11610229
Simulation and analysis on the resiliency and efficiency of malnets
Future network intruders will probably use an organized army of malicious nodes (here called "malnodes", or collectively a "malnet") to deliver many different attacks, rather than recruiting a disorganized set of compromised nodes per attack. However, partly due to the lack of understanding of the resiliency and efficiency a malnet can have, countering malnets has been ineffective. This paper begins to address this deficiency. Through calculation and simulation for three representative malnets-random, small-world, and Gnutella-like-we show that extremely resilient malnets can be formed to deliver attack code quickly. In particular, we show that disconnecting malnets is possible, but extremely naive approaches such as randomly disinfecting malnodes will not suffice, and effective defenses must either happen very quickly during a second-wave attack, or take effect prior to it.
11640530
SAVE: source address validity enforcement protocol
Forcing all IP packets to carry correct source addresses can greatly help network security, attack tracing, and network problem debugging. However, due to asymmetries in today's Internet routing, routers do not have readily available information to verify the correctness of the source address for each incoming packet. In this paper we describe a new protocol, named SAVE, that can provide routers with the information needed for source address validation. SAVE messages propagate valid source address information from the source location to all destinations, allowing each router along the way to build an incoming table that associates each incoming interface of the router with a set of valid source address blocks. This paper presents the protocol design and evaluates its correctness and performance by simulation experiments. The paper also discusses the issues of protocol security, the effectiveness of partial SAVE deployment, and the handling of unconventional forms of network routing, such as mobile IP and tunneling.
756983
An internet routing forensics framework for discovering rules of abnormal BGP events
Abnormal BGP events such as attacks, misconfigurations, electricity failures, can cause anomalous or pathological routing behavior at either global level or prefix level, and thus must be detected in their early stages. Instead of using ad hoc methods to analyze BGP data, in this paper we introduce an Internet Routing Forensics framework to systematically process BGP routing data, discover rules of abnormal BGP events, and apply these rules to detect the occurrences of these events. In particular, we leverage data mining techniques to train the framework to learn rules of abnormal BGP events, and our results from two case studies show that these rules are effective. In one case study, rules of worm events discovered from the BGP data during the outbreaks of the CodeRed and Nimda worms were able to successfully detect worm impact on BGP when an independent worm, the Slammer, subsequently occurred. Similarly, in another case study, rules of electricity blackout events obtained using BGP data from the 2003 East Coast blackout were able to detect the BGP impact from the Florida blackout caused by Hurricane Frances in 2004.
18241375
Proof of Service in a Hybrid P2P Environment
In a hybrid peer-to-peer environment, clients can either directly download data from their server, or share data with each other. In order to create incentives for clients to share data and decrease server load, an effective economy model is for the server to credit those provider clients who provide data to others and offer discounts to those recipient clients who download data from provider clients instead of the server. To realize this model, the proof of service between provider and recipient clients must be provided. 
 
We design and investigate three different schemes and compare them in terms of scalability, effectiveness, and cost. We emphasize the issues of lessening the number of proofs which must be provided, avoiding a heavy load on the server, and ensuring the proof for every piece of data served. Our study shows our enhanced public-key-based scheme to be the most effective.
14717043
BGP routing dynamics revisited
Understanding BGP routing dynamics is critical to the solid growth and maintenance of the Internet routing infrastructure. However, while the most extensive study on BGP dynamics is nearly a decade old, many factors that could affect BGP dynamics have changed considerably. We revisit this important topic in this paper, focusing on not only comparing with the previous results, but also issues not well explored before. We have found that, compared to almost a decade ago, although certain characteristics remain unchanged (such as some temporal properties), BGP dynamics are now â busier,â and more importantly, now have much less pathological behavior and are â healthierâ ; for example, forwarding dynamics are now not only dominant, but also more consistent across different days. Contributions to BGP dynamics by different BGP peersâ which are not proportional to the size of a peerâ s ASâ are also more stable, and dynamics due to policy changes or duplicate announcements are usually from specific peers
12669704
Observations on versioning of off-the-shelf components in industrial projects (short paper)
Using OTS (Off-The-Shelf) components in software projects has become increasing popular in the IT industry. After project managers opt for OTS components, they can decide to use COTS (Commercial-Off-The-Shelf) components or OSS (Open Source Software) components. We have done a series of interviews and surveys to document and understand industrial practice with OTS-based development in Norwegian, German, and Italian IT industry. The perspective is that of a software architect or system integrator, not a developer or maintainer of such components. The study object is a completed development project using one or several OTS components. This paper reports on the versioning aspects of OTS components in such projects. We found that one third of the COTS components actually provided source code, in addition to all OSS components. However, OTS components were seldom modified (i.e. re-used "as-is"), even if source code was available. Although backward compatibility of new releases did not cause noticeable problems for a single OTS component, using several different OTS components in a project caused difficulties in maintenance planning of asynchronous releases and system integration of new releases. Several new research questions have been formulated based on the results of this study.
14076397
The Empirical Studies on Quality Benefits of Reusing Software Components
The benefits of reusing software components have been studied for many years. Several previous studies have concluded that reused components have fewer defects in general than non-reusable components. However, few of these studies have gone a further step, i.e., investigating which type of defects has been reduced because of reuse. Thus, it is suspected that making a software component reusable will automatically improve its quality. This paper presents an on-going industrial empirical study on the quality benefits of reuse. We are going to compare the defects types, which are classified by ODC (orthogonal defect classification), of the reusable component vs. the non-reusable components in several large and medium software systems. The intention is to figure out which defects have been reduced because of reuse and the reasons of the reduction.
2572958
RACCOON: a peer-based system for data integration and sharing
Recent database applications see the emerging need to support data integration in distributed, peer-to-peer environments, in which autonomous peers (sources) connected by a network are willing to exchange data and services with each other. To address related research challenges, we are developing a system called "RACCOON", which allows different sources to integrate and share their data. We use an application to show several important features of the RACCOON system. The system also suggests semantic mappings for the user to choose. We show the two different querying modes, particularly how a query is expanded using the semantic mappings in the extended querying mode to compute as many answers to the query as possible.
2953723
Hierarchical land cover information retrieval in object-oriented remote sensing image databases with native queries
Classification and change detection of land cover types in the remotely sensed images is one of the major applications in remote sensing. This paper presents a hierarchical framework for land cover information storage and retrieval from object-oriented (OO) remote sensing image databases. Multi-spectral (band) remotely sensed images are classified by an optimized k-means clustering algorithm. The land cover maps are then decomposed and indexed with region quad-tree data structure stored in an OO database. Native queries (NQs), which use the semantics of the OO programming language for query composition, are developed to retrieve land cover distribution information and detect the changes of each land cover type at multi levels. A prototype system was implemented and the experiments were conducted on a time series Landsat Thematic Mapper (TM) images. The results show the effectiveness of the framework and the potentials in other remote sensing applications like urban planning and drought monitoring.
13632337
Grid resource discovery based on semantic P2P communities
Grid technologies enable the sharing of a wide variety of resources. The full use of these resources requires effective resource discovery mechanisms. However, the complicated and dynamic characteristics of grid resources make sharing and discovering them a challenge. In this paper, we propose a semantic community approach to enable efficient resource discovery in grids. The system clusters nodes into communities according to their semantic properties. The community construction and maintenance is fully decentralized and self-organizing. This structure helps prune the searching space and reduce the cost of searching. The system exhibits many desirable properties: it supports complex queries and is fully decentralized, scalable, and efficient. Our simulation results show how searching the grids can take advantage of semantic communities to reduce searching costs and improve the quality of results.