detecting threats in star graphs

10
Detecting Threats in Star Graphs Navid Imani, Student Member, IEEE, Hamid Sarbazi-Azad, Albert Y. Zomaya, Fellow, IEEE, and Parya Moinzadeh Abstract—In this paper, we consider the problem of searching a network for intruders. We propose a strategy for capturing the intruder in the popular interconnection topology, the star network. According to the proposed strategy, a team of collaborative software agents are responsible for capturing a hostile intruder (e.g., a virus). These agents asynchronously move along the network links, and the intruder has the capability of escaping arbitrarily fast. Index Terms—Folded star graph, graph searching, intrusion capturing, network security, spanning tree, star interconnection network. Ç 1 INTRODUCTION O NE of the important problems in distributed systems is network security. Reports show that a huge amount of money and resources are spent annually to recover information that is lost due to the attack of worms and viruses. Spyware and cookies are other examples of software agents that often enter the hosts without permis- sion and gain unauthorized access to the information that may later be used to compromise the computer system. In [17], different types of threat models in practice were reported. Here, we only consider a general form of such threats such as a piece of software (e.g., virus) that moves in the network from one node to another; we will call such an element the intruder. Our assumption of threats is quite general and can include a variety of threat models, including those presented in [17]. It is assumed that we have a team of software agents that collaborate in order to protect the network and thus have the goal of neutralizing the intruder and cleansing the entire network. Of course, the intruder is also considered to be a software agent. In order to narrow the gap between our model and the problem in the real world, we target the worst case scenario where the collaborative agents are only aware of the topology of the network and are blind in the sense that they can see neither the intruder nor other collaborators. The intruder, on the other hand, is assumed to be arbitrarily fast and can track the movement of the searchers and is intelligent enough to select the best possible move in order to evade the searchers. Although the intruder is able to cause damage to its host, it cannot imperil other agents. The purpose of our algorithm is then to move and replicate the “cleaning” agents in the network such that the intruder is finally captured by these agents. The number of agents to be involved, the number of moves the agents have to perform, and the runtime are some metrics to assess the efficiency of an intruder capturing algorithm. The concept of Intrusion Detection is extensively studied in the literature [3], [7], [9]. Most of the previous works have assumed that in the beginning, all searcher agents are present at the home base, and they move to other nodes whenever needed [9]. Our model, however, takes the assumption that agents are able to replicate; i.e., they can create a copy of themselves whenever needed. Hence, without loss of generality, we assume that there exists only a single agent at the beginning, and other agents are created gradually as the algorithm proceeds. All agents are identical; hence, we do not distinguish agents by names or labels, and when discussing the position of the agents, we are only interested in knowing which nodes are occupied by the agents rather than being concerned with the cell where a particular agent resides. The described scenario is also known as the contiguous search problem in which agents cannot be removed from the network, and clear links must form a connected subnetwork at any time, providing safety of movements [3]. This problem is NP-complete in general [18]. In fact, intrusion detection is a variant of the more general problem of Graph Searching, which is well studied in the field of discrete mathematics [2], [20], [21]. The graph search algorithms studied in the literature vary in the agents’ level of environmental information. In most of the models, it is assumed that the agents, i.e., the searchers and the intruder, have a comprehensive knowledge of their environment and can see and act according to the movement of other participants. This model is known as the basic pursuit-evasion model (or BPE for short) with complete information [2]. Besides network security, the graph-searching problem has many other applications, including pursuit-evasion problems in a labyrinth, decontamination problems in a system of tunnels, and mobile computing problems in which agents or robots are searching for a hostile intruder. Moreover, the graph-searching problem also arises in VLSI design through its equivalence with the gate-matrix layout problem [3]. The problem of intrusion detection has been studied in the literature on interconnection networks for a number of 474 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 4, APRIL 2009 . N. Imani is with Simon Fraser University, Vancouver, BC V6B 5K3, Canada. E-mail: [email protected]. . H. Sarbazi-Azad and P. Moinzadeh are with the Department of Computer Engineering, Sharif University of Technology, Tehran, Iran, and also with the School of Computer Science, Institute for Studies in Theoretical Physics and Mathematics (IPM), Tehran, Iran. E-mail: [email protected], [email protected]. . A.Y. Zomaya is with the School of Information Technologies, The University of Sydney, Building J12, Sydney, NSW 2006, Australia. E-mail: [email protected]. Manuscript received 29 Aug. 2006; revised 9 Aug. 2007; accepted 11 June 2008; published online 20 June 2008. Recommended for acceptance by X. Zhang. For information on obtaining reprints of this article, please send e-mail to: [email protected], and reference IEEECS Log Number TPDS-0249-0806. Digital Object Identifier no. 10.1109/TPDS.2008.108. 1045-9219/09/$25.00 ß 2009 IEEE Published by the IEEE Computer Society

Upload: p

Post on 10-Mar-2017

214 views

Category:

Documents


1 download

TRANSCRIPT

Detecting Threats in Star GraphsNavid Imani, Student Member, IEEE, Hamid Sarbazi-Azad,

Albert Y. Zomaya, Fellow, IEEE, and Parya Moinzadeh

Abstract—In this paper, we consider the problem of searching a network for intruders. We propose a strategy for capturing the

intruder in the popular interconnection topology, the star network. According to the proposed strategy, a team of collaborative software

agents are responsible for capturing a hostile intruder (e.g., a virus). These agents asynchronously move along the network links, and

the intruder has the capability of escaping arbitrarily fast.

Index Terms—Folded star graph, graph searching, intrusion capturing, network security, spanning tree, star interconnection network.

Ç

1 INTRODUCTION

ONE of the important problems in distributed systems isnetwork security. Reports show that a huge amount of

money and resources are spent annually to recoverinformation that is lost due to the attack of worms andviruses. Spyware and cookies are other examples ofsoftware agents that often enter the hosts without permis-sion and gain unauthorized access to the information thatmay later be used to compromise the computer system.

In [17], different types of threat models in practice werereported. Here, we only consider a general form of suchthreats such as a piece of software (e.g., virus) that moves inthe network from one node to another; we will call such anelement the intruder. Our assumption of threats is quitegeneral and can include a variety of threat models,including those presented in [17]. It is assumed that wehave a team of software agents that collaborate in order toprotect the network and thus have the goal of neutralizingthe intruder and cleansing the entire network. Of course,the intruder is also considered to be a software agent. Inorder to narrow the gap between our model and theproblem in the real world, we target the worst case scenariowhere the collaborative agents are only aware of thetopology of the network and are blind in the sense thatthey can see neither the intruder nor other collaborators.The intruder, on the other hand, is assumed to be arbitrarilyfast and can track the movement of the searchers and isintelligent enough to select the best possible move in orderto evade the searchers. Although the intruder is able tocause damage to its host, it cannot imperil other agents. Thepurpose of our algorithm is then to move and replicate the

“cleaning” agents in the network such that the intruder isfinally captured by these agents. The number of agents to beinvolved, the number of moves the agents have to perform,and the runtime are some metrics to assess the efficiency ofan intruder capturing algorithm.

The concept of Intrusion Detection is extensively studiedin the literature [3], [7], [9]. Most of the previous works haveassumed that in the beginning, all searcher agents arepresent at the home base, and they move to other nodeswhenever needed [9]. Our model, however, takes theassumption that agents are able to replicate; i.e., they cancreate a copy of themselves whenever needed. Hence,without loss of generality, we assume that there exists onlya single agent at the beginning, and other agents are createdgradually as the algorithm proceeds. All agents areidentical; hence, we do not distinguish agents by namesor labels, and when discussing the position of the agents,we are only interested in knowing which nodes areoccupied by the agents rather than being concerned withthe cell where a particular agent resides.

The described scenario is also known as the contiguoussearch problem in which agents cannot be removed from thenetwork, and clear links must form a connected subnetworkat any time, providing safety of movements [3]. This problemis NP-complete in general [18]. In fact, intrusion detection is avariant of the more general problem of Graph Searching, whichis well studied in the field of discrete mathematics [2], [20],[21]. The graph search algorithms studied in the literaturevary in the agents’ level of environmental information. Inmost of the models, it is assumed that the agents, i.e., thesearchers and the intruder, have a comprehensive knowledgeof their environment and can see and act according to themovement of other participants. This model is known as thebasic pursuit-evasion model (or BPE for short) with completeinformation [2].

Besides network security, the graph-searching problemhas many other applications, including pursuit-evasionproblems in a labyrinth, decontamination problems in asystem of tunnels, and mobile computing problems inwhich agents or robots are searching for a hostile intruder.Moreover, the graph-searching problem also arises in VLSIdesign through its equivalence with the gate-matrix layoutproblem [3].

The problem of intrusion detection has been studied in theliterature on interconnection networks for a number of

474 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 4, APRIL 2009

. N. Imani is with Simon Fraser University, Vancouver, BC V6B 5K3,Canada. E-mail: [email protected].

. H. Sarbazi-Azad and P. Moinzadeh are with the Department of ComputerEngineering, Sharif University of Technology, Tehran, Iran, and also withthe School of Computer Science, Institute for Studies in Theoretical Physicsand Mathematics (IPM), Tehran, Iran.E-mail: [email protected], [email protected].

. A.Y. Zomaya is with the School of Information Technologies, TheUniversity of Sydney, Building J12, Sydney, NSW 2006, Australia.E-mail: [email protected].

Manuscript received 29 Aug. 2006; revised 9 Aug. 2007; accepted 11 June2008; published online 20 June 2008.Recommended for acceptance by X. Zhang.For information on obtaining reprints of this article, please send e-mail to:[email protected], and reference IEEECS Log Number TPDS-0249-0806.Digital Object Identifier no. 10.1109/TPDS.2008.108.

1045-9219/09/$25.00 � 2009 IEEE Published by the IEEE Computer Society

prominent network topologies. In [9], a solution for intrusioncapturing in hypercube is proposed, while [10], [25], and [11]studied the same problem in mesh, pyramid, and chordal ringand torus, respectively. The problem of intrusion capturing inproduct networks is studied in [13].

In this paper, we tackle the problem of intrusion capturingin a well-known network topology, namely, the star inter-connection network. The star graph was proposed as anattractive interconnection network for parallel processing,featuring a smaller degree and diameter than a hypercube ofcomparable size, and is studied extensively in the literature(see [1], [6], [16], [19], [23], [26], [27], and associatedreferences). Considering the complexity of the network, theproblem of constructing spanning trees for star graphs can bequite challenging as addressed in [5] and [24].

The rest of this paper is organized as follows: In Section 2,we set forth some definitions and notations. Section 3proposes a new auxiliary graph structure, namely, the foldedstar and discusses its properties. Section 4 discusses theproblem of spanning tree construction in the star graph. Inparticular, we utilize a spanning tree on the folded star inorder to derive the desired spanning tree in the star graph. Wederive our final intrusion capturing algorithm in Section 5.And finally, Section 6 concludes this paper.

2 PRELIMINARIES AND DEFINITIONS

An n-dimensional star graph, also referred to as n-star or Sn,is an undirected graph consisting of n! nodes (vertices) andðn� 1Þn!=2 links (edges). Each node is uniquely assigned alabel a1a2 . . . an, which is the permutation of n distinctsymbols 1, 2, . . . , and n. Two nodes are joined by an edgealong dimension d if the label of one node can be obtainedfrom the other by swapping the first symbol and thedth symbol, 2 � d � n [1]. This edge is called thedth connection. Thus, we can define a function � such thatit gives the label of the node connected to a given nodea ¼ a1a2 . . . an�1an via the ith connection as �iða1 . . . anÞ ¼aia2 . . . ai�1a1aiþ1 . . . an, i 2 f2; . . . ; ng. With a little liberty inusing the notation, we may use a to mean both the stringa1a2 . . . an�1an and the vertex labeled S.

Let A ¼ fa1; . . . ; akg be the set of search agents employedto neutralize the network G. It is quite obvious that the totalnumber of agents, denoted by jAj, is not constant over theruntime of the algorithm because we assume that the searchagents are created on demand. Throughout this paper, weoften refer to a “search agent” as a “cleaning agent” orsimply as an “agent.”

Based on the premise that the intruder can only hide inthe nodes, at any given instant, an agent can only move to aneighboring node. The agents move in a way that theintruder cannot enter a node that has already neutralized,i.e., we are dealing with a contiguous node search problem.Let CðtÞ 2 V ðGÞ denote the set of clean nodes at an instant t;then, we can easily conclude that C is growing over thetime; i.e., 8k > 0, CðtÞ � Cðtþ kÞ.

Let us build a graphH � Gwhose vertex set isC and eachtwo ci and cj vertices of C are connected if and only if< ci; cj > 2 EðGÞ. As the clean nodes do not get contaminatedagain and the agents can only move to their neighboringnodes, we may simply infer thatH is a connected graph at any

instant t. We call H the clean territory hereafter. I ¼ G nH isthe part ofG that has not been cleaned yet; hence, we call it theintruder territory. It is also obvious that for some v 2 H, v isincident to some vertex in I. Let @ðHÞ be the entire set of suchvertices; we call this set the battlefront of H. The battlefrontshould always be occupied by the agents, or else, the intruderwill be able to expand its territory.

We assume that each agent can only sense whether or notits neighboring nodes are clean and performs its actionsaccording to this limited information provided about itsneighboring nodes.

A search agent in our model at any discrete time instantis capable of performing one of the following two actions:

. Move. It can move to any of its neighboring nodes inorder to extend the clean territory.

. Replicate. It can produce a new cleaning agent andinject it into a neighboring node.

Let A be a known contiguous algorithm for capturing anintruder in a graph G. As we saw before, A consists of somesteps for each agent in some vertices of G. As we have thegoal of cleaning the entire graph and knowing that the onlyway for a cleaner to capture an intruder is to be in the samevertex as the intruder, we can easily state that for each givenvertex v of G, there exists some agent a such that a doessome action in v during the runtime of the algorithm. This istrue since the cleaner should sweep all the nodes in thenetwork. Moreover, as A is contiguous, once a node iscleaned, it need not be rechecked. On the other hand, thepath that each agent takes in the graph is a connectedsubgraph of G. Based on the above arguments, we canconclude that the paths through which the agents move andreplicate builds a spanning tree for G.

Definition 1 [13]. Given a graph G and an algorithm A forcapturing an intruder in G, the spanning search tree for Adenoted by SST is a tree constructed from A in thefollowing way:

. SST has the same vertex set as G.

. The root of SST is the home vertex in G.

. If during the runtime of the algorithm, some agent aperforms a movement action maðu; vÞ, then we drawan edge between u and v and label it as m.

. If during the runtime of the algorithm, some agent aperforms a replication action raðu; vÞ, then we draw anedge between u and v and label it as r.

. Each edge of the tree is also assigned a number thatindicates the order of performing that particular actionwith respect to other actions; e.g., an action that isperformed first is labeled 1 and so on. Two edges with thesame number correspond to concurrent steps of thealgorithm.

The numbers on the edges define the way of searchingthe spanning tree, with the exception that some edges maybe traversed in parallel. Whenever the actions that aredefined for an agent in each vertex v of SST are performedconsecutively, we can simply assign the numbers to thevertices instead of labeling the outgoing edges withconsecutive numbers.

It can be easily seen that for any given vertex v of thetree, only a single edge with label m can exist; i.e., all of the

IMANI ET AL.: DETECTING THREATS IN STAR GRAPHS 475

other exiting edges should be labeled r. This is true sinceeach vertex in the battlefront is occupied by a single agent,and the additional required agents for the next stage of thealgorithm should be created with replication operationscorresponding to the edges that are labeled r.

Definition 2. We denote by R the number of edges labeled “r”and by M the number of edges labeled “m” in a given SST . Itis clear that the total number of actions performed by theagents and the number of agents employed by the algorithm areobtained as M þR and Rþ 1, respectively. These two factorsare considered as important performance criteria for anintrusion capturing algorithm.

3 FOLDED STAR

Despite its straightforward recursive definition, the stargraph has a very complex graph structure in a way that stargraphs of dimensions five or more are really hard to imagineunless one tries the recursive construction of the graph(starting from star graphs of lower dimensions). This inabilityto visualize the structure of the graph makes it even harder totraverse the graph edges contiguously in some manner. Thelarge number of vertices in the graph, on the other hand,makes the problem even more complex as the growth of thenumber of vertices (with dimension n) makes the problemsmathematically intractable for a large n due to combinatorialexplosion. In this section, in order to ease the problem ofmodeling the star graph mathematically, we propose asimplified graph structure obtained from the star graph,namely, the folded star. Later, we will utilize the folded star inorder to derive a spanning tree and, eventually, an SST forthe star graph that solves the desired graph search problem.

Definition 3 [12]. Let u and v be any source and destinationnodes and B � A ¼ fa1; a2; . . . ; ang be the set of symbolsin u whose position is changed in the permutation belongingto v. A new graph GðV ;EÞ can be constructed, whereV ¼ fkjak 2 Bg, and ði; jÞ 2 E , ui ¼ vj. An edge betweentwo vertices u and v is present if and only if in the newarrangement pertaining to the index of v, the position of theith symbol of u is j. Hereafter, we call this graph theDisplacement Graph for u and v.

Definition 4. A folded star of dimension n denoted by FSn is agraph structure obtained from n-star in the following way: Eachvertex ofFSn is obtained by grouping all the vertices ofSn whosecorresponding displacement graphs are equivalent. There is anedge between two vertices u and v of FSn if any vertexcorresponding to u in Sn is connected to some vertex in Sncorresponding to vertex v inFSn. In particular,FSn is obtainedby folding Sn by grouping all the vertices with the samesymmetric property from the base vertex in one supervertex andignoring the multiplicity of the edges of the resulting graph.

Definition 5 [12]. Let G be the displacement graph for any givensource and destination u, v, and u1 2 V ðGÞ. There is a cycle cjin the graph containing u1; we refer to this cycle as theprimary cycle of G and to u1 as the primary symbol. When cjis not primary, cj is a regular cycle.

Let V ðSnÞ be the set of all vertices in Sn. We can define anoninjective function C : V ! ðZpÞbn=2c to map each vertex vof Sn to a string CðvÞ of the form CðvÞ ¼ cbn=2c . . . c2b, ci,b 2 Zp. In particular, each given substring ci in CðvÞ

identifies the number of cycles of length i (containingi symbols) in the structure of the displacement graphcorresponding to v. The substring b, on the other hand, isobtained as the length of the primary cycle in the structureof the displacement graph corresponding to v.

The folded star is defined formally in the following way:

V ðFSnÞ ¼ C V ðSnÞð Þ;EðFSnÞ ¼ fðv; uÞjv; u 2 V ðFSnÞ ^ ð9ðx; yÞ 2 EðSnÞ

s:t:CðxÞ ¼ v; CðyÞ ¼ uÞg:

8><>: ð1Þ

As C is not injective, each string in its range (also eachvertex of FSn) is the mapping of a set of vertices of Sn, i.e.,the vertices in Sn whose displacement graphs are equivalentup to isomorphism. As C is a function (rather than arelation), it imposes a partitioning on V ðSnÞ. We name eachof these partitions with the label of the corresponding vertexin FSn, so given a string s, an s-partition of Sn denotes the setof all vertices in Sn that are mapped to vertex s. For the sakeof simplicity, we often omit the zeros in the left of CðvÞ;therefore, 2 represents a vertex whose correspondingdisplacement graphs have only a primary cycle of length 2,and 2-partition corresponds to all vertices in Sn whosedisplacement graph consists of a primary cycle of length 2,i.e., neighbors of b. Also, 0 shows the base vertex of FSn,denoted by b, which is the mapping of vertex 12 . . .n of Sn.

If we imagine each bidirectional edge as a pair ofunidirectional edges, each edge can be labeled by anoperation corresponding to the action that is performed onthe displacement graph of the source vertex to obtain thedisplacement graph of the destination vertex. In particular,we can categorize the edges in the star graph (� functionsequivalently) into a set of groups. Let us denote thisset with O; then, O ¼ fPrimeþ;Prime�;Collapse;Merge;Primize;Regularizeg. As can be seen, each element in Ohas an inverse element in the set. Hence, given an edge ecorresponding to the collapse operation from a vertex u to avertex v, there is a pair edge e0 from v to u that correspondsto the merge operation. It is easy to see that each edge inthe folded star can be labeled with a pair of inversesfrom the set f< prime�; primeþ >;< collapse;merge >;< regularize; primize >g. This property is clearly true dueto the criteria we used for grouping the vertices whilebuilding the folded star from the star graph.

We also label the vertices in Sn with a set of threesymbols S ¼ fNeutral;Prime;Regularg. A vertex v of Sn isRegular if it has the first symbol in its place; i.e., itsdisplacement graph has no primary cycle. b is the onlyNeutral vertex in Sn whose corresponding displacementgraph has no edges, and we call a vertex Prime if itsdisplacement graph has a primary cycle.

Next, we explain what each of the operations mean to us.The primeþ operation corresponds to an edge from asupervertex with a smaller displacement graph to a super-vertex with a larger displacement graph. The prime�operation, on the other hand, corresponds to an edge froma supervertex with a larger displacement graph to asupervertex with a smaller displacement graph. A collapseedge dissects a primary cycle to a primary cycle and a regularcycle, while the merge operation merges a primary cycle witha regular cycle to form a bigger primary cycle. Primize turns aregular cycle into a primary cycle, while regularize is the

476 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 4, APRIL 2009

operation that turns a primary cycle in the displacementgraph of the source supervertex into a regular cycle in thedisplacement graph of the destination supervertex.

Furthermore, we label each edge e of FSn from u to vwithtwo numbers: a negative number l� and a positive label lþ .lþ corresponds to the number of vertices in the v-partitionthat an arbitrary vertex in the u-partition is adjacent to,while l� counts the inverse of the above argument; i.e., thenumber of vertices in the u-partition that an arbitrary vertexin the v-partition is adjacent to. We also refer to these twonumbers as the negative and positive multiplicity of an edge.The structure of FS6 is shown in Fig. 1.

It is interesting to see that the folded star is smaller inorder of magnitude than the corresponding star graph,while it preserves the structure of the star graph. Theseproperties make this structure ideal for studying the graphproperties of the star graph. In what follows, we will probeinto some of the applications of the folded star.

The folded star also comes handy when considering theshortest paths in the star graph; this is because there existssome shortest path in FSn corresponding to each shortestpath in Sn. The next few theorems discuss the problem offinding the shortest path between two vertices in Sn usingthe FSn structure.

Theorem 1. Given a shortest path P between two vertices u andv in Sn, assuming that C maps u and v to two differentvertices in FSn, there exists a walk P 0 from CðuÞ to CðvÞ inFSn such that jP j ¼ jP 0j.

Proof. The mapping C of V ðSnÞ to V ðFSnÞ imposes amapping D : EðSnÞ ! DðFSnÞ of edges that projectseach edge e of Sn to an edge DðeÞ of FSn. In particular,by definition of the folded star, D can be obtained asDð< u; v >Þ ¼< CðuÞ; CðvÞ > . Now, we consider thesubgraph K2 of Sn, which consists of the edge e andtwo ending vertices u and v. It is easy to see that Dmaps e to an edge that neighbors CðuÞ and CðvÞ vertices,which is a subgraph K2 of FSn. We can generalize thisargument to conclude that each path in Sn is mapped to a

walk in FSn with the same length. If CðuÞ ¼ CðvÞ, thenobviously, there exists some other mapping like C0 basedon some other index vertex such that it preserves theshortest path between u and v. tu

Therefore, in order to find the shortest path between twovertices, say, u and v, in the star graph, it is enough to findthe vertices of the folded star to which u and v are mappedand find a walk between the respective vertices. Inparticular, if we choose u as the base vertex and constructthe folded star accordingly, each shortest path in Sn from uto any arbitrary vertex is mapped to a shortest path (ratherthan walk) in FSn. This shortest path algorithm can also beperformed without the need to reconstruct FSn andthrough renaming the symbols such that the vertex u getsthe same label as the base vertex.

Theorem 2. Given a vertex v of FSn, we denote by ½v� the sizeof v defined as the number of vertices in the displacementgraph corresponding to v. ½v� can then be obtained in thefollowing way:

½v� ¼Xn�1

i¼2

ici þ b: ð2Þ

Proof. ½v� can be easily obtained by adding up the numberof vertices in each cycle of the displacement graphcorresponding to v, which is equal to

Xn�1

i¼2

ici þ b:

ut

Theorem 3. Given a vertex v of FSn, we denote by deg�ðvÞ thenumber of incoming edges to v. deg�ðvÞ can be obtained as

deg�ðvÞ ¼ kvk; ð3Þ

IMANI ET AL.: DETECTING THREATS IN STAR GRAPHS 477

Fig. 1. The structure of FS6.

where given a string s, ksk counts the number of nonzero

digits in s.

Proof. In order to count the incoming degree of v, weconsider the displacement graph corresponding to v. Wedenote this structure by dv. In particular, we need tocount the number of displacement graph configurationsthat can be turned to dv via a single operation from theset of operations O. Clearly, if dv has a primary cycle,then there exists some displacement graph that turns todv through the “primeþ” operation. Let us assume thatvd has ci regular cycles of length i; then, we can reach to asingle new configuration by “primizeing” either of theseci cycles; thus, there exists some vertex u that neighbors vthrough a regularize edge. As i was chosen arbitrarily,especially, there exists some vertex for cycles of anylength in dv. Therefore, we can obtain the number ofincoming vertices as the number of different types ofcycles that are present in dv that can be calculated as thenumber of nonzero digits in string v. tu

Theorem 4. Given a vertex v of FSn, we denote by degþ ðvÞ the

number of outgoing edges from v. degþ ðvÞ can be obtained as

degþ ðvÞ ¼RðvÞ þ P ðvÞ;

P ðvÞ ¼1 ½v� < n;

0 ½v� ¼ n;

�RðvÞ ¼

0 b < 3;

b� 2 b � 3:

� ð4Þ

Proof. In order to obtain the number of outgoing edgesfrom v, once again, we consider the displacement graphcorresponding to v denoted by dv. The regular cyclesclearly play no role in the process as the onlyoperations that can be performed on them is “primize,”which decreases the distance from the base vertex. Weassume that dv has a primary cycle of length b. If b is atleast four, then dv can result in b� 2 new displacementgraph configurations via b� 3 collapses and a singleregularize operation. If b ¼ 3, then only a singleregularize operation can be performed on dv. On theother hand, if b < 3, then none of these two operationscan be performed. This is exactly what the R functioncalculates. A prime+ can be operated on dv only if thereare unused symbols left, i.e., jV ðdvÞj ¼ ½v� < n. This iscalculated by the P function. It is clear that degþðvÞ isobtained as the sum of R and P . tuHaving obtained the label of each vertex v of FSn, it is

easy to calculate the distance of v from the base vertex b.

This is of particular importance to us as the respective

distance is equivalent to the distance of vertices in the

v-partition from the base vertex in Sn.

Definition 6. Given a vertex v of Sn, we denote by jCðvÞj the

length of v, defined as the distance of v from the base vertex.

jCðvÞj can then be obtained from CðvÞ in the following way:

CðvÞj j ¼Xn�1

i¼2

ðiþ 1Þci þ ðb� 1Þ: ð5Þ

Theorem 5. Given a vertex v ¼ ck . . . c3c2b of FSn, the number

of vertices of Sn that are mapped to v (the v-partition) denoted

by MðvÞ is obtained as

MðvÞ ¼ ðb� 1Þ! b� 1þPn�1

i¼2

cii

b� 1

0@

1A

�Yn�1

j¼2

Pn�1

i¼jcii

cjj

0B@

1CAðj� 1Þ!cj

Ycji¼2

ij

j

� �264

375:

ð6Þ

Proof. The number of vertices in a v-partition can becalculated by counting the number of vertices in Sn thathave isomorphic displacement graphs, i.e., displacementgraphs with the same number of cycles of each lengthand primary cycles of the same length. In order tocalculate this number, we follow the process of con-structing displacement graphs using a total number of

bþXn�1

i¼2

ici

symbols, i.e., the number of symbols used in v. As we goon with this construction process, we impose somelimitations on the structure (number and length) of thecycle so that the resulting displacement graph will beisomorphic to the one v specifies. First of all, we need tobuild a primary cycle of length b. This can be easily doneby selecting b� 1 symbols in addition to the “1” symbolsout of the total number of

b� 1þXn�1

i¼2

ici

nonprimary symbols. Clearly, this can be performed in

b� 1þPn�1

i¼2

cii

b� 1

0@

1A

ways. These b� 1 symbols can be put in circular order inðb� 2Þ! ways. For each such configuration of b� 1symbols, the symbol “1” can be put in b� 1 places.Therefore, we can construct a primary cycle of length b inthe following number of ways:

ðb� 1Þ! b� 1þPn�1

i¼2

ici

b� 1

0@

1A: ð7Þ

Next, we consider construction of regular cycles startingfrom cycles of length 2. Let us assume that we want toconstruct cj cycles of length j, j > 1. By using our methodof construction, we have calculated so far all cycles oflength less than j and, hence, the total number ofremaining symbols is obtained as

Xn�1

i¼jici:

To construct cj cycles of length j, we first need to selectcjj symbols out of the remaining symbols in

Pn�1

i¼jici

cjj

0@

1A

478 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 4, APRIL 2009

ways. Then, we need to partition these cjj symbols into cjsets of length j each. This can be done by iterativeselection and disposal of j symbols in

Ycji¼2

ijj

� �

ways. We can put each of these cj symbols in ðj� 1Þways. Thus, cj cycles of length j can be formed in

Pn�1

i¼jcii

cjj

0@

1Aðj� 1Þ!cj

Ycji¼2

ijj

� �

ways. Clearly, the number of vertices in the v-partition

can be obtained by multiplying the former equation overall possible values of j and multiplying the result by (1)for the primary cycle. Thus, the final equation is finallyderived as

MðvÞ ¼ ðb� 1Þ!b� 1þ

Pn�1

i¼2

cii

b� 1

0B@

1CA

�Yn�1

j¼2

Pn�1

i¼jcii

cjj

0B@

1CAðj� 1Þ!cj

Ycji¼2

ij

j

!264

375:

ut

4 SPANNING TREE CONSTRUCTION

In this section, we derive the spanning tree and SST for thestar graph by utilizing the robust properties inherent in thefolded star. In particular, we first propose a spanning treeconstruction method for the folded star graph and latermake use of this tree for deriving the desired spanning treefor the star graph.

Definition 7. Given an FSn, we call the path composed of

vertices of the form wb, 0 � jwj, b 2 f0; 2; 3; . . . ; ng, with a

common prefix w, the w-backbone of FSn. If jwj ¼ 0, we call

the resulting backbone the �-backbone. Clearly, the

�-backbone of FSn is of length n� 1 as there are exactly

n vertices on the path, i.e., the vertices labeled 0; 2; . . . ; n.

Observation 1. All edges on backbones correspond to the

< prime�; primeþ > pair of inverse operations.

Theorem 6. The length of the w-backbone of FSn is obtained as

lenðwÞ ¼ n�Xjwjþ1

i¼2

ici � 1: ð8Þ

Proof. The length of the w-backbone is equal to thenumber of edges on the backbone. In order to obtainthis number, one should note that a backboneconsists of < prime�; primeþ > edges only. The chainof < prime�; primeþ > edges ends in a vertex, say, v,when the primary cycle corresponding to v cannotgrow anymore. This happens only when ½v� ¼ n.Through each < prime�; primeþ > operation, ½v�

increases by 1 except for the < prime�; primeþ >operation at the head of the backbone, whichincreases ½v� by two. Let u be the vertex at the headof the chain; then, the length of the backbone can beobtained as n� ½v� � 1. But the displacement graphcorresponding to u, du, may not have a primarycycle, and hence, b ¼ 0. Therefore, we can obtain

½u� ¼Xjwjþ1

i¼2

ici:

After replacing the value of ½u�, the previously proposedequation is obtained. tu

Theorem 7. A spanning tree on FSn, denoted by ST 0, can beconstructed by selecting the edges that correspond to the< prime�; primeþ > or < regularize; primize > pair ofinverse operators.

Proof. To prove that the resulting graph is a spanning tree,we should prove that 1) it spans all edges of FSn and 2) nocycles would be formed. To prove argument 1, we shouldshow that any vertex v of FSn except for the base vertexhas an incoming edge of type < prime�; primeþ > or< regularize; primize > . We envision two cases for thestructure of the displacement graph corresponding to v

denoted by dv. Either dv contains a primary cycle, in whichcase v has an incoming edge of type< prime�; primeþ > ,or dv consists of regular cycles only, in which case there isan edge of type < regularize; primize > incoming to v.Therefore, ST 0 spans all edges in FSn. To proveargument 2, we show that no cycles can be formed if wedo not use < collapse;merge > edges. We can make twoimportant observations regarding edges of FSn. First ofall, an edge of type < prime�; primeþ > can only appearin the middle of a backbone, every vertex is on somebackbone, and two backbones cannot intersect and henceare parallel. Therefore, we can conclude that eachimaginary cycle should use edges from at least twobackbones. The < regularize; primize > edges, on theother hand, connect a vertex in a middle of a backboneto a vertex at the head of the backbone, and there existsonly a single edge of this type incoming to the head ofeach backbone. Thus, we can conclude that given twoarbitrary backbones only a single < regularize; primize >can connect them together, and no cycle can be formedusing two backbones. This proves argument 2 and, hence,the theorem is proved. tu

Corollary 1. All of the backbones are included in ST 0.

Proof. This can be easily verified by checking that all edgeson a backbone are of type < prime�; primeþ > . tu

Next, we discuss the problem of spanning tree construc-tion on the star graph using the derived spanning tree forthe folded star.

Theorem 8. Any K2 subgraph of FSn is the mapping of a B1;m

subgraph of Sn, where B1;m denotes a bipartite graph whosevertices in the first and second independent sets are of degree 1and m, respectively (a forest of K1;m graphs).

IMANI ET AL.: DETECTING THREATS IN STAR GRAPHS 479

Proof. Let u and v be two vertices contained in a K2

subgraph of FSn. The set of vertices mapped to u are

independent because these vertices are at fixed distance

from the base vertex, and if there was an edge between

two of such vertices, that would form an odd cycle in

Sn, which is a contradiction. The same argument can be

stated in order to prove the independence of vertices

mapped to v. It only remains to show that the vertices

in one of the independent sets have the degree of 1. As

we noted earlier, each edge of FSn corresponds to a set

of inverse operations from set O. Therefore, an edge e

corresponds to either the following pair of operations:

< prime�; primeþ > , < merge; collapse > or < primize;

regularize > . “Prime� ,” “collapse,” and “regularize”

operations always have the multiplicity of one. There-

fore, we can conclude that the vertices in one of the

independent sets pertaining to u or v are of degree 1,

and the theorem is proved. tu

In order to build a spanning tree on the star graph, for

each edge e of ST 0 from u to v, we should decide which

edges to include from the corresponding B1;m subgraph.

With this goal, we classify the edges of ST 0 into two sets:

1. edges for which lþ � l� and2. edges with lþ < l� .

Case 1 is easy to treat as we should select all the edges in the

respectiveB1;m subgraph, or else, the resulting spanning tree

would get disconnected. In the second case, each vertex in the

v-partition is connected to more than one vertex in the

u-partition and if we choose all edges between the two

partitions, cycle(s) would be formed. Hence, we are required

to select only some ðjlþ =l� jÞ of the vertices in the u-partition

and include only edges, in the ST , branching out from those

vertices. Particularly, we should select one vertex from the set

of l� =lþ vertices that lead to the same vertex in the

v-partition. This selection can be performed by imposing an

ordering on the vertices and selecting the least ordered

vertex. All of the edges in the u-partition that are connected to

the same vertex in the v-partition have the property that their

corresponding displacement graphs have primary cycles

whose vertices are in the same order except for the vertex

labeled “1.” Therefore, if we define an ordering on these

primary cycles, we may solve the problem.

Definition 8. Given two primary cycles c and c0, we say that c

is smaller than c0 and denote it by c / c0 if the value obtained

by concatenating the vertex labels in c on the cycle starting

from 1 is less than the respective value for c0. Given two

vertices u and v in Sn with primary cycles c and c0,

respectively, we say that u is smaller than v and denote it by

u / v if c / c0.

Choosing the smallest vertex in each set of

jl� =lþ j

vertices that lead to the same vertex in the v-partition solves

the issue, and ST is constructed from ST 0.

5 THE OVERALL ALGORITHM

In this section, we use the spanning tree derived in theprevious section to present our final algorithm for intrusioncapturing in the star graph. In particular, we derive thespanning search tree for the star graph in two levels. First,we build a spanning search tree for FSn using the spanningtree construction method presented in the previous section.We denote this tree by SST 0. Then, we utilize the approachwe used for constructing ST from ST 0 to acquire thespanning search tree for the star graph, denoted by SST ,from SST 0.

As each vertex in FSn corresponds to multiple vertices inSn, the spanning search tree we build on the folded stardiffers from a usual spanning search tree in that its edgesare not only labeled by “r” and “m.” We also observe aratio �, 0 < � � 1, for each edge. This ratio shows whatpercent of vertices in the source vertex should perform themove (replicate) action. Therefore, an edge e from a vertex uto some vertex v that is labeled 0:4m means that 40 percentof agents in the vertices of the u-partition are moved to thev-partition. An edge labeled “m” or “r,” on the other hand,means that all the agents are moved to the vertices in thedestination partition. One should note that the details ofhow the agents move cannot be deduced from this labeling.Indeed, this detailed information would be providedwhile building SST from SST 0, which would completeour work.

We build SST 0 in the following steps:

a. < regularize; primize > edges of ST 0 are labeled“rjlþ =l� j.”

b. Edges on backbones, i.e., < prime�; primeþ >edges, are labeled as “ðjlþ =l� j � 1Þr.”

c. < regularize; primize > have priority in performingtheir actions over < prime�; primeþ > edges at thesame distance, while the set of edges of the sametype are assigned the same number, and hence, theiractions are performed in parallel.

Having obtained SST 0, we would look into theproblem of obtaining a spanning search tree for the stargraph from SST 0. In particular, in order to derive SSTfrom SST 0, for each edge e of ST 0, we decide which of itscorresponding edges in ST should be labeled “r” andwhich should be labeled “m.” We should also assign anumber that determines the order of operations for eachedge in SST .

A < regularize�; primizeþ > edge of SST 0 is the easiestto deal with, as we can simply label all edges mapped toone such an edge with “r.” In this case, agents can replicatein parallel, and hence, we assign the same number to all ofthese edges.

Let e be any arbitrary < prime�; primeþ > edge ofSST 0 labeled “�r.” Edges mapped to e, on the other hand,should be labeled with both labels unless � ¼ 0, in whichcase all edges are labeled “m.” As the degree of eachvertex v in the B1;k corresponding to e is �þ 1, from the setof edges adjacent to v, any arbitrary set of � edges shouldbe labeled “r,” and one edge is labeled “m.” All of theactions for the edges with the same label can be performedin parallel.

480 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 4, APRIL 2009

So far, we have labeled the edges of SST with appropriateactions (“r” or “m”). In order to complete our constructionalgorithm, we are required to assign an integer to each edge todetermine the order of actions corresponding to that edge.Once again, we make use of the labeling of SST 0 edges tofigure out the correct ordering for edges of SST . Wedetermine the ordering of edge levels by the level accordingto their distance from the root vertex. In particular, in order todetermine the order of edges of SST , we impose three levelsof priority on the edges using the following priority rules:

a. An edge e closer to the root has priority over anedge e0 farther from the root. If e and e0 are at thesame distance from the root, then refer to rule b.

b. Between two edges at the same distance from the root,the edge that is mapped to a< regularize�; primizeþ >edge of SST 0 has priority over the edge mapped to a< prime�; primeþ > edge.

c. Between two edges at the same distance from theroot, which are mapped to the same type of edge ofSST 0, the one that is labeled “r” has priority over theedge labeled “m.” If both edges have a commonlabel, they have equal priority meaning that theirrespective actions can be performed in parallel.

Clearly, an edge e that has priority over some edge e0

should be assigned a smaller number.Here is an example of how one can assign order numbers to

edges ofSST . Starting from the root, the only edge at level 1 isa < prime�; primeþ > edge, and � > 0; therefore, some ofthe edges ofSST that are mapped to this edge are labeled “r,”and the rest are labeled “m.” We cannot perform bothreplication and movement actions in parallel as it wouldbreak the battlefront, and the intruder would be able tocontaminate the cleaned vertices. Edges labeled “r” havepriority over those labeled “m,” i.e., replication actions arerequired to be performed before the movements; hence, weassign 1 and 2 to edges labeled “r” and “m,” respectively. Inthe same way, edges in level 2 are assigned integers 3 and 4. Inlevel 3, edges are mapped to two kinds of edges of SST 0.Edges mapped to the < regularize�; primizeþ > edge areassigned integer 5; Edges that are mapped to an edge in thebackbone, i.e., a< prime�; primeþ > , are assigned integers 6(those labeled “r”) and 7 (those labeled “m”). One can go onwith this process to finally assign the ordering to all of theedges in SST .

Now that we obtained the spanning search tree for thestar graph, we have an algorithm for intrusion capturing inSn on our hand. Next, we discuss the performance of theresulting algorithm.

Theorem 9. The intrusion capturing algorithm correspondingto the SST spanning search tree can be performed in amaximum of

33ðn� 1Þ

2

� �� 2

steps of the algorithm.

Proof. Clearly, SST is of height

3ðn� 1Þ2

� �;

i.e., the diameter of the star graph. Edges in all levels arein three different priority levels, except for the edges infirst and second levels (and, perhaps, the highest levels),which are in two priority levels. The number of steps ofthe algorithm can be obtained by summing up thenumber of priority levels in each level of the tree. Anupper bound on this number is obtained as

33ðn� 1Þ

2

� �� 2

� �þ 2ð2Þ ¼ 3

3ðn� 1Þ2

� �� 2:

This is an upper bound since all edges that are mappedto an edge on a backbone may be assigned “m,” andthis results in two priority levels for the highest levelsof the tree. tuIn order to find the number of agents required for our

intrusion detection algorithm, we address the searchnumber problem on graphs. The search number SðGÞ fora graph G is the minimum number of agents for which asearch strategy exists so that the entire network is cleansed.However, the calculation of SðGÞ, given G, is indeed adifficult problem. In the case of our algorithm, since wehave demonstrated a spanning search tree for our con-cerned problem, we can make use of the results given in[18] for calculating SðGÞ for a tree.

Proposition 1 [18]. For a tree T with N nodes, we haveSðT Þ � 1þ log3ðN � 1Þ.

Theorem 10. The intrusion capturing algorithm correspondingto the SST spanning search tree can be performed with amaximum of 1þ log3ðn!� 1Þ agents.

Proof. As the constructed tree of our algorithm has the samenumber of nodes as our original star graph, i.e., n! nodes,and using proposition 1, it is easy to conclude thatSðSST Þ � 1þ log3ðn!� 1Þ. tu

6 CONCLUSION

Network security is one of the most important issues indesigning distributed systems. In this paper, we describedthe problem of decontaminating the star interconnectionnetwork from possible active threats. The star interconnec-tion network is known to expose very attractive propertieswhen utilized as an interconnection network topology for adistributed computing environment. We proposed a solu-tion for intrusion detection in the star graph, which is basedon graph theoretical properties of the star graph. Inparticular, we modeled intrusion capturing as the moreabstract problem of finding a spanning search tree in therespective graph. Due to the large number of vertices andthe complex structure of the graph, it is not easy to dealwith the star graph mathematically. Thus, in order tofacilitate the process of solving the problem, we propose anauxiliary graph structure, namely, the folded star graph,which is obtained from the star graph by grouping verticesinto supervertices. The folded star is interesting in the sensethat while preserving many of the same graph properties asits ancestor, it possesses a very small number of vertices(compared to other famous topologies such as the hyper-cube) and hence is easier to deal with. It comes as nosurprise that one can utilize the folded star as a more fragile

IMANI ET AL.: DETECTING THREATS IN STAR GRAPHS 481

graph structure in order to obtain properties on the stargraph. In this paper, we made use of the folded star in orderto derive the desired spanning tree on the star graph. Morespecifically, we obtained the former spanning tree on thestar graph from a spanning tree we constructed on thecorresponding folded star. Finally, we took advantage ofthis spanning tree in order to propose the final algorithmfor intrusion detection in the star interconnection network.The folded star graph as introduced in this paper is quiterobust and can be easily used to obtain other properties andalgorithms for the star graph. Our algorithm for intrusioncapturing on the star graph is very attractive with respect toits sublogarithmic time complexity. This low time complex-ity is an outcome of the high degree of parallelization thatthe algorithm benefits from. Future works that can beenvisioned in this line are the use of the folded star forderiving other attractive algorithms and properties on thestar graph and proposing solutions for intrusion capturingon incomplete network topologies.

ACKNOWLEDGMENTS

Navid Imani was with the School of Computer Science,Institute for Studies in Theoretical Physics and Mathematics(IPM), Tehran, Iran.

REFERENCES

[1] S.B. Akers and B. Krishnamurthy, “A Group-Theoretic Model forSymmetric Interconnection Networks,” IEEE Trans. Computers,vol. 38, no. 4, pp. 555-566, Apr. 1989.

[2] B. Alspach, Searching and Sweeping Graphs: A Brief Survey,http://www.dmi.unict.it/combinatorics04/documenti%20pdf/alspach.pdf, Sept. 2004.

[3] L. Barriere, P. Flocchini, P. Fraignaud, and N. Santoro, “Capture ofan Intruder by Mobile Agents,” Proc. 14th ACM Symp. ParallelAlgorithms and Architectures (SPAA ’02), pp. 200-209, 2002.

[4] L. Barriere, P. Fraignaud, N. Santoro, and D.M. Thilikos,“Searching Is Not Jumping,” Proc. 29th Workshop Graph TheoreticConcepts in Computer Science (WG ’03), pp. 34-45, 2003.

[5] T.S. Chen, Y.C. Tseng, and J.P. Sheu, “Balanced SpanningTrees in Complete and Incomplete Star Graphs,” IEEE Trans.Parallel and Distributed Systems, vol. 7, no. 7, pp. 717-723,1996.

[6] K. Day and A. Tripathi, “A Comparative Study ofTopological Properties of Hypercubes and Star Graphs,” IEEETrans. Parallel and Distributed Systems, vol. 5, no. 1, pp. 31-38,Jan. 1994.

[7] M. Demirbas, A. Arora, and M. Gouda, “A Pursuer-Evader Gamefor Sensor Networks,” Proc. Sixth Symp. Self-Stabilizing Systems(SSS ’03), pp. 1-16, June 2003.

[8] J.A. Ellis, I.H. Sudborough, and J.S. Turner, “The VertexSeparation and Search Number of a Graph,” Information andComputation, vol. 113, pp. 50-79, 1994.

[9] P. Flocchini, M.J. Huang, and F.L. Luccio, “Contiguous Searchin the Hypercube for Capturing an Intruder,” Proc. 19th IEEEInt’l Parallel and Distributed Processing Symp. (IPDPS ’05), p. 62,2005.

[10] P. Flocchini, F.L. Luccio, and L. Song, “Size Optimal Strategies forCapturing an Intruder in Mesh Networks,” Proc. Int’l Conf. Comm.in Computing (CIC ’05), pp. 200-206, 2005.

[11] P. Flocchini, F.L. Luccio, and L. Song, “Decontamination ofChordal Rings and Tori,” Proc. Eighth Workshop Advances inParallel and Distributed Computational Models (APDCM), 2006.

[12] N. Imani, H. Sarbazi-Azad, and S.G. Aki, “On Some Combinator-ial Properties of the Star Graph,” Proc. Eighth Int’l Symp. ParallelArchitectures, Algorithms and Networks (ISPAN ’05), pp. 58-65, 2005.

[13] N. Imani, H. Sarbazi-Azad, and A.Y. Zomaya, “Capturing anIntruder in Product Networks,” Proc. 13th Int’l Conf. HighPerformance Computing (HiPC ’06), pp. 193-204, Dec. 2006.

[14] L.M. Kirousis and C.H. Papadimitriou, “Searching and Pebbling,”Theoretical Computer Science, vol. 47, pp. 205-218, 1986.

[15] A. Lapaugh, “Recontamination Does Not Help to Search aGraph,” J. ACM, vol. 40, no. 2, pp. 224-245, 1993.

[16] T.K. Li, J.J.M. Tan, and L.H. Hsu, “Hyper Hamiltonian Laceabilityon Edge Fault Star Graph,” Information Sciences: An Int’l J., vol. 165,nos. 1-2, pp. 59-71, 2004.

[17] S. Myagmar, A. Lee, and W. Yurcik, “Threat Modeling as a Basisfor Security Requirements,” Proc. Symp. Requirements Eng. forInformation Security (SREIS ’05), Aug. 2005.

[18] N. Megiddo, S. Hakimi, M. Garey, D. Johnson, andC. Papadimitriou, “The Complexity of Searching a Graph,”J. ACM, vol. 35, pp. 18-44, 1988.

[19] J. Misic and Z. Jovanovic, “Communication Aspects of the StarGraph Interconnection Network,” IEEE Trans. Parallel and Dis-tributed Systems, vol. 5, no. 7, pp. 678-687, July 1994.

[20] T. Parson, “Pursuit-Evasion Problem on a Graph,” Theory andApplications in Graphs, pp. 426-441, Springer, 1976.

[21] T. Parson, “The Search Number of a Connected Graph,” Proc.Ninth Southeastern Conf. Combinatorics, Graph Theory and Comput-ing, pp. 549-554, 1978.

[22] S. Peng, M. Ko, C. Ho, T. Hsu, and C. Tang, “Graph Searching onChordal Graphs,” Algorithmica, vol. 27, pp. 395-426, 2000.

[23] S. Ranka, J. Wang, and N. Yeh, Embedding Meshes on the Star Graph.pp. 476-485, CS Press, 1990.

[24] A.A. Rescigno, “Optimally Balanced Spanning Tree of the StarNetwork,” IEEE Trans. Computers, vol. 50, no. 1, pp. 88-91,Jan. 2001.

[25] P. Shareghi, N. Imani, and H. Sarbazi-Azad, “Capturing anIntruder in the Pyramid,” Proc. Int’l Computer Science Symp. inRussia (CSR ’06), pp. 580-590, 2006.

[26] J.P. Sheu, C.T. Wu, and T.S. Chen, “An Optimal BroadcastingAlgorithm without Message Redundancy in Star Graphs,” IEEETrans. Parallel and Distributed Systems, vol. 6, no. 6, pp. 653-658,June 1995.

[27] Y.C. Tseng, S.H. Chang, and J.P. Sheu, “Fault-Tolerant RingEmbedding in a Star Graph with Both Link and NodeFailure,” IEEE Trans. Parallel and Distributed Systems, vol. 8,no. 12, pp. 1185-1195, Dec. 1997.

[28] P. Yospanya, B. Laekhanukit, D. Nanongkai, and J. Fakcharoen-phol, “Detecting and Cleaning Intruders in Sensor Networks,”Proc. Eighth Nat’l Computer Science and Eng. Conf. (NCSEC), 2004.

Navid Imani is currently a graduate student incomputer science at Simon Fraser University,Vancouver, Canada. He was with the School ofComputer Science, Institute for Studies inTheoretical Physics and Mathematics (IPM),Tehran, Iran. His research interests includeparallel and distributed systems and algorithmsand theoretical computer science. He is astudent member of the IEEE.

482 IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 20, NO. 4, APRIL 2009

Hamid Sarbazi-Azad received the BSc degreein electrical and computer engineering fromShahid-Beheshti University, Tehran, Iran, in1992, the MSc degree in computer engineeringfrom Sharif University of Technology, Tehran, in1994, and the PhD degree in computing sciencefrom the University of Glasgow, Glasgow, UnitedKingdom, in 2002. He is currently an associateprofessor of computer engineering in the De-partment of Computer Engineering, Sharif Uni-

versity of Technology, and heads the School of Computer Science,Institute for Studies in Theoretical Physics and Mathematics (IPM),Tehran. His research interests include high-performance computerarchitectures, NoCs and SoCs, parallel and distributed systems,performance modeling/evaluation, graph theory and combinatorics,and wireless/mobile networks, on which he has published more than200 refereed conference and journal papers. He received the KhwarizmiInternational Award in 2006 and the TWAS Young Scientist Award inengineering sciences in 2007. He is a member of the managing board ofthe Computer Society of Iran (CSI), and has served as the editor in chieffor the CSI Journal on Computer Science and Engineering since 2005.He is an editorial board member and a guest editor for several specialissues on high-performance computing architectures and networks(HPCAN) in related journals. He is a member of the ACM.

Albert Y. Zomaya currently holds the chairprofessor of high performance computing andnetworking in the School of Information Tech-nologies, University of Sydney. Prior to joiningthe University of Sydney, he was a full professorin the Electrical and Electronic EngineeringDepartment, University of Western Australia,where he also led the Parallel ComputingResearch Laboratory during the period 1990-2002. He is the author or a coauthor of seven

books and more than 300 publications in technical journals andconference proceedings and the editor of eight books and eightconference volumes. He is currently an associate editor for 16 journals,the founding editor of the Wiley Book Series on Parallel and DistributedComputing and a founding coeditor of the Wiley Book Series onBioinformatics. He was the Chair of the IEEE Technical Committee onParallel Processing (1999-2003) and currently serves on its executivecommittee. He also serves on the Advisory Board of the IEEE TechnicalCommittee on Scalable Computing and IEEE Systems, Man, andCybernetics Society Technical Committee on Self-Organization andCybernetics for Informatics and is a Scientific Council Member of theInstitute for Computer Sciences, Social-Informatics, and Telecommuni-cations Engineering (in Brussels). He received the 1997 EdgeworthDavid Medal from the Royal Society of New South Wales for outstandingcontributions to Australian Science. He is also the recipient of theMeritorious Service Award (in 2000) and the Golden Core Recognition(in 2006), both from the IEEE Computer Society. He is a charteredengineer (CEng), a fellow of the American Association for theAdvancement of Science, the IEEE, the IEEE Computer Society, andthe Institution of Electrical Engineers (United Kingdom), and adistinguished engineer of the ACM. His research interests are in theareas of high-performance computing, parallel algorithms, mobilecomputing, and bioinformatics.

Parya Moinzadeh received the BS degree incomputer engineering from Shahid BeheshtiUniversity, Tehran, Iran, in 2005, and the MSdegree in information technology from SharifUniversity of Technology, Tehran, Iran, in 2008.She is currently a graduate student in theComputer Science Department, University ofIllinois, Urbana-Champaign. She has been work-ing as a research assistant at the School ofComputer Science, Institute for Studies in

Theoretical Physics and Mathematics (IPM), since March 2007. Herresearch interests mainly include interconnection networks, parallel anddistributed systems, applied graph theory, and wireless/mobile networks.

. For more information on this or any other computing topic,please visit our Digital Library at www.computer.org/publications/dlib.

IMANI ET AL.: DETECTING THREATS IN STAR GRAPHS 483