1302015
An evaluation of scalable application-level multicast built using peer-to-peer overlays
Structured peer-to-peer overlay networks such as CAN, Chord, Pastry, and Tapestry can be used to implement Internet-scale application-level multicast. There are two general approaches to accomplishing this: tree building and flooding. This paper evaluates these two approaches using two different types of structured overlay: 1) overlays which use a form of generalized hypercube routing, e.g., Chord, Pastry and Tapestry, and 2) overlays which use a numerical distance metric to route through a Cartesian hyperspace, e.g., CAN. Pastry and CAN are chosen as the representatives of each type of overlay. To the best of our knowledge, this paper reports the first head-to-head comparison of CAN-style versus Pastry-style overlay networks, using multicast communication workloads running on an identical simulation infrastructure. The two approaches to multicast are independent of overlay network choice, and we provide a comparison of flooding versus tree-based multicast on both overlays. Results show that the tree-based approach consistently outperforms the flooding approach. Finally, for tree-based multicast, we show that Pastry provides better performance than CAN.
13895152
ShieldGen: Automatic Data Patch Generation for Unknown Vulnerabilities with Informed Probing
In this paper, we present ShieldGen, a system for automatically generating a data patch or a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. The key novelty in our work is that we leverage knowledge of the data format to generate new potential attack instances, which we call probes, and use a zero-day detector as an oracle to determine if an instance can still exploit the vulnerability; the feedback of the oracle guides our search for the vulnerability signature. We have implemented a ShieldGen prototype and experimented with three known vulnerabilities. The generated signatures have no false positives and a low rate of false negatives due to imperfect data format specifications and the sampling technique used in our probe generation. Overall, they are significantly more precise than the signatures generated by existing schemes. We have also conducted a detailed study of 25 vulnerabilities for which Microsoft has issued security bulletins between 2003 and 2006. We estimate that ShieldGen can produce high quality signatures for a large portion of those vulnerabilities and that the signatures are superior to the signatures generated by existing schemes.
17331850
A Systematic Approach to Uncover Security Flaws in GUI Logic
To achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the human-computer interface is compromised. GUI logic flaws are a category of software vulnerabilities that result from logic bugs in GUI design/implementation. Visual spoofing attacks that exploit these flaws can lure even security- conscious users to perform unintended actions. The focus of this paper is to formulate the problem of GUI logic flaws and to develop a methodology for uncovering them in software implementations. Specifically, based on an in-depth study of key subsets of Internet Explorer (IE) browser source code, we have developed a formal model for the browser GUI logic and have applied formal reasoning to uncover new spoofing scenarios, including nine for status bar spoofing and four for address bar spoofing. The IE development team has confirmed all these scenarios and has fixed most of them in their latest build. Through this work, we demonstrate that a crucial subset of visual spoofing vulnerabilities originate from GUI logic flaws, which have a well-defined mathematical meaning allowing a systematic analysis.
5266558
Resilient peer-to-peer streaming
We consider the problem of distributing "live" streaming media content to a potentially large and highly dynamic population of hosts. Peer-to-peer content distribution is attractive in this setting because the bandwidth available to serve content scales with demand. A key challenge, however, is making content distribution robust to peer transience. Our approach to providing robustness is to introduce redundance; both in network paths and in data. We use multiple, diverse distribution trees to provide redundancy in network paths and multiple description coding (MDC) to provide redundancy in data. We present a simple tree management algorithm that provides the necessary path diversity and describe an adaptation framework for MDC based on scalable receiver feedback. We evaluate these using MDC applied to real video data coupled with real usage traces from a major news site that experienced a large flash crowd for live streaming content. Our results show very significant benefits in using multiple distribution trees and MDC, with a 22 dB improvement in PSNR in some cases.
42916380
Policy-enabled handoffs across heterogeneous wireless networks
"Access is the killer app" is the vision of the Daedalus project at UC Berkeley. Being able to be connected seamlessly anytime anywhere to the best network still remains an unfulfilled goal. Often, even determining the "best" network is a challenging task because of the widespread deployment of overlapping wireless networks. We describe a policy-enabled handoff system that allows users to express policies on what is the "best" wireless system at any moment, and make tradeoffs among network characteristics and dynamics such as cost, performance and power consumption. We designed a performance reporting scheme estimating current network conditions, which serves as input to the policy specification. A primary goal of this work is to make it possible to balance the bandwidth load across networks with comparable performance. To avoid the problem of handoff instability, i.e., many mobile hosts making the same handoff decision at essentially the same time, we designed randomization into our mechanism. Given the current "best" network, our system determines whether the handoff is worthwhile based on the handoff overhead and potential network usage duration.
325582
Virtual Playgrounds for Worm Behavior Investigation
To detect and defend against Internet worms, researchers have long hoped to have a safe convenient environment to unleash and run real-world worms for close observation of their infection, damage, and propagation. However, major challenges exist in realizing such “worm playgrounds”, including the playgrounds' fidelity, confinement, scalability, as well as convenience in worm experiments. In this paper, we present a virtualization-based platform to create virtual worm playgrounds, called vGrounds, on top of a physical infrastructure. A vGround is an all-software virtual environment dynamically created for a worm attack. It has realistic end-hosts and network entities, all realized as virtual machines (VMs) and confined in a virtual network (VN). The salient features of vGround include: (1) high fidelity supporting real worm codes exploiting real vulnerable services, (2) strict confinement making the real Internet totally invisible and unreachable from inside a vGround, (3) high resource efficiency achieving sufficiently large scale of worm experiments, and (4) flexible and efficient worm experiment control enabling fast (tens of seconds) and automatic generation, re-installation, and final tear-down of vGrounds. Our experiments with real-world worms (including multi-vector worms and polymorphic worms) have successfully exhibited their probing and propagation patterns, exploitation steps, and malicious payloads, demonstrating the value of vGrounds for worm detection and defense research.
5809000
VIBRANT: A Brainstorming Agent for Computer Supported Creative Problem Solving
This paper describes key issues underlying the design of a tutoring system that brainstorms with students in order to support qualitative problem solving. Cognitively oriented and socially oriented support are enabled by two technologies, namely heuristic-based feedback generation and community-data-driven social recommendation. Formal representations and corresponding automated reasoning procedures for these technologies are introduced.
14701684
A secure multicast protocol with copyright protection
We present a simple, efficient, and secure multicast protocol with copyright protection in an open and insecure network environment. There is a wide variety of multimedia applications that can benefit from using our secure multicast protocol, e.g., the commercial pay-per-view video multicast, or highly secure military intelligence video conference. Our secure multicast protocol is designed to achieve the following goals. (1) It can run in any open network environment. It does not rely on any security mechanism on intermediate network switches or routers. (2) It can be built on top of any existing multicast architecture. (3) Our key distribution protocol is both secure and robust in the presence of long delay or membership message. (4) It can support dynamic group membership, e.g., JOIN/LEAVE/EXPEL operations, in a network bandwidth efficient manner. (5) It can provide copyright protection for the information provider. (6) It can help to identify insiders in the multicast session who are leaking information to the outside world. We have implemented a prototype system which validates our secure multicast protocol and evaluated it against various performance matrices. The experimental results are very encouraging, but also show where new engineering approaches need to be deployed to conform fully to the design goals.
7539036
Multi-level logic optimization of FSM networks
Current approaches tocompute and exploit the flexibility ofa component in an FSM network are allat the symbolic level [32,42,44,43]. Conventionally, exploitation of this flexibility relies on state minimizers for incompletely specified FSM's (ISFSM's) or pseudo non-deterministic FSM's (PNDFSM's) [44]. However, state-of-the-art state minimizers cannothandle large ISFSM's orPNDFSM's [19,21,45,14, 22]. In addition, these exploitation techniques are at the symbolic level, not directly at the net-list logic level. We present a general approach to exploit exact orapproximate flexibility directly at the net-list logic level, and we demonstrate that many sequential logic optimization techniques can beapplied inexploitation. Moreover, we propose a new procedure for input don't care sequences. As a result, both computation and exploitation of input don't care sequences inlarger FSM networks can be made efficient and effective. Finally, we give preliminary results on some artificially constructed FSM networks. Preliminary results indicate that our approach can beeffective inreducing the size of a componentof an FSM network. •This projectwassupported by NSF undercontract numberMIP-8719546.
12211000
Intelligent Agent Supported Business Process Management
The complex business environment requires managing business processes with the ability to adapt to changes and to collaborate in activities. Conventional workflow approaches based on predefined logical procedure offer little support for the dynamic business environment. A cognitive agent-based approach is proposed to manage business activities based on situational awareness and real-time decisions on activities. Business activities are delegated to a number of cognitive and collaborative problem-solving agents. Each software agent perceives its environment by capturing events and monitoring the state of tasks and resources. Based on the continuous perception of environment, business rules concerning process routing, operational constraint, exception handling and business strategy are used by such software agents to perform appropriate actions. The mechanism of this approach is investigated, and a case application of exception management in securities trading is developed to demonstrate the validity and benefits of this approach.
45076379
Kernel Spectral Correspondence Matching Using Label Consistency Constraints
This paper investigates a kernel spectral approach to the problem of point pattern matching. Our first contribution is to show how kernel principal components analysis can be effectively used for solving the point correspondence matching problem when the point-sets are subject to structural errors, i.e. they are of different size. Our second contribution is to show how label consistency constraints can be incorporated into the construction of the Gram matrices for solving the articulated point pattern matching problem. We compare our algorithm with earlier point matching approaches and provide experiments on both synthetic data and real world data.