16424311
Model-based fault detection in powerline networking
Powerline networking is increasingly becoming an important component of home networking systems. Its reliability is however still a problem. We consider the popular X10 powerline communication protocol. Our main contribution is a model-based fault detection system that achieves completeness of coverage for X10 faults. We develop experimentally a finite state automaton that models all legal sequences of X10 commands. The task of detecting every violation of this model is complicated by the presence of hidden state and unobservable illegal transitions. This problem is addressed by deducing the model state indirectly from the sequence of X10 commands that is observed on the powerline. To this end, we formulate the model state deduction task in terms of the observability of the model, a concept which arises in discrete-event dynamic systems. Based on the observability property of our X10 model, the detection of model violations is performed in our current implementation via regular expressions on observable X10 command sequences. Our final contribution is a preliminary diagnosis procedure for identifying X10 faults.
9300546
Detecting stealth software with Strider GhostBuster
Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of the Internet. Resource hiding is a powerful stealth technique commonly used by malware to evade detection by computer users and anti-malware scanners. In this paper, we focus on a subclass of malware, termed "ghostware", which hide files, configuration settings, processes, and loaded modules from the operating system's query and enumeration application programming interfaces (APIs). Instead of targeting individual stealth implementations, we describe a systematic framework for detecting multiple types of hidden resources by leveraging the hiding behavior as a detection mechanism. Specifically, we adopt a cross-view diff-based approach to ghostware detection by comparing a high-level infected scan with a low-level clean scan and alternatively comparing an inside-the-box infected scan with an outside-the-box clean scan. We describe the design and implementation of the Strider GhostBuster tool and demonstrate its efficiency and effectiveness in detecting resources hidden by real-world malware such as rootkits, Trojans, and key-loggers.
15335137
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities
Internet attacks that use malicious web sites to install malware programs by exploiting browser vulnerabilities are a serious emerging threat. In response, we have developed an automated web patrol system to automatically identify and monitor these malicious sites. We describe the design and implementation of the Strider HoneyMonkey Exploit Detection System, which consists of a pipeline of “monkey programs” running possibly vulnerable browsers on virtual machines with different patch levels and patrolling the Web to seek out and classify web sites that exploit browser vulnerabilities. Within the first month of utilizing this system, we identified 752 unique URLs hosted on 288 web sites that could successfully exploit unpatched Windows XP machines. The system automatically constructed topology graphs based on traffic redirection to capture the relationship between the exploit sites. This allowed us to identify several major players who are responsible for a large number of exploit pages. By monitoring these 752 exploit-URLs on a daily basis, we discovered a malicious web site that was performing zero-day exploits of the unpatched javaprxy.dll vulnerability and was operating behind 25 exploit-URLs. It was confirmed as the first “inthe-wild”, zero-day exploit of this vulnerability that was reported to the Microsoft Security Response Center. Additionally, by scanning the most popular one million URLs as classified by a search engine, we found over seven hundred exploit-URLs, many of which serve popular content related to celebrities, song lyrics, wallpapers, video game cheats, and wrestling.
28971506
Statistical identification of encrypted Web browsing traffic
Encryption is often proposed as a tool for protecting the privacy of World Wide Web browsing. However, encryption-particularly as typically implemented in, or in concert with popular Web browsers-does not hide all information about the encrypted plaintext. Specifically, HTTP object count and sizes are often revealed (or at least incompletely concealed). We investigate the identifiability of World Wide Web traffic based on this unconcealed information in a large sample of Web pages, and show that it suffices to identify a significant fraction of them quite reliably. We also suggest some possible countermeasures against the exposure of this kind of information and experimentally evaluate their effectiveness.
16068554
The SIMBA user alert service architecture for dependable alert delivery
Alerts refer to the delivery of user-subscribed information to the user. As the number of alert services and the types of information delivery devices increase, a new model that allows users to manage alert delivery and avoid alert overflow is needed. The unique dependability challenge in the management of alerts is in the proper use of redundancy to achieve timeliness and reliability without being unduly intrusive or cumbersome. We describe the design, implementation, and user experience of an alert service architecture, called SIMBA. SIMBA utilizes Instant Messaging with acknowledgements as the universal, reliable alert delivery channel, with emails being the fallback channel. All alerts that a user subscribes to are first directed to the user's MyAlertBuddy, which allows centralized delivery preference customization and acts as a personal alert router to protect the privacy of user addresses. Delivery modes, each of which involves multiple user addresses to accommodate communication failures, are supported as an abstraction for specifying personalized dependability levels. A working implementation of the SIMBA system, which integrates five different types of alert services, is described. Challenges and techniques in maintaining a highly available MyAlertBuddy to avoid single-point of failure are discussed. The concept of exception handling automation is introduced for enhancing the robustness of applications that drive third-party communication client software through automation interfaces.
16817937
COMERA: COM Extensible Remoting Architecture
In a distributed object system, remoting architecture refers to the infrastructure that allows client programs to invoke methods on remote server objects in a transparent way. In this paper, we study the strength and limitations of current remoting architecture of COM (Component Object Model), and propose a new architecture called COMERA (COM Extensible Remoting Architecture) to enhance the extensibility and flexibility. We describe several application scenarios and implementations to demonstrate the power of such a componentized remoting architecture.
46137989
On information and knowledge representation in the brain
The cognitive models of information representation and the capacity of human memory are fundamental research areas in cognitive informatics, which help to reveal the mechanism and potential of the brain. This paper develops the object-attribute-relation (OAR) model for describing information representation and storage in the brain. According to the OAR model, the human memory and knowledge are represented by relations, i.e. connections of synapses between neurons, rather than by the neurons themselves as the traditional container metaphor described. Based on the OAR model, the memory capacity of the human brain is calculated as in the order of 10/sup 8432/ bits. The determination of the magnitude of human memory capacity is not only theoretically significant in cognitive informatics, but also practically useful to estimate the human potential, as well as the gap between the natural and machine intelligence.
21531236
Towards Unsupervised Segmentation of Semi-rigid Low-Resolution Molecular Surfaces
In this paper, we study a particular type of surface segmentation problem motivated by molecular biology applications. In particular, two input surfaces are given, coarsely modeling two different conformations of a molecule undergoing a semi-rigid deformation. The molecule consists of two subunits that move in a roughly rigid manner. The goal is to segment the input surfaces into these semi-rigid subcomponents. The problem is closely related to non-rigid surface registration problems, although considering only a special type of deformation that exists commonly in macromolecular movements (such as the popular hinge motion). We present and implement an efficient paradigm for this problem, which combines several existing and new ideas. We demonstrate the performance of our new algorithm by some preliminary experimental results in segmenting low-resolution molecular surfaces.
1164311
Trust and reputation model in peer-to-peer networks
It is important to enable peers to represent and update their trust in other peers in open networks for sharing files, and especially services. We propose a Bayesian network-based trust model and a method for building reputation based on recommendations in peer-to-peer networks. Since trust is multifaceted, peers need to develop differentiated trust in different aspects of other peers' capability. The peer's needs are different in different situations. Depending on the situation, a peer may need to consider its trust in a specific aspect of another peer's capability or in multiple aspects. Bayesian networks provide a flexible method to present differentiated trust and combine different aspects of trust. The evaluation of the model using a simulation shows that the system where peers communicate their experiences (recommendations) outperforms the system where peers do not share recommendations with each other and that a differentiated trust adds to the performance in terms of percentage of successful interactions.
21557809
Formal description of the cognitive process of problem solving
One of the fundamental human cognitive processes is problem solving. Most of the decisions we make relate to some kind of problems we try to solve no matter how trivial and critical the problem may be. The problem solving process entails performing in a new situation with information acquired and knowledge learned from past situations. As a higher level cognitive process, problem solving involves the correlation process effort to connect newly encounter problem object(s) with the object-attribute-relation (OAR) model representation of knowledge in the brain. The goal of problem solving is to search along various solution paths within the problem solver's knowledge base in the memory. When a problem object is identified, problem solving can be perceived as a search process in the memory space for finding a relationship between a set of problem-solving goals and a set of alternative paths. This paper presents a mathematical and cognitive model that describes problem solving as a cognitive process. The cognitive structures of the brain and the mechanisms of internal knowledge representation behind the cognitive process of problem solving are explained. The cognitive process is then formally and rigorously described using real-time process algebra (RTPA) base on the aforementioned models. Extended discussions are presented on applications of the cognitive process model of problem solving in software engineering and psychology.
1363812
Models For Dependable Computation with Multiple Inputs and Some Hardness Results
We consider the problem of dependable computation with multiple inputs. The goal is to study when redundancy can help to achieve survivability and when it cannot. We use AND/OR graphs to model fault tolerant computations with multiple inputs. While there is a polynomial time algorithm for finding vertex disjoint paths in networks, we will show that the equivalent problem in computation systems with multiple inputs is NP-hard. Our main results are as follows. (1) We present a general model for fault tolerant computation systems with multiple inputs: AND/OR graphs. (2) We show that it is NP-hard to find two vertex disjoint solution graphs in an AND/OR graph. It follows that in the general case redundancy cannot help to achieve survivability, assuming P≠NP.