325582
Virtual Playgrounds for Worm Behavior Investigation
To detect and defend against Internet worms, researchers have long hoped to have a safe convenient environment to unleash and run real-world worms for close observation of their infection, damage, and propagation. However, major challenges exist in realizing such “worm playgrounds”, including the playgrounds' fidelity, confinement, scalability, as well as convenience in worm experiments. In this paper, we present a virtualization-based platform to create virtual worm playgrounds, called vGrounds, on top of a physical infrastructure. A vGround is an all-software virtual environment dynamically created for a worm attack. It has realistic end-hosts and network entities, all realized as virtual machines (VMs) and confined in a virtual network (VN). The salient features of vGround include: (1) high fidelity supporting real worm codes exploiting real vulnerable services, (2) strict confinement making the real Internet totally invisible and unreachable from inside a vGround, (3) high resource efficiency achieving sufficiently large scale of worm experiments, and (4) flexible and efficient worm experiment control enabling fast (tens of seconds) and automatic generation, re-installation, and final tear-down of vGrounds. Our experiments with real-world worms (including multi-vector worms and polymorphic worms) have successfully exhibited their probing and propagation patterns, exploitation steps, and malicious payloads, demonstrating the value of vGrounds for worm detection and defense research.
5818682
Towards an integrated multimedia service hosting overlay
With the proliferation of multimedia data sources on the Internet, we envision an increasing demand for value-added and function-rich multimedia services that transport, process, and analyze multimedia data on behalf of end users. More importantly, multimedia services are expected to be easily accessible and composable by users. In this paper, we propose MSODA, a service-oriented platform that hosts a wide spectrum of media services provided by different parties. From the user's point of view, MSODA is a shared "market" for media service access and composition. For a media service provider, MSODA creates a virtual dedicated environment for service deployment and management. Finally, the underlying MSODA middleware performs the key functions of service composition, configuration, and mapping for users. We discuss key challenges in the design of MSODA and present preliminary results towards its full realization.
6781814
"Out-of-the-Box" Monitoring of VM-Based High-Interaction Honeypots
Honeypot has been an invaluable tool for the detection and analysis of network-based attacks by either human intruders or automated malware in the wild. The insights obtained by deploying honeypots, especially high-interaction ones, largely rely on the monitoring capability on the honeypots. In practice, based on the location of sensors, honeypots can be monitored either internally or externally. Being deployed inside the monitored honeypots, internal sensors are able to provide a semantic-rich view on various aspects of system dynamics (e.g., system calls). However, their very internal existence makes them visible, tangible, and even subvertible to attackers after break-ins. From another perspective, existing external honeypot sensors (e.g., network sniffers) could be made invisible to the monitored honeypot. However, they are not able to capture any internal system events such as system calls executed. 
 
It is desirable to have a honeypot monitoring system that is invisible, tamper-resistant and yet is capable of recording and understanding the honeypot's system internal events such as system calls. In this paper, we present a virtualization-based system called VMscope which allows us to view the system internal events of virtual machine (VM)-based honeypots from outside the honeypots. Particularly, by observing and interpreting VM-internal system call events at the virtual machine monitor (VMM) layer, VMscope is able to provide the same deep inspection capability as that of traditional inside-the-honeypot monitoring tools (e.g., Sebek) while still obtaining similar tamper-resistance and invisibility as other external monitoring tools. We have built a proof-of-concept prototype by leveraging and extending one key virtualization technique called binary translation. Our experiments with real-world honeypots show that VMscope is robust against advanced countermeasures that can defeat existing internally-deployed honeypot monitors, and it only incurs moderate run-time overhead.
15335137
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities
Internet attacks that use malicious web sites to install malware programs by exploiting browser vulnerabilities are a serious emerging threat. In response, we have developed an automated web patrol system to automatically identify and monitor these malicious sites. We describe the design and implementation of the Strider HoneyMonkey Exploit Detection System, which consists of a pipeline of “monkey programs” running possibly vulnerable browsers on virtual machines with different patch levels and patrolling the Web to seek out and classify web sites that exploit browser vulnerabilities. Within the first month of utilizing this system, we identified 752 unique URLs hosted on 288 web sites that could successfully exploit unpatched Windows XP machines. The system automatically constructed topology graphs based on traffic redirection to capture the relationship between the exploit sites. This allowed us to identify several major players who are responsible for a large number of exploit pages. By monitoring these 752 exploit-URLs on a daily basis, we discovered a malicious web site that was performing zero-day exploits of the unpatched javaprxy.dll vulnerability and was operating behind 25 exploit-URLs. It was confirmed as the first “inthe-wild”, zero-day exploit of this vulnerability that was reported to the Microsoft Security Response Center. Additionally, by scanning the most popular one million URLs as classified by a search engine, we found over seven hundred exploit-URLs, many of which serve popular content related to celebrities, song lyrics, wallpapers, video game cheats, and wrestling.
18153606
Virtual distributed environments in a shared infrastructure
We have developed a middleware system that integrates and extends virtual machine and virtual network technologies to support mutually isolated virtual distributed environments in shared infrastructures like the grid and the PlanetLab overlay infrastructure. Integrating virtual network and on-demand virtual machine creation and customization technologies makes virtual distributed environments a reality. The Violin-based middleware system integrates and enhances such technologies to create virtual distributed environments.
38206015
A Scalable HLA-Based Distributed Simulation Framework for VR Application
HLA-based Distributed Simulation technology is employed widely in Virtual Reality (VR) applications, such as military simulation, internet games, roaming etc. To support larger number of participants, scalability is becoming a key issue of VR applications. In this paper, we explore the characteristics of distributed simulation, and analyze the scalability of servers and participants, and classify our approach to improve scalability of VR applications into three aspects: a three-tier node management mode to accommodate more participants, an efficient management of servers to manage scalable number of clients and software development interface to achieve reusability and interoperability of VR applications. We present our middleware platform, HIVE, providing a scalable HLA-based distributed simulation framework for VR applications, on which users can develop VR applications easily and quickly. Then we give the method and view of application integration with HIVE. Finally an experimental demo is given.
14786472
CoarseZ Buffer Bandwidth Model in 3D Rendering Pipeline
Depth traffic occupies a major portion of 3D graphics memory bandwidth. In order to reduce depth reading, we propose employing a low-resolution depth buffer, namely CoarseZ buffer, for tile-level depth culling before per-pixel test. The maximum depth of a tile is stored in the corresponding entry of CoarseZ buffer. Simulation results show that a small CoarseZ buffer can achieve remarkably high culling rate and significantly reduce z-reading bandwidth. We build a model that quantifies the influence of the CoarseZ design parameters on its efficiency and bandwidth. Test results of industrial benchmarks show that CoarseZ with tile size of 4 and bit depth of 16 can be a best selection to reduce memory bandwidth
5057474
Overall Blocking Behavior Analysis of General Banyan-Based Optical Switching Networks
Banyan networks are attractive for serving as the optical switch architectures due to their nice properties of small depth and absolutely signal loss uniformity. Combining the horizontal expansion and vertical stacking of optical banyan networks is a general scheme for constructing banyan-based optical switching networks. The resulting horizontally expanded and vertically stacked optical banyan (HVOB) networks usually take either a high hardware cost or a large network depth to guarantee the nonblocking property. Blocking behavior analysis is an effective approach to studying network performance and finding a graceful compromise among hardware cost, network depth, and blocking probability; however, little has been done to analyze the blocking behavior of general HVOB networks. In this paper, we study the overall blocking behavior of general HVOB networks, where an upper bound on the blocking probability of a HVOB network is developed with respect to the number of planes (stacked copies) and the number of stages. The upper bound accurately depicts the overall blocking behavior of a HVOB network as verified by an extensive simulation study, and it agrees with the strictly nonblocking condition of the network. The derived upper bound is significant because it reveals the inherent relationship among blocking probability, network depth, and network hardware cost, so that a desirable tradeoff can be made among them. In particular, our bound gives network developers an effective tool to estimate the maximum blocking probability of a HVOB network, in which different routing strategies can be applied with a guaranteed performance in terms of blocking probability, hardware cost and network depth. Our upper bound model predicts some unobvious qualitative behaviors of HVOB networks, and it draws an important conclusion that a very low blocking probability (e.g., less than 0.001 percent) can be achieved in a HVOB network without introducing either a significantly high hardware cost or a large network depth
12509330
Approximate Information Flows: Socially-Based Modeling of Privacy in Ubiquitous Computing
In this paper, we propose a framework for supporting sociallycompatible privacy objectives in ubiquitous computing settings. Drawing on social science research, we have developed a key objective called the Principle of Minimum Asymmetry, which seeks to minimize the imbalance between the people about whom data is being collected, and the systems and people that collect and use that data. We have also developed Approximate Information Flow (AIF), a model describing the interaction between the various actors and personal data. AIF effectively supports varying degrees of asymmetry for ubicomp systems, suggests new privacy protection mechanisms, and provides a foundation for inspecting privacy-friendliness of ubicomp systems.
28130722
Quasi-monte carlo simulation in a LIBOR market model
Quasi-Monte Carlo (QMC) methods have been extensively applied to pricing complex derivatives. We apply quasi-Monte Carlo simulation to LIBOR market models based on the Brace-Gatarek-Musiela/Jamshidian framework. We price exotic interest-rate derivatives and compare the results using pseudo random sequences and different low discrepancy sequences.