7627765
Directions for Web and e-commerce applications security
This paper provides directions for Web and e-commerce application security. In particular, access control policies, workflow security, XML security and federated database security issues pertaining to the Web and e-commerce applications are discussed.
639197
An integrated and collaborative framework for business design: A knowledge engineering approach
Many large-scale endeavors, especially the ones that need to be performed on an occasional basis, are performed on a de novo basis. Whether one is designing a spacecraft or a dam, or launching a sales campaign, each endeavor tends to have a life of its own. Very little knowledge, if any, is transferred from one business or engineering design endeavor to a successive one. This paper describes an approach that involves the acquisition of raw information from the keystrokes entered by the user while performing the primary activity. Such information is distilled to produce knowledge for future use, without imposing additional burden on human users involved in the first endeavor or the succeeding endeavors. The paper also describes a complementary approach that significantly reduces the time and effort spent by human beings in articulating their requirements, and specifically, in terms of delineating the indifference points among a set of feasible alternatives. Both these approaches have been validated in a complex multi-organizational situation related to spacecrafts. The approaches can be applied, either singly or jointly, to a broad class of business and engineering scenarios. They incorporate the notion of automated knowledge acquisition, discovery, management, and dissemination. The proposed approach is discussed in the context of supporting workteams that are distributed both on geographic and temporal basis, thereby creating a "24-Hour Knowledge Factory" environment.
5958805
Selective and authentic third-party distribution of XML documents
Third-party architectures for data publishing over the Internet today are receiving growing attention, due to their scalability properties and to the ability of efficiently managing large number of subjects and great amount of data. In a third-party architecture, there is a distinction between the Owner and the Publisher of information. The Owner is the producer of information, whereas Publishers are responsible for managing (a portion of) the Owner information and for answering subject queries. A relevant issue in this architecture is how the Owner can ensure a secure and selective publishing of its data, even if the data are managed by a third-party, which can prune some of the nodes of the original document on the basis of subject queries and access control policies. An approach can be that of requiring the Publisher to be trusted with regard to the considered security properties. However, the serious drawback of this solution is that large Web-based systems cannot be easily verified to be secure and can be easily penetrated. For these reasons, we propose an alternative approach, based on the use of digital signature techniques, which does not require the Publisher to be trusted. The security properties we consider are authenticity and completeness of a query response, where completeness is intended with regard to the access control policies stated by the information Owner. In particular, we show that, by embedding in the query response one digital signature generated by the Owner and some hash values, a subject is able to locally verify the authenticity of a query response. Moreover, we present an approach that, for a wide range of queries, allows a subject to verify the completeness of query results.
13088866
Specification-based anomaly detection: a new approach for detecting network intrusions
Unlike signature or misuse based intrusion detection techniques, anomaly detection is capable of detecting novel attacks. However, the use of anomaly detection in practice is hampered by a high rate of false alarms. Specification-based techniques have been shown to produce a low rate of false alarms, but are not as effective as anomaly detection in detecting novel attacks, especially when it comes to network probing and denial-of-service attacks. This paper presents a new approach that combines specification-based and anomaly-based intrusion detection, mitigating the weaknesses of the two approaches while magnifying their strengths. Our approach begins with state-machine specifications of network protocols, and augments these state machines with information about statistics that need to be maintained to detect anomalies. We present a specification language in which all of this information can be captured in a succinct manner. We demonstrate the effectiveness of the approach on the 1999 Lincoln Labs intrusion detection evaluation data, where we are able to detect all of the probing and denial-of-service attacks with a low rate of false alarms (less than 10 per day). Whereas feature selection was a crucial step that required a great deal of expertise and insight in the case of previous anomaly detection approaches, we show that the use of protocol specifications in our approach simplifies this problem. Moreover, the machine learning component of our approach is robust enough to operate without human supervision, and fast enough that no sampling techniques need to be employed. As further evidence of effectiveness, we present results of applying our approach to detect stealthy email viruses in an intranet environment.
32208794
Adaptive delivery of E-commerce web sites
Most e-commerce web sites are very large, often confusing and overwhelm the visitor with a huge amount of information. People cannot easily find what they are looking for. Moreover, the web site is presented in the same format to every visitor, irrespective of his needs. This paper proposes a model to solve the above problems. Our model divides the visitors into groups. Then it arranges web pages in the decreasing order of preference for each group and applies path prediction to find sink pages for that group. The results of these algorithms are displayed in a separate frame without modifying the site. Secondly, our paper addresses the need to guide visitors during the configuration of a product. We propose to apply data mining on the quotes for every group and find associations between different components of the product. We can then display these results as suggestions while the prospective buyer is configuring the product. These suggestions will dynamically change as each selection is made. We have discussed the data mining algorithms applicable to our model.
31393341
Compiling abstract scientific workflows into Web service workflows
The authors present an approach for compiling "scientist-friendly" abstract workflow specifications into real-world executable workflows of Web service invocations, using a set of abstract-as-view definitions from a repository of abstract tasks. There have been a number of proposals and systems for scientific workflow management. However, our approach features unique aspects, in particular: the separation of abstract and concrete executable workflows; and the use of database mediation techniques to automatically translate AWFs into EWFs.
15353920
Beyond safety: customized SAT-based model checking
Model checking of safety properties has taken a significant lead over nonsafety properties in recent years. To bridge the gap, we propose dedicated SAT-based model checking algorithms for properties beyond safety. Previous bounded model checking (BMC) approaches have relied on either converting such properties to safety checking, or finding proofs by deriving termination criteria using loop-free path analysis. Instead, our approach uses a customized SAT-based formulation for bounded model checking of nonsafety properties, and determines the completeness bounds for liveness using unbounded SAT-based analysis. Our main contributions are: 1) Customized property translations for LTL formulas for BMC, with novel features that utilize partitioning, learning, and incremental formulation. Customized translations not only improve the BMC performance significantly in comparison to standard monolithic LTL translations, but also allow efficient derivation and use of completeness bounds. Though we discuss the translation schemas for liveness, they can be easily extended to handle other LTL properties as well. 2) Customized formulations for determining completeness bounds for liveness using SAT-based unbounded model checking (UMC) rather than using loop-free path analysis. These formulations comprise greatest fixed-point and least fixed-point computations to efficiently handle nested properties using SAT-based quantification approaches. We show the effectiveness of our overall approach for checking liveness on public benchmarks and several industry designs.
1782369
Designing and executing scientific workflows with a programmable integrator
MOTIVATION
As in many other fields of science, computational methods in molecular biology need to intersperse information access and algorithm execution in a computational workflow. Users often find difficulties when transferring data between data sources and applications. In most cases there is no standard solution for workflow design and execution and tailored scripting mechanisms are implemented in a case by case basis.


RESULTS
In this paper, we present a general purpose 'programmable integrator' that can access information from a variety of sources in a coordinated manner. Its usefulness in complex bioinformatics applications is claimed and supported by some application examples.


AVAILABILITY
Tools are freely available to non-profit educations and research institutions. Usage by commercial organizations requires a license agreement. Software requirements: Java v1.3 (http://java.sun.com), Xerces XML Parser (http://xml.apache.org/xerces-j) and Kweelt implementation of XQuery (http://kweelt.sourceforge.net/).