13895152
ShieldGen: Automatic Data Patch Generation for Unknown Vulnerabilities with Informed Probing
In this paper, we present ShieldGen, a system for automatically generating a data patch or a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. The key novelty in our work is that we leverage knowledge of the data format to generate new potential attack instances, which we call probes, and use a zero-day detector as an oracle to determine if an instance can still exploit the vulnerability; the feedback of the oracle guides our search for the vulnerability signature. We have implemented a ShieldGen prototype and experimented with three known vulnerabilities. The generated signatures have no false positives and a low rate of false negatives due to imperfect data format specifications and the sampling technique used in our probe generation. Overall, they are significantly more precise than the signatures generated by existing schemes. We have also conducted a detailed study of 25 vulnerabilities for which Microsoft has issued security bulletins between 2003 and 2006. We estimate that ShieldGen can produce high quality signatures for a large portion of those vulnerabilities and that the signatures are superior to the signatures generated by existing schemes.
42916380
Policy-enabled handoffs across heterogeneous wireless networks
"Access is the killer app" is the vision of the Daedalus project at UC Berkeley. Being able to be connected seamlessly anytime anywhere to the best network still remains an unfulfilled goal. Often, even determining the "best" network is a challenging task because of the widespread deployment of overlapping wireless networks. We describe a policy-enabled handoff system that allows users to express policies on what is the "best" wireless system at any moment, and make tradeoffs among network characteristics and dynamics such as cost, performance and power consumption. We designed a performance reporting scheme estimating current network conditions, which serves as input to the policy specification. A primary goal of this work is to make it possible to balance the bandwidth load across networks with comparable performance. To avoid the problem of handoff instability, i.e., many mobile hosts making the same handoff decision at essentially the same time, we designed randomization into our mechanism. Given the current "best" network, our system determines whether the handoff is worthwhile based on the handoff overhead and potential network usage duration.
1513566
Passive network tomography using Bayesian inference
In this paper, we investigate the problem of identifying lossy links in the interior of the Internet by passively observing the end-to-end performance of existing traffic between a server and its clients. This is in contrast to the previous work on network tomography (e.g., [1]) that has been based on active probing. The key advantage of a passive approach is that it does not introduce wasteful traffic which might perturb the object of inference, i.e., the link loss rates. Moreover, our techniques depend only on knowing the number of lost and successful packets sent to each client rather than the exact loss sequence required by previous techniques such as [1]. While accuracy of link loss rate inference may consequently suffer, our techniques can still pinpoint the trouble spots in the network (e.g., highly lossy links). We have developed three techniques for passive network tomography: Random Sampling, Linear Optimization, and Bayesian Inference using Gibbs Sampling. We have evaluated these techniques using simulations and traces gathered at a busy Web server. In this paper, we focus on the Gibbs Sampling technique; more information on the three techniques appears in [3].
9905659
A signaling system using lightweight call sessions
Because of the emergence of heterogeneous access devices and diverse wired and wireless networks, and a substantial lack of support for integrating these networks, we are building a communication network and a service infrastructure that provides integrated telephony and data services across these networks. We generalize the basic call service to support communication between two or more call parties using any number of devices through any media. Call setup has already been addressed by protocols such as the session initiation protocol (SIP), so we focus on a missing component: scalable and fault-tolerant call session maintenance and control after call setup. In this paper, we present a new signaling protocol that offers scalability, high availability, robustness, and flexibility in creating new call processing services. The protocol is compatible with existing call setup protocols, but provides lightweight call session management using a completely decentralized, soft-state group control protocol. We show that this approach simplifies the implementation of the basic call service, including multi-device calling and service handoff between diverse access networks. The design of our protocol follows the principle of separation of control (signaling information) from data. The signaling protocol has been implemented in ICEBERG, an IP-based core network testbed with access to heterogeneous networks.
2228641
Server-based inference of Internet link lossiness
The problem of inferring the packet loss characteristics of Internet links using server-based measurements is investigated. Unlike much of existing work on network tomography that is based on active probing, we make inferences based on passive observation of end-to-end client-server traffic. Our work on passive network tomography focuses on identifying lossy links (i.e., the trouble spots in the network). We have developed three techniques for this purpose based on random sampling, linear optimization, and Bayesian inference using Gibbs sampling, respectively. We evaluate the accuracy of these techniques using both simulations and Internet packet traces. We find that these techniques can identify most of the lossy links in the network with a manageable false positive rate. For instance, simulation results indicate that the Gibbs sampling technique has over 80% coverage with a false positive rate under 5%. Furthermore, this technique provides a confidence indicator on its inference. We also perform inference based on Internet traces gathered at the busy microsoft.com Web site. However, validating these inferences is a challenging problem. We present a method for indirect validation that suggests that the false positive rate is manageable.
7336686
Online aggregation
Aggregation in traditional database systems is performed in batch mode: a query is submitted, the system processes a large volume of data over a long period of time, and, eventually, the final answer is returned. This archaic approach is frustrating to users and has been abandoned in most other areas of computing. In this paper we propose a new online aggregation interface that permits users to both observe the progress of their aggregation queries and control execution on the fly. After outlining usability and performance requirements for a system supporting online aggregation, we present a suite of techniques that extend a database system to meet these requirements. These include methods for returning the output in random order, for providing control over the relative rate at which different aggregates are computed, and for computing running confidence intervals. Finally, we report on an initial implementation of online aggregation in POSTGRES.
14161279
Database System Extensions for Decision Support: the AXL Approach
Research on database-centric data mining is seeking to improve the e ectiveness of database systems in decision support applications. Di erent solutions are now used for di erent problems, including (i) SQL extensions for more complex OLAP queries, (ii) new datablades for special data types such as time-series, and (iii) architectural extensions to support data mining functions. Here, we proposed a uni ed solution for all these problems; the solution is based on User-De ned Aggregates (UDAs) expressed in an SQL-like language called AXL. In this paper, we discuss the architecture and implementation of the AXL prototype and its use and performance in expressing data mining functions and complex OLAP queries.
15118493
Anomaly intrusion detection using multi-objective genetic fuzzy system and agent-based evolutionary computation framework
In this paper, we present a multi-objective genetic fuzzy system for anomaly intrusion detection. The proposed system extracts accurate and interpret able fuzzy rule-based knowledge from network data using an agent-based evolutionary computation framework. The experimental results on KDD-Cup99 intrusion detection benchmark data demonstrate that our system can achieve high detection rate for intrusion attacks and low false positive rate for normal network traffic.
28595757
User-Defined Aggregates for Datamining
9019747
A Novel Alternative Hypothesis Characterization Using Kernel Classifiers for LLR-Based Speaker Verification
In a log-likelihood ratio (LLR)-based speaker verification system, the alternative hypothesis is usually ill-defined and hard to characterize a priori, since it should cover the space of all possible impostors. In this paper, we propose a new LLR measure in an attempt to characterize the alternative hypothesis in a more effective and robust way than conventional methods. This LLR measure can be further formulated as a non-linear discriminant classifier and solved by kernel-based techniques, such as the Kernel Fisher Discriminant (KFD) and Support Vector Machine (SVM). The results of experiments on two speaker verification tasks show that the proposed methods outperform classical LLR-based approaches.
4379994
Interdomain Routing as Social Choice
Interdomain routing is essential to both the stability and efficiency of the global Internet. However, most previous studies focus only on stability, and only on a special class of routing protocols, namely BGP-type, path-vector protocols. In this paper, we conduct a systematic analysis of interdomain routing considering optimality and implementation in strategic settings. We adopt the novel perspective that an interdomain routing system is one which defines a social choice rule that aggregates individual preferences of all of the autonomous systems (ASes) in a network to select interdomain routes with a set of desirable properties. An interdomain routing protocol, then, is a mechanism to implement the identified interdomain routing social choice rule, when the ASes can adopt strategic actions. By pointing out the incompatibility among the desirable properties of an interdomain routing system and the requirements for strategic implementation in distributed settings, we reveal fundamental tradeoffs that must be made when extending BGP or designing the next-generation interdomain routing system. We also provide new insights into BGP, by "reverseengineering" its behaviors from the perspective of social choice and implementation theory.