5266558
Resilient peer-to-peer streaming
We consider the problem of distributing "live" streaming media content to a potentially large and highly dynamic population of hosts. Peer-to-peer content distribution is attractive in this setting because the bandwidth available to serve content scales with demand. A key challenge, however, is making content distribution robust to peer transience. Our approach to providing robustness is to introduce redundance; both in network paths and in data. We use multiple, diverse distribution trees to provide redundancy in network paths and multiple description coding (MDC) to provide redundancy in data. We present a simple tree management algorithm that provides the necessary path diversity and describe an adaptation framework for MDC based on scalable receiver feedback. We evaluate these using MDC applied to real video data coupled with real usage traces from a major news site that experienced a large flash crowd for live streaming content. Our results show very significant benefits in using multiple distribution trees and MDC, with a 22 dB improvement in PSNR in some cases.
1513566
Passive network tomography using Bayesian inference
In this paper, we investigate the problem of identifying lossy links in the interior of the Internet by passively observing the end-to-end performance of existing traffic between a server and its clients. This is in contrast to the previous work on network tomography (e.g., [1]) that has been based on active probing. The key advantage of a passive approach is that it does not introduce wasteful traffic which might perturb the object of inference, i.e., the link loss rates. Moreover, our techniques depend only on knowing the number of lost and successful packets sent to each client rather than the exact loss sequence required by previous techniques such as [1]. While accuracy of link loss rate inference may consequently suffer, our techniques can still pinpoint the trouble spots in the network (e.g., highly lossy links). We have developed three techniques for passive network tomography: Random Sampling, Linear Optimization, and Bayesian Inference using Gibbs Sampling. We have evaluated these techniques using simulations and traces gathered at a busy Web server. In this paper, we focus on the Gibbs Sampling technique; more information on the three techniques appears in [3].
42916380
Policy-enabled handoffs across heterogeneous wireless networks
"Access is the killer app" is the vision of the Daedalus project at UC Berkeley. Being able to be connected seamlessly anytime anywhere to the best network still remains an unfulfilled goal. Often, even determining the "best" network is a challenging task because of the widespread deployment of overlapping wireless networks. We describe a policy-enabled handoff system that allows users to express policies on what is the "best" wireless system at any moment, and make tradeoffs among network characteristics and dynamics such as cost, performance and power consumption. We designed a performance reporting scheme estimating current network conditions, which serves as input to the policy specification. A primary goal of this work is to make it possible to balance the bandwidth load across networks with comparable performance. To avoid the problem of handoff instability, i.e., many mobile hosts making the same handoff decision at essentially the same time, we designed randomization into our mechanism. Given the current "best" network, our system determines whether the handoff is worthwhile based on the handoff overhead and potential network usage duration.
9905659
A signaling system using lightweight call sessions
Because of the emergence of heterogeneous access devices and diverse wired and wireless networks, and a substantial lack of support for integrating these networks, we are building a communication network and a service infrastructure that provides integrated telephony and data services across these networks. We generalize the basic call service to support communication between two or more call parties using any number of devices through any media. Call setup has already been addressed by protocols such as the session initiation protocol (SIP), so we focus on a missing component: scalable and fault-tolerant call session maintenance and control after call setup. In this paper, we present a new signaling protocol that offers scalability, high availability, robustness, and flexibility in creating new call processing services. The protocol is compatible with existing call setup protocols, but provides lightweight call session management using a completely decentralized, soft-state group control protocol. We show that this approach simplifies the implementation of the basic call service, including multi-device calling and service handoff between diverse access networks. The design of our protocol follows the principle of separation of control (signaling information) from data. The signaling protocol has been implemented in ICEBERG, an IP-based core network testbed with access to heterogeneous networks.
13895152
ShieldGen: Automatic Data Patch Generation for Unknown Vulnerabilities with Informed Probing
In this paper, we present ShieldGen, a system for automatically generating a data patch or a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. The key novelty in our work is that we leverage knowledge of the data format to generate new potential attack instances, which we call probes, and use a zero-day detector as an oracle to determine if an instance can still exploit the vulnerability; the feedback of the oracle guides our search for the vulnerability signature. We have implemented a ShieldGen prototype and experimented with three known vulnerabilities. The generated signatures have no false positives and a low rate of false negatives due to imperfect data format specifications and the sampling technique used in our probe generation. Overall, they are significantly more precise than the signatures generated by existing schemes. We have also conducted a detailed study of 25 vulnerabilities for which Microsoft has issued security bulletins between 2003 and 2006. We estimate that ShieldGen can produce high quality signatures for a large portion of those vulnerabilities and that the signatures are superior to the signatures generated by existing schemes.
17331850
A Systematic Approach to Uncover Security Flaws in GUI Logic
To achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the human-computer interface is compromised. GUI logic flaws are a category of software vulnerabilities that result from logic bugs in GUI design/implementation. Visual spoofing attacks that exploit these flaws can lure even security- conscious users to perform unintended actions. The focus of this paper is to formulate the problem of GUI logic flaws and to develop a methodology for uncovering them in software implementations. Specifically, based on an in-depth study of key subsets of Internet Explorer (IE) browser source code, we have developed a formal model for the browser GUI logic and have applied formal reasoning to uncover new spoofing scenarios, including nine for status bar spoofing and four for address bar spoofing. The IE development team has confirmed all these scenarios and has fixed most of them in their latest build. Through this work, we demonstrate that a crucial subset of visual spoofing vulnerabilities originate from GUI logic flaws, which have a well-defined mathematical meaning allowing a systematic analysis.
11673267
Object-based video compression scheme with optimal bit allocation among shape, motion and texture
In object-based video, the encoding of the video data is decoupled into the encoding of shape, motion and texture information, which enables certain functionalities like content-based interactivity and scalability. However, the problem of how to jointly encode these separate signals to reach the best coding efficiency has never been solved thoroughly. In this paper, we present an operational rate-distortion optimal bit allocation scheme that provides a solution to this problem. Our approach is based on the Lagrangian relaxation and dynamic programming. Experimental results indicate that the proposed optimal encoding approach has considerable gains over an ad-hoc method without optimization. Furthermore the proposed algorithm is much more efficient than exhaustive search.
8707040
Extending SQL for Decision Support Applications
The challenge of extending database systems for decision support applications has been thetopic of much recent research—a very incomplete list of previous work includes [11, 8, 12, 4,10, 5]. Yet, there is no generally accepted solution for the problem, which remains a criticalone, since the inability of current DBMSs to support data mining applications is well-testedand clearly documented [12].Our research approach in addressing this diﬃcult problem is motivated by the observa-tion that aggregate functions provide the linchpin for most decision support computations;moreover inductive discovery from large data sets can be viewed as the process of aggregat-ing low level data into statistical summaries of semantic signiﬁcance. Therefore, the ATLaSsystem designed at UCLA [2] allows end-users to deﬁne new powerful aggregate functionsby writing them in SQL. The same mechanism can be used to deﬁne new table functionsin ATLaS, whose name stands for Aggregate & Table Language and System. ATLaS is thesuccessor of the AXL system described in [15].These SQL-based native extension mechanisms turn ATLaS into a powerful and ﬂexiblesystem for advanced data-intensive applications, including applications from many domainsthat are not supported well by current Object-Relational database systems, which stillsuﬀer from limited extensibility. In fact, the only extensibility mechanism now providedby Object-Relational systems relies on nonnative datablades—i.e., on external functionsdeﬁned in a procedural language and imported into SQL.ATLaS is very eﬀective at expressing decision support tasks: we demonstrate this prop-erty by the eﬃcient implementation of several functions, such as rollups, datacubes, clas-siﬁers, and frequent item sets for association rules [2]. The performance of these functionsexpressed in ATLaS is typically within 30% of the performance of the same algorithmscoded in C/C++. To achieve this level of performance, ATLaS supports various optimiza-tion techniques, and the ability of manipulating in-memory tables in SQL. In fact, attributesof reference type in such tables allow the eﬃcient support of data structures, such as tries,that are instrumental in implementing data mining algorithms, such as Apriori [1, 7].The stream-oriented computation model used by ATLaS contrasts with the computa-tion model based on ‘blocking’ semantics that is normally used for aggregates in currentdatabase systems. Thus, online aggregates [9], time-series queries [13], sliding-window ag-gregates, approximate aggregates, and continuous queries [3] are naturally supported inATLaS. Furthermore, important properties of an ATLaS program, such as blocking behav-ior and monotonicity, can be easily inferred from the syntactic structure of the program [14].
28149553
Fingerprint Indexing Based On Symmetrical Measurement
Due to the small number of classes and uneven distribution, the Henry's fingerprint classification approach is not able to provide an efficient way to narrow down the search when identifying a person in a large database. In this paper, three symmetrical filters are used to measure different orientation structures. We proposed a new fingerprint indexing approach based on these three symmetrical measurements. Experiments conducted on the NIST database 4 show the effectiveness of the proposed approach
14701684
A secure multicast protocol with copyright protection
We present a simple, efficient, and secure multicast protocol with copyright protection in an open and insecure network environment. There is a wide variety of multimedia applications that can benefit from using our secure multicast protocol, e.g., the commercial pay-per-view video multicast, or highly secure military intelligence video conference. Our secure multicast protocol is designed to achieve the following goals. (1) It can run in any open network environment. It does not rely on any security mechanism on intermediate network switches or routers. (2) It can be built on top of any existing multicast architecture. (3) Our key distribution protocol is both secure and robust in the presence of long delay or membership message. (4) It can support dynamic group membership, e.g., JOIN/LEAVE/EXPEL operations, in a network bandwidth efficient manner. (5) It can provide copyright protection for the information provider. (6) It can help to identify insiders in the multicast session who are leaking information to the outside world. We have implemented a prototype system which validates our secure multicast protocol and evaluated it against various performance matrices. The experimental results are very encouraging, but also show where new engineering approaches need to be deployed to conform fully to the design goals.
794384
A Novel Intrusion Detection Method
It is an important issue for the security of network that how to detect new intrusions attack. This paper investigates unsupervised intrusion detection method. A distance definition for mixed attributes, a simple method calculating cluster radius threshold, a outlier factor measured deviating degree of a cluster, and a novel intrusion detection method are proposed in this paper. The experimental results show that the method has promising performance with high detection rate and low false alarm rate, also can detect new intrusion.