt;
* Implementing and testing Test Online Mode.  (Done)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4147</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4147"/>
		<updated>2011-02-01T01:38:59Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Evaluation according to the plan (Large Scale Evaluation &amp;amp; Documentation) is complete, as following:&lt;br /&gt;
** Generated Traffics have been checked.&lt;br /&gt;
** Alpha &amp;amp; Beta has been tuned.&lt;br /&gt;
** Different traffic have been generated for different number of bots [10, 50, 100].&lt;br /&gt;
** FP/FN has been calculated for different Win [1h, 2h, 3h], and for different Sliding-Win [5m, 10m, 15m, 20m, 25m, 30m], with different number of bots.&lt;br /&gt;
** Average running time has been computed for different Win [1h, 2h, 3h] and different number of bots [10, 50, 100].&lt;br /&gt;
** A total of 34 figures have been plotted and included in the report.&lt;br /&gt;
** The attached report has all the update.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4141</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4141"/>
		<updated>2011-01-28T20:25:26Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Exporting statistics into Matlab, and fixing figures' errors (Still in progress).&lt;br /&gt;
** Generated two new 24h traffic with: one with 50 bots, and the other with 100 bots.&lt;br /&gt;
** Calculating FP/FN for all combinations and generate 24 statistic reports. I'm waiting for Prof suggestion on this matter as calculating FP/FN while applying the same setting (at least 24 different settings) will require an intensive and very long time.&lt;br /&gt;
** Export the 24 statistic reports into Matlab, and generate 24 figures.&lt;br /&gt;
** Finally and to prove the ineffectiveness of picking (Win=1h), I'll need to run some experiments to calculate FP/FN as well, plot a figure and include it in the report.&lt;br /&gt;
** Update the report.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4140</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4140"/>
		<updated>2011-01-28T20:20:34Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/Report.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Exporting statistics into Matlab, and fixing figures' errors (Still in progress).&lt;br /&gt;
** Generated two new 24h traffic with: one with 50 bots, and the other with 100 bots.&lt;br /&gt;
** Calculating FP/FN for all combinations and generate 24 statistic reports. I'm waiting for Prof suggestion on this matter as calculating FP/FN while applying the same setting (at least 24 different settings) will require an intensive and very long time.&lt;br /&gt;
** Export the 24 statistic reports into Matlab, and generate 24 figures.&lt;br /&gt;
** Finally and to prove the ineffectiveness of picking (Win=1h), I'll need to run some experiments to calculate FP/FN as well, plot a figure and include it in the report.&lt;br /&gt;
** Update the report.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4139</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4139"/>
		<updated>2011-01-28T18:43:51Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Exporting statistics into Matlab, and fixing figures' errors (Still in progress).&lt;br /&gt;
** Generated two new 24h traffic with: one with 50 bots, and the other with 100 bots.&lt;br /&gt;
** Calculating FP/FN for all combinations and generate 24 statistic reports. I'm waiting for Prof suggestion on this matter as calculating FP/FN while applying the same setting (at least 24 different settings) will require an intensive and very long time.&lt;br /&gt;
** Export the 24 statistic reports into Matlab, and generate 24 figures.&lt;br /&gt;
** Finally and to prove the ineffectiveness of picking (Win=1h), I'll need to run some experiments to calculate FP/FN as well, plot a figure and include it in the report.&lt;br /&gt;
** Update the report.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics reports.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4138</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4138"/>
		<updated>2011-01-28T18:43:19Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Exporting statistics into Matlab, and fixing figures' errors (Still in progress).&lt;br /&gt;
** Generated two new 24h traffic with: one with 50 bots, and the other with 100 bots.&lt;br /&gt;
** Calculating FP/FN for all combinations and generate 24 statistic reports. I'm waiting for Prof suggestion on this matter as calculating FP/FN while applying the same setting (at least 24 different settings) will require an intensive and very long time.&lt;br /&gt;
** Export the 24 statistic reports into Matlab, and generate 24 figures.&lt;br /&gt;
** Finally and to prove the ineffectiveness of picking (Win=1h), I'll need to run some experiments to calculate FP/FN as well, plot a figure and include it in the report.&lt;br /&gt;
** Update the report.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works (Large Scale Evaluation &amp;amp; Documentation):&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics report.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4137</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4137"/>
		<updated>2011-01-28T18:41:57Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
* Works:&lt;br /&gt;
** Exporting statistics into Matlab, and fixing figures' errors (Still in progress).&lt;br /&gt;
** Generated two new 24h traffic with: one with 50 bots, and the other with 100 bots.&lt;br /&gt;
** Calculating FP/FN for all combinations and generate 24 statistic reports. I'm waiting for Prof suggestion on this matter as calculating FP/FN while applying the same setting (at least 24 different settings) will require an intensive and very long time.&lt;br /&gt;
** Export the 24 statistic reports into Matlab, and generate 24 figures.&lt;br /&gt;
** Finally and to prove the ineffectiveness of picking (Win=1h), I'll need to run some experiments to calculate FP/FN as well, plot a figure and include it in the report.&lt;br /&gt;
** Update the report.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works:&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics report.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4136</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4136"/>
		<updated>2011-01-28T18:30:03Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
*&lt;br /&gt;
**&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works:&lt;br /&gt;
** Generated 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Ran the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics report.&lt;br /&gt;
** Exporting statistics reports into Matlab and generating figures.&lt;br /&gt;
** &lt;br /&gt;
* [[]]&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4135</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4135"/>
		<updated>2011-01-28T18:28:33Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
*&lt;br /&gt;
**&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works:&lt;br /&gt;
** Generate 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots.&lt;br /&gt;
** Tuned Alpha &amp;amp; Beta values.&lt;br /&gt;
** Run the proposed system against the generated traffic with different win sizes (3h, 2h), and different Sliding-Win sizes (5m, 10m, 15m, 20m, 25m, 30m), to calculate False Positives/Negatives, and generated 12 statistics report.&lt;br /&gt;
** Generate &lt;br /&gt;
** &lt;br /&gt;
* [[]]&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4129</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4129"/>
		<updated>2011-01-27T02:03:45Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
* '''Progress Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;br /&gt;
*&lt;br /&gt;
**&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* Works:&lt;br /&gt;
** Generate 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots, Win=3h, and Sliding-Win=15m.&lt;br /&gt;
** &lt;br /&gt;
* [[]]&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4128</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4128"/>
		<updated>2011-01-27T01:20:11Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;= Spring 2011 =&lt;br /&gt;
* '''Courses:'''  None&lt;br /&gt;
* '''Research:''' Developing Online SIP-Botnet Detection System&lt;br /&gt;
&lt;br /&gt;
=== Jan 24 ===&lt;br /&gt;
* '''Report:''' Please read &amp;quot;Progress&amp;quot; section [https://cs-nsl-svn.cs.surrey.sfu.ca/cssvn/nsl-members/alkurbi/projects/Online-Sip-Botnet-Detection/Report/Thesis/Thesis/doc/thesis.pdf here]&lt;br /&gt;
* [[]]&lt;br /&gt;
* Works:&lt;br /&gt;
** Generate 24h SIP traffic with &amp;quot;1000&amp;quot; users, &amp;quot;10&amp;quot; bots, Win=3h, and Sliding-Win=15m.&lt;br /&gt;
** &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== Feb 01 ===&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4127</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4127"/>
		<updated>2011-01-27T01:06:47Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''Spring 2011'''&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
'''Jan 25'''&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4126</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4126"/>
		<updated>2011-01-27T01:06:33Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;nowiki&amp;gt;Insert non-formatted text here&amp;lt;/nowiki&amp;gt;''''Spring 2011''''&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
'''Jan 25'''&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4125</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4125"/>
		<updated>2011-01-27T01:06:18Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;''''Spring 2011''''&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
'''Jan 25'''&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4124</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4124"/>
		<updated>2011-01-27T01:05:59Z</updated>

		<summary type="html">&lt;p&gt;Mma105: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;''Spring 2011''&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
'''Jan 25'''&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
	<entry>
		<id>https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4123</id>
		<title>Private:progress-alkurbi</title>
		<link rel="alternate" type="text/html" href="https://nmsl.cs.sfu.ca/index.php?title=Private:progress-alkurbi&amp;diff=4123"/>
		<updated>2011-01-27T01:04:57Z</updated>

		<summary type="html">&lt;p&gt;Mma105: New page: ''Italic text''Spring 2011  ---- '''Bold text'''Jan 25&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;''Italic text''Spring 2011&lt;br /&gt;
&lt;br /&gt;
----&lt;br /&gt;
'''Bold text'''Jan 25&lt;/div&gt;</summary>
		<author><name>Mma105</name></author>
	</entry>
</feed>