15335137
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities
Internet attacks that use malicious web sites to install malware programs by exploiting browser vulnerabilities are a serious emerging threat. In response, we have developed an automated web patrol system to automatically identify and monitor these malicious sites. We describe the design and implementation of the Strider HoneyMonkey Exploit Detection System, which consists of a pipeline of “monkey programs” running possibly vulnerable browsers on virtual machines with different patch levels and patrolling the Web to seek out and classify web sites that exploit browser vulnerabilities. Within the first month of utilizing this system, we identified 752 unique URLs hosted on 288 web sites that could successfully exploit unpatched Windows XP machines. The system automatically constructed topology graphs based on traffic redirection to capture the relationship between the exploit sites. This allowed us to identify several major players who are responsible for a large number of exploit pages. By monitoring these 752 exploit-URLs on a daily basis, we discovered a malicious web site that was performing zero-day exploits of the unpatched javaprxy.dll vulnerability and was operating behind 25 exploit-URLs. It was confirmed as the first “inthe-wild”, zero-day exploit of this vulnerability that was reported to the Microsoft Security Response Center. Additionally, by scanning the most popular one million URLs as classified by a search engine, we found over seven hundred exploit-URLs, many of which serve popular content related to celebrities, song lyrics, wallpapers, video game cheats, and wrestling.
6781814
"Out-of-the-Box" Monitoring of VM-Based High-Interaction Honeypots
Honeypot has been an invaluable tool for the detection and analysis of network-based attacks by either human intruders or automated malware in the wild. The insights obtained by deploying honeypots, especially high-interaction ones, largely rely on the monitoring capability on the honeypots. In practice, based on the location of sensors, honeypots can be monitored either internally or externally. Being deployed inside the monitored honeypots, internal sensors are able to provide a semantic-rich view on various aspects of system dynamics (e.g., system calls). However, their very internal existence makes them visible, tangible, and even subvertible to attackers after break-ins. From another perspective, existing external honeypot sensors (e.g., network sniffers) could be made invisible to the monitored honeypot. However, they are not able to capture any internal system events such as system calls executed. 
 
It is desirable to have a honeypot monitoring system that is invisible, tamper-resistant and yet is capable of recording and understanding the honeypot's system internal events such as system calls. In this paper, we present a virtualization-based system called VMscope which allows us to view the system internal events of virtual machine (VM)-based honeypots from outside the honeypots. Particularly, by observing and interpreting VM-internal system call events at the virtual machine monitor (VMM) layer, VMscope is able to provide the same deep inspection capability as that of traditional inside-the-honeypot monitoring tools (e.g., Sebek) while still obtaining similar tamper-resistance and invisibility as other external monitoring tools. We have built a proof-of-concept prototype by leveraging and extending one key virtualization technique called binary translation. Our experiments with real-world honeypots show that VMscope is robust against advanced countermeasures that can defeat existing internally-deployed honeypot monitors, and it only incurs moderate run-time overhead.
42869695
Dynamic RWA Based on the Combination of Mobile Agents Technique and Genetic Algorithm in WDM Networks with Sparse Wavelength Conversion
In this paper, we study the dynamic RWA problem in WDM networks with sparse wavelength conversion and propose a novel hybrid algorithm for it based on the combination of mobile agents technique and genetic algorithm. By keeping a suitable number of mobile agents in the network to cooperatively explore the network states and continuously update the routing tables, the new hybrid algorithm has the ability to promptly determine the first population of routes for a new request based on the routing table of its source node without requiring the time consuming process associated with the available GA-based dynamic RWA algorithms. To achieve a good load balance in WDM networks with sparse wavelength conversion, we adopt in our hybrid algorithm a new reproduction scheme and a new fitness function that simultaneously takes into account the path length, number of free wavelengths and wavelength conversion capability in route selection. Our new algorithm has the capabilities of achieving a better load balance and resulting a significantly lower blocking probability than that of the promising fixed-alternate routing algorithm for both the optical networks with sparse and full-range wavelength converters and the optical networks with sparse and limited-range wavelength converters, as verified by an extensive simulation study upon the ns-2 network simulator. The ability to guarantee both a low blocking probability and a small setup delay makes the new hybrid dynamic RWA algorithm very attractive for both the optical circuit switching networks and future optical burst switching networks.
45958635
Micro power meter for energy monitoring of wireless sensor networks at scale
5057474
Overall Blocking Behavior Analysis of General Banyan-Based Optical Switching Networks
Banyan networks are attractive for serving as the optical switch architectures due to their nice properties of small depth and absolutely signal loss uniformity. Combining the horizontal expansion and vertical stacking of optical banyan networks is a general scheme for constructing banyan-based optical switching networks. The resulting horizontally expanded and vertically stacked optical banyan (HVOB) networks usually take either a high hardware cost or a large network depth to guarantee the nonblocking property. Blocking behavior analysis is an effective approach to studying network performance and finding a graceful compromise among hardware cost, network depth, and blocking probability; however, little has been done to analyze the blocking behavior of general HVOB networks. In this paper, we study the overall blocking behavior of general HVOB networks, where an upper bound on the blocking probability of a HVOB network is developed with respect to the number of planes (stacked copies) and the number of stages. The upper bound accurately depicts the overall blocking behavior of a HVOB network as verified by an extensive simulation study, and it agrees with the strictly nonblocking condition of the network. The derived upper bound is significant because it reveals the inherent relationship among blocking probability, network depth, and network hardware cost, so that a desirable tradeoff can be made among them. In particular, our bound gives network developers an effective tool to estimate the maximum blocking probability of a HVOB network, in which different routing strategies can be applied with a guaranteed performance in terms of blocking probability, hardware cost and network depth. Our upper bound model predicts some unobvious qualitative behaviors of HVOB networks, and it draws an important conclusion that a very low blocking probability (e.g., less than 0.001 percent) can be achieved in a HVOB network without introducing either a significantly high hardware cost or a large network depth
7558919
Siren: Context-aware Computing for Firefighting
Based on an extensive field study of current firefighting practices, we have developed a system called Siren to support tacit communication between firefighters with multiple levels of redundancy in both communication and user alerts. Siren provides a foundation for gathering, integrating, and distributing contextual data, such as location and temperature. It also simplifies the development of firefighting applications using a peer-to-peer network of embedded devices through a uniform programming interface based on the information space abstraction. As a proof of concept, we have developed a prototype context-aware messaging application in the firefighting domain. We have evaluated this application with firefighters and they have found it to be useful for improving many aspects of their current work practices.
858944
Ubiquitous computing for firefighters: field studies and prototypes of large displays for incident command
In this paper, we demonstrate how field studies, interviews, and low-fidelity prototypes can be used to inform the design of ubiquitous computing systems for firefighters. We describe the artifacts and processes used by firefighters to assess, plan, and communicate during emergency situations, showing how accountability affects these decisions, how their current Incident Command System supports these tasks, and some drawbacks of existing solutions. These factors informed the design of a large electronic display for supporting the incident commander, the person who coordinates the overall response strategy in an emergency. Although our focus was on firefighters, our results are applicable for other aspects of emergency response as well, due to common procedures and training.