6868150
FLIPS: Hybrid Adaptive Intrusion Prevention
Intrusion detection systems are fundamentally passive and fail–open. Because their primary task is classification, they do nothing to prevent an attack from succeeding. An intrusion prevention system (IPS) adds protection mechanisms that provide fail–safe semantics, automatic response capabilities, and adaptive enforcement. We present FLIPS (Feedback Learning IPS), a hybrid approach to host security that prevents binary code injection attacks. It incorporates three major components: an anomaly-based classifier, a signature-based filtering scheme, and a supervision framework that employs Instruction Set Randomization (ISR). Since ISR prevents code injection attacks and can also precisely identify the injected code, we can tune the classifier and the filter via a learning mechanism based on this feedback. Capturing the injected code allows FLIPS to construct signatures for zero-day exploits. The filter can discard input that is anomalous or matches known malicious input, effectively protecting the application from additional instances of an attack – even zero-day attacks or attacks that are metamorphic in nature. FLIPS does not require a known user base and can be deployed transparently to clients and with minimal impact on servers. We describe a prototype that protects HTTP servers, but FLIPS can be applied to a variety of server and client applications.
11784167
An access control language for web services
This paper presents an approach for formally specifying and enforcing security policies on web service implementations. Networked services in general, and web services in particular, require extensive amounts of code to ensure that clients respect site-integrity constraints. We provide a language by which these constraints can be expressed and enforced automatically, portably and efficiently. Security policies in our system are specified in a language based on temporal logic, and are processed by an enforcement engine to yield site and platform-specific access control code. This code is integrated with a web server and platform-specific libraries to enforce the specified policy on a given web service. Our approach decouples the security policy specification from service implementations, provides a mandatory access control model for web services, and achieves good performance. We show that up to 22% of the code in a traditional web service module is dedicated to security checking functionality, including checks for client sequencing and parameter validation. We show that our prototype language implementation, WebGuard, enables web programmers to significantly reduce the amount of security checking code they need to develop manually. The quality of the code generated by WebGuard from formal policy specifications is competitive with the latency of handcrafted code to within a few percent.
38950979
Behavior Profiling of Email
This paper describes the forensic and intelligence analysis capabilities of the Email Mining Toolkit (EMT) under development at the Columbia Intrusion Detection (IDS) Lab. EMT provides the means of loading, parsing and analyzing email logs, including content, in a wide range of formats. Many tools and techniques have been available from the fields of Information Retrieval (IR) and Natural Language Processing (NLP) for analyzing documents of various sorts, including emails. EMT, however, extends these kinds of analyses with an entirely new set of analyses that model "user behavior". EMT thus models the behavior of individual user email accounts, or groups of accounts, including the "social cliques" revealed by a user's email behavior.
26247223
Combining Description Logic and Defeasible Logic for the Semantic Web
The importance of integrating rules and ontologies for the Semantic Web has been well addressed by many researchers. Defeasible Logic is a simple but efficient nonmonotonic language which can handle both defeasibility and priority. In this paper we propose a novel approach to combining Defeasible Logic with Description Logics by introducing the Description Defeasible Logic (DDL). DDL is similar to Defeasible Logic but it also contains queries to the Description Logic knowledge base. DDL allows nonmonotonic reasoning to be built on top of ontologies, and to a certain degree, allows ontologies to be built on top of nonmonotonic reasoning. We give some basic properties of DDL, one of which shows that DDL is a tractable language provided that the underlying Description Logic is tractable.
11271251
Top-down specialization for information and privacy preservation
Releasing person-specific data in its most specific state poses a threat to individual privacy. This paper presents a practical and efficient algorithm for determining a generalized version of data that masks sensitive information and remains useful for modelling classification. The generalization of data is implemented by specializing or detailing the level of information in a top-down manner until a minimum privacy requirement is violated. This top-down specialization is natural and efficient for handling both categorical and continuous attributes. Our approach exploits the fact that data usually contains redundant structures for classification. While generalization may eliminate some structures, other structures emerge to help. Our results show that quality of classification can be preserved even for highly restrictive privacy requirements. This work has great applicability to both public and private sectors that share information for mutual benefits and productivity.
14817828
Argumentation-based abduction in disjunctive logic programming
Abstract In this paper, we propose an argumentation-based semantic framework, called DAS, for disjunctive logic programming. The basic idea is to translate a disjunctive logic program into an argumentation-theoretic framework. One unique feature of our proposed framework is to consider the disjunctions of negative literals as possible assumptions so as to represent incomplete information. In our framework, three semantics preferred disjunctive hypothesis (PDH), complete disjunctive hypothesis (CDH) and well-founded disjunctive hypothesis (WFDH) are defined by three kinds of acceptable hypotheses to represent credulous, moderate and skeptical reasoning in artificial intelligence (AI), respectively. Furthermore, our semantic framework can be extended to a wider class than that of disjunctive programs (called bi-disjunctive logic programs). In addition to being a first serious attempt in establishing an argumentation-theoretic framework for disjunctive logic programming, DAS integrates and naturally extends many key semantics, such as the minimal models, extended generalized closed world assumption (EGCWA), the well-founded model, and the disjunctive stable models. In particular, novel and interesting argumentation-theoretic characterizations of the EGCWA and the disjunctive stable semantics are shown. Thus the framework presented in this paper does not only provide a new way of performing argumentation (abduction) in disjunctive deductive databases, but also is a simple, intuitive and unifying semantic framework for disjunctive logic programming.
9884844
Parallel multilevel block ILU preconditioning techniques for large sparse linear systems
We present a class of parallel preconditioning strategies built on a multilevel block incomplete LU (ILU)factorization technique to solve large sparse linear systems on distributed memory parallel computers. The preconditioners are constructed by using the concept of block independent sets. Two algorithms for constructing block independent sets of a distributed sparse matrix are proposed. We compare a few implementations of the parallel multilevel ILU preconditioners with different block independent set algorithms and different coarse level solution strategies. We also use some diagonal thresholding and perturbation strategies to enhance factorization stability. Numerical experiments indicate that our parallel multilevel block ILU preconditioners are robust and efficient.
12098916
Binary decision diagram with minimum expected path length
We present methods to generate a Binary Decision Diagram (BDD) with minimum expected path length. A BDD is a generic data structure which is widely used in several fields. One important application is the representation of Boolean functions. A BDD representation enables us to evaluate a Boolean function: Simply traverse the BDD from the root node to the terminal node and retrieve the value in the terminal node. For a BDD with minimum expected path length will be also minimized the evaluation time for the corresponding Boolean function. Three efficient algorithms for constructing BDDs with minimum expected path length are proposed.