17933107
Safety analysis of usage control authorization models
The usage control (UCON) model was introduced as a unified approach to capture a number of extensions for traditional access control models. While the policy specification flexibility and expressive power of this model have been studied in previous work, as a related and fundamental problem, the safety analysis of UCON has not been explored. This paper presents two fundamental safety results for UCONA, a sub-model of UCON only considering authorizations. In UCONA, an access control decision is based on the subject and/or the object attributes, which can be changed as the side-effects of using the access right, resulting in possible changes to future access control decisions. Hence the safety question in UCONA is all the more pressing since every access can potentially enable additional permissions due to the mutability of attributes in UCON. In this paper, first we show that the safety problem is in general undecidable. Then, we show that a restricted form of UCONA with finite attribute value domains and acyclic attribute creation relation has a decidable safety property. The decidable model maintains good expressive power as shown by specifying an RBAC system with a specific user-role assignment scheme and a DRM application with consumable rights.
736327
A usage-based authorization framework for collaborative computing systems
Collaborative systems such as Grids provide efficient and scalable access to distributed computing capabilities and enable seamless resource sharing between users and platforms. This heterogeneous distribution of resources and the various modes of collaborations that exist between users, virtual organizations, and resource providers require scalable, flexible, and fine-grained access control to pro-tect both individual and shared computing resources. In this paper we propose a usage control (UCON) based authorization frame-work for collaborative applications. In our framework, usage con-trol policies are defined using subject and object attributes, along with system attributes as conditions. General attributes include not only persistent attributes such as role and group memberships, but also mutable usage attributes of subjects and objects. Conditions in UCON can be used to support context-based authorizations in ad-hoc collaborations. As a proof-of-concept we implement a pro-totype system based on our proposed architecture and conduct ex-perimental studies to demonstrate the feasibility and performance of our approach.
2355764
Locating faults through automated predicate switching
Typically debugging begins when during a program execution a point is reached at which an obviously incorrect value is observed. A general and powerful approach to automated debugging can be based upon identifying modifications to the program state that will bring the execution to a successful conclusion. However, searching for arbitrary changes to the program state is difficult due to the extremely large search space. In this paper we demonstrate that by forcibly switching a predicate's outcome at runtime and altering the control flow, the program state can not only be inexpensively modified, but in addition it is often possible to bring the program execution to a successful completion (i.e., program produces the desired output). By examining the switched predicate, also called the critical predicate, the cause of the bug can then be identified. Since the outcome of a branch can only be either true or false, the number of modified states resulting by predicate switching is far less than those possible through arbitrary state changes. Thus, it is possible to automatically search through modified states to find one that leads to the correct output. We have developed an implementation based upon dynamic instrumentation to perform this search through program re-execution -- the program is executed from the beginning and a predicate's outcome is switched to produce the desired change in control flow. To evaluate our approach, we tried our technique on several reported bugs for a number of UNIX utility programs. Our technique was found to be practical (i.e., acceptable in time taken) and effective (i.e., we were able to automatically identify critical predicates). Moreover we show that bidirectional dynamic slices of critical predicates capture the faulty code.
3446035
Resource-Bounded Searches in an Information Marketplace
Over the past five years, we have been developing a Web-based, resource-bounded, information-gathering agent-called BIG, for Bounded Information Gathering-to support a human decision process. Although its techniques are general enough to apply to a wide range of domains, BIG specifically helps clients pick software packages. For example, a client can instruct BIG to recommend a database package for Windows 98 and specify constraints on both the search process and the product characteristics. BIG will then formulate a plan, locate and extract relevant information from both structured and unstructured documents, and return a recommendation to the client, along with supporting data. Our focus is on a recently developed capability, namely, to schedule information-gathering activity in a way that controls the money spent on acquiring information from sites that charge a fee for access. This capability supports an information marketplace on the Web, which we feel will eventually supersede (but obviously not completely replace) the current model of free information access supported by advertising fees.
16218609
Exploring constraints to efficiently mine emerging patterns from large high-dimensional datasets
Emerging patterns (EPs) were proposed recently to capture changes or di erences betw een datasets: an EP is a multivariate feature whose support increases sharply from a background dataset to a target dataset, and the support ratio is called its gro wth rate. Interesting long EPs often have low support; mining such EPs from high-dimensional datasets is a great challenge due to the combinatorial explosion of the number of candidates. We propose a Constraint-based EP Miner, ConsEPMiner, that utilizes tw o types of constraints for e ectively pruning the search space: External constrain tsare user-giv enminimums on support, growth rate, and growth-rate improvement to con ne the resulting EP set. Inheren t constrain ts | same subset support, top growth rate, and same origin | are deriv ed from the propertiesof EPs and datasets, and are solely for pruning the search space and saving computation. ConsEPMiner can eÆciently mine all EPs at low support on large highdimensional datasets, with low minimums on growth rate and growth-rate improvement. In comparison, the widely known Apriori-like approach is ine ective on high-dimensional data. While ConsEPMiner adopts several ideas from DenseMiner [4], a recent constrain t-based association rule miner, its main new contributions are the introduction of inherent constrain ts and the ways to use them together with externalconstrain ts for eÆcient EP mining from dense datasets. Experiments on dense data show that, at low support, ConsEPMiner outperforms the Apriori-like approach by orders of magnitude and is more than twice as fast as the DenseMiner approach.
11467593
Generating Multidimensional Schemata from Relational Aggregation Queries
Queries on operational databases can be viewed as a form of business rules on data warehouse schema design. We propose to use such queries to automatically generate measures, dimensions and dimension hierarchies and their representation in a star schema. The schema produced with our approach has good properties such as non-redundant dimensional attributes and orthogonality among dimensions and can answer many more queries than just those it was generated from.
20308673
A Learning-Based Contact Model in Belt-Grinding Processes
It is crucial to calculate the Signorini contact problem at high speed in real-time simulation of the belt grinding process. Finite Element Method (FEM) is the traditional way to solve such a contact problem. However, FEM is too time-consuming to fulfill the real-time simulation requirement. This paper demonstrates a new approach to model the Signorini contact problem based on learning. This new model averts doing the expensive optimization problem for each contact by FEM; hence dramatically reduces the calculating time. Multi-Layers Neurons (MLN) and Support Vector Regression (SVR) are adopted as a learning machine. The testing errors of these two learning machines are also compared. SVR showed superior performance than MLN in this application.