26798727
BANDS: An Inter-domain Internet Security Policy Management System for IPSec/VPN
IPSec/VPN is widely deployed for users to remotely access their corporate data. IPSec policies must be correctly set up for VPN to provide anticipated protection. Manual policy setup is unscalable, inefficient and error-prone. Automated policy generation to comply with and enforce high-level security policies is desired but difficult, especially in an inter-domain environment when a VPN traverses multiple domains. This paper presents a distributed framework and protocol, BANDS, for inter-domain policy negotiation and generation. The BANDS architecture consists of two phases: AS (autonomous system) route path discovery and an inter-domain collaborative protocol for policy negotiation among the autonomous systems discovered in the first phase. Each AS conceptually has one security requirement server responsible for the task of inter-domain policy negotiation. Following this two-step process in BANDS, a set of distributed security policies (for the implementation of policy enforcement) is automatically negotiated/generated based on decentralized and predefined security requirements.
39342835
Guaranteed Mutually Consistent Checkpointing in Distributed Computations
In this paper, we explore the isomorphism between vector time and causality to characterize consistency of a set of checkpoints in a distributed computing. A necessary and sufficient condition, to determine if a set of local checkpoints can form a consistent global checkpoint, is presented and proved using the isomorphic power of vector time and causality. To the best of our knowledge, this is the first attempt to use the isomorphism for this purpose. This condition leads to a simple and straightforward algorithm for a guaranteed mutually consistent global checkpointing. In our approach, a process can take a checkpoint whenever and wherever it wants while other related process may be asked to take an additional checkpoint for ensuring the mutual consistency. We also show how this condition and the resulting algorithm can be used to obtain a maximum and minimum global checkpoints, another important paradigm for distributed applications.
2702750
A new look at multimedia synchronization in distributed environments
A multimedia system requires to handle automatically and uniformly the generation, manipulation, presentation, storage, and communication of independent discrete and continuous media data. The synchronization between various kinds of media data is a key issue in an integrated multimedia system, and has drawn a considerable attention. In this paper we investigate the synchronization problem in distributed multimedia environments and propose a new approach. Based on a globally synchronized clock, we present an isochronous clock-driven protocol for multimedia synchronization in a distributed environment. We show that the isochronous approach is simple, easy to understand, and more importantly, can guarantee the temporal ordering (including causal order and /spl Delta/-causal order). We believe that with the new developments in the improved NTP over Internet and very high accuracy of synchronized clocks over ATM and LANs, the clock-based distributed synchronization would provide a promising, yet simple and intuitive, alternative to the existing approaches.
58339956
IPsec/VPN security policy correctness and assurance
With IPsec/VPN policies being widely deployed, how to correctly specify and configure them is critical in enforcing security requirements, especially among different administrative domains across the Internet. Under current practice, IPsec/VPN policies are specified individually by system administrators from different organizations without any formal coordination. This practice implies unintentional errors due to inconsistent IPsec/VPN policies. Furthermore, Internet routing dynamics may possibly interfere with IPsec/VPN policies such that unexpected conflicts occur due to a mismatch between the routing and IPsec/VPN layers. To deal with these problems, we formally define IPsec security requirements, policies, and their correctness criteria. Based on these definitions, we present an inter-domain architecture to automatically generate correct and efficient security policies. Our approach works when we are given a set of security requirements for a single end-to-end traffic flow. We can also deal with changes when new security requirements are added. Finally, we present simulation results which evaluate the performance of our solutions.
11534248
Mining in Anticipation for Concept Change: Proactive-Reactive Prediction in Data Streams
Prediction in streaming data is an important activity in the modern society. Two major challenges posed by data streams are (1) the data may grow without limit so that it is difficult to retain a long history of raw data; and (2) the underlying concept of the data may change over time. The novelties of this paper are in four folds. First, it uses a measure of conceptual equivalence to organize the data history into a history of concepts. This contrasts to the common practice that only keeps recent raw data. The concept history is compact while still retains essential information for learning. Second, it learns concept-transition patterns from the concept history and anticipates what the concept will be in the case of a concept change. It then proactively prepares a prediction model for the future change. This contrasts to the conventional methodology that passively waits until the change happens. Third, it incorporates proactive and reactive predictions. If the anticipation turns out to be correct, a proper prediction model can be launched instantly upon the concept change. If not, it promptly resorts to a reactive mode: adapting a prediction model to the new data. Finally, an efficient and effective system RePro is proposed to implement these new ideas. It carries out prediction at two levels, a general level of predicting each oncoming concept and a specific level of predicting each instance's class. Experiments are conducted to compare RePro with representative existing prediction methods on various benchmark data sets that represent diversified scenarios of concept change. Empirical evidence offers inspiring insights and demonstrates the proposed methodology is an advisable solution to prediction in data streams.
2911118
A Theory of Network Localization
In this paper, we provide a theoretical foundation for the problem of network localization in which some nodes know their locations and other nodes determine their locations by measuring the distances to their neighbors. We construct grounded graphs to model network localization and apply graph rigidity theory to test the conditions for unique localizability and to construct uniquely localizable networks. We further study the computational complexity of network localization and investigate a subclass of grounded graphs where localization can be computed efficiently. We conclude with a discussion of localization in sensor networks where the sensors are placed randomly
14899560
Dealing with Predictive-but-Unpredictable Attributes in Noisy Data Sources
Attribute noise can affect classification learning. Previous work in handling attribute noise has focused on those predictable attributes that can be predicted by the class and other attributes. However, attributes can often be predictive but unpredictable. Being predictive, they are essential to classification learning and it is important to handle their noise. Being unpredictable, they require strategies different from those of predictable attributes. This paper presents a study on identifying, cleansing and measuring noise for predictive-but-unpredictable attributes. New strategies are accordingly proposed. Both theoretical analysis and empirical evidence suggest that these strategies are more effective and more efficient than previous alternatives.
599278
Extending RDF in distributed knowledge-intensive applications
The resource description framework (RDF) has become a formal language tool to specify the semantics of distributed systems, such as web services nowadays. In fact, it can also be extended to describe entities and relationships within specific application environments to support knowledge sharing and ontology construction. This paper presents two case studies on a network management knowledge model and a distributed workflow system process ontology. With practical experiences, the authors suggest how RDF can be applied innovatively and effectively to reengineer data integration solutions in different novel knowledge-intensive areas, which, in the past, were built upon traditional modelling languages, such as XML.
8861403
Design and implementation of the just-in-time retrieving policy for schedule-based distributed multimedia presentations
In order to provide the smooth playback of a distributed multimedia presentation, the object-retrieving engine for the player must fetch each object before its playback time. In this paper, a smart object-retrieving engine is proposed, which adopts a retrieving policy named the just-in-time policy. The policy expects the retrieval process of an object to finish right before the playback time of the object to achieve a better buffer utilization and network bandwidth efficiency. The proposed object-retrieving engine focuses on SMIL1.0-based multimedia presentations. By converting the synchronization relationship of objects in the SMIL 1.0 document to Real-Time Synchronization Model, which simplifies the handling of the synchronization relationship, and considering the end-to-end bandwidth as well as the user interactions, the object-retrieving engine determines the object request time for each object. The engine issues the request to fetch each object for the ongoing presentation at the object request time, and provides the player with proper media objects. The feasibility and better performance of the proposed just-in-time retrieving policy had been proved by performance measurements of system implementation.