1475648
VIOLIN: Virtual Internetworking on Overlay Infrastructure
We propose a novel application-level virtual network architecture called VIOLIN (Virtual Internetworking on OverLay INfrastructure). VIOLINs are isolated virtual networks created on top of an overlay infrastructure (e.g., PlanetLab). Entities in a VIOLIN include virtual end-hosts, routers, and switches implemented by software and hosted by physical overlay hosts. Novel features of VIOLIN include: (1) a VIOLIN is a “virtual world” with its own IP address space. All its computation and communications are strictly con.ned within the VIOLIN. (2) VIOLIN entities can be created, deleted, or migrated on-demand. (3) Value-added network services not widely deployed in the real Internet can be provided in a VIOLIN. We have designed and implemented a prototype of VIOLIN in PlanetLab.
6781814
"Out-of-the-Box" Monitoring of VM-Based High-Interaction Honeypots
Honeypot has been an invaluable tool for the detection and analysis of network-based attacks by either human intruders or automated malware in the wild. The insights obtained by deploying honeypots, especially high-interaction ones, largely rely on the monitoring capability on the honeypots. In practice, based on the location of sensors, honeypots can be monitored either internally or externally. Being deployed inside the monitored honeypots, internal sensors are able to provide a semantic-rich view on various aspects of system dynamics (e.g., system calls). However, their very internal existence makes them visible, tangible, and even subvertible to attackers after break-ins. From another perspective, existing external honeypot sensors (e.g., network sniffers) could be made invisible to the monitored honeypot. However, they are not able to capture any internal system events such as system calls executed. 
 
It is desirable to have a honeypot monitoring system that is invisible, tamper-resistant and yet is capable of recording and understanding the honeypot's system internal events such as system calls. In this paper, we present a virtualization-based system called VMscope which allows us to view the system internal events of virtual machine (VM)-based honeypots from outside the honeypots. Particularly, by observing and interpreting VM-internal system call events at the virtual machine monitor (VMM) layer, VMscope is able to provide the same deep inspection capability as that of traditional inside-the-honeypot monitoring tools (e.g., Sebek) while still obtaining similar tamper-resistance and invisibility as other external monitoring tools. We have built a proof-of-concept prototype by leveraging and extending one key virtualization technique called binary translation. Our experiments with real-world honeypots show that VMscope is robust against advanced countermeasures that can defeat existing internally-deployed honeypot monitors, and it only incurs moderate run-time overhead.
5799803
Protection mechanisms for application service hosting platforms
The application service hosting platform (ASHP) has recently received tremendous attention from both industry and academia. An ASHP provides a shared high-performance infrastructure to host different application services (AS), outsourced by application service providers (ASP). In this paper, we focus on the protection of ASHP which has inherent requirement of sharing, openness, and mutual isolation. In contrast to a dedicated server platform, which is analogous with a private house, an ASHP is like an apartment building, involving the 'host' - the ASHP infrastructure, and the 'tenants' - the AS. Strong protection and isolation must be provided between the host and the tenants, as well as between different tenants. Unfortunately, traditional OS architecture and mechanisms are not adequate to provide strong ASHP protection. In this paper we first make the case for a new OS architecture based on the virtual OS technology. We then present three protection mechanisms we have developed in SODA, our ASHP architecture. The mechanisms include: (1) resource isolation between AS; (2) virtual switching and firewalling between AS; and (3) kernelized intrusion detection and logging for each AS. For (3), we have developed a system called Kernort inside the virtual OS kernel. Kernort detects network intrusions in real-time and logs AS activities even when the AS has been compromised. Moreover for the privacy of AS, logs are encrypted by Kernort so that the 'landlord' (namely ASHP owner) cannot view them without authorization. We are applying SODA to iShare, an Internet-based distributed resource sharing platform.
15335137
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities
Internet attacks that use malicious web sites to install malware programs by exploiting browser vulnerabilities are a serious emerging threat. In response, we have developed an automated web patrol system to automatically identify and monitor these malicious sites. We describe the design and implementation of the Strider HoneyMonkey Exploit Detection System, which consists of a pipeline of “monkey programs” running possibly vulnerable browsers on virtual machines with different patch levels and patrolling the Web to seek out and classify web sites that exploit browser vulnerabilities. Within the first month of utilizing this system, we identified 752 unique URLs hosted on 288 web sites that could successfully exploit unpatched Windows XP machines. The system automatically constructed topology graphs based on traffic redirection to capture the relationship between the exploit sites. This allowed us to identify several major players who are responsible for a large number of exploit pages. By monitoring these 752 exploit-URLs on a daily basis, we discovered a malicious web site that was performing zero-day exploits of the unpatched javaprxy.dll vulnerability and was operating behind 25 exploit-URLs. It was confirmed as the first “inthe-wild”, zero-day exploit of this vulnerability that was reported to the Microsoft Security Response Center. Additionally, by scanning the most popular one million URLs as classified by a search engine, we found over seven hundred exploit-URLs, many of which serve popular content related to celebrities, song lyrics, wallpapers, video game cheats, and wrestling.
18153606
Virtual distributed environments in a shared infrastructure
We have developed a middleware system that integrates and extends virtual machine and virtual network technologies to support mutually isolated virtual distributed environments in shared infrastructures like the grid and the PlanetLab overlay infrastructure. Integrating virtual network and on-demand virtual machine creation and customization technologies makes virtual distributed environments a reality. The Violin-based middleware system integrates and enhances such technologies to create virtual distributed environments.
325582
Virtual Playgrounds for Worm Behavior Investigation
To detect and defend against Internet worms, researchers have long hoped to have a safe convenient environment to unleash and run real-world worms for close observation of their infection, damage, and propagation. However, major challenges exist in realizing such “worm playgrounds”, including the playgrounds' fidelity, confinement, scalability, as well as convenience in worm experiments. In this paper, we present a virtualization-based platform to create virtual worm playgrounds, called vGrounds, on top of a physical infrastructure. A vGround is an all-software virtual environment dynamically created for a worm attack. It has realistic end-hosts and network entities, all realized as virtual machines (VMs) and confined in a virtual network (VN). The salient features of vGround include: (1) high fidelity supporting real worm codes exploiting real vulnerable services, (2) strict confinement making the real Internet totally invisible and unreachable from inside a vGround, (3) high resource efficiency achieving sufficiently large scale of worm experiments, and (4) flexible and efficient worm experiment control enabling fast (tens of seconds) and automatic generation, re-installation, and final tear-down of vGrounds. Our experiments with real-world worms (including multi-vector worms and polymorphic worms) have successfully exhibited their probing and propagation patterns, exploitation steps, and malicious payloads, demonstrating the value of vGrounds for worm detection and defense research.
22047646
Performance of Fast Routing Algorithms in Large Optical Switches Built on the Vertical Stacking of Banyan Structures
AbstractVertical stacking of multiple optical banyan networks is a novel scheme for building banyan-based nonblocking optical switches. The resulting network, namely vertically stacked optical banyan (VSOB) network, preserves the properties of small depth and absolutely loss uniformity but loses the nice self-routing capability of banyan networks. To guarantee a high switching speed, routing in VSOB network needs special attentions so that paths can be established as fast as possible. The best known global routing algorithm for an N × N nonblocking VSOB network has the time complexity of O(Nlog N), which will introduce an unacceptable long delay in path establishment for a large size optical switch. In this paper, we propose two fast routing algorithms for the VSOB network based on the idea of inputs grouping. The two algorithms, namely plane fixed routing (PFR) algorithm and partially random routing (PRR) algorithm, have the time complexities of O(log N) and O(
$$\sqrt N $$
) respectively, and FR algorithm can actually turn a VSOB network into a self-routing one. Extensive simulation based on a network simulator indicates that for large VSOB networks our new algorithms can achieve a reasonably low blocking probability while guarantee a very high switching speed.
28130722
Quasi-monte carlo simulation in a LIBOR market model
Quasi-Monte Carlo (QMC) methods have been extensively applied to pricing complex derivatives. We apply quasi-Monte Carlo simulation to LIBOR market models based on the Brace-Gatarek-Musiela/Jamshidian framework. We price exotic interest-rate derivatives and compare the results using pseudo random sequences and different low discrepancy sequences.
30106346
A Genetic Algorithm for Dynamic Routing and Wavelength Assignment in WDM Networks
In this paper, we study the challenging problem of Dynamic Routing and Wavelength Assignment (DRWA) in WDM (Wavelength-Division-Multiplexing) networks with wavelength continuity constraint, and propose an improved genetic algorithm (GA) for it. By adopting a new fitness function to consider simultaneously the path length and number of free wavelengths in cost estimation of a route, the new genetic RWA algorithm can achieve a good load balance among route candidates and result in a lower blocking probability than both the fixed alternative routing algorithm and the previous GA-based algorithm for DRWA, as verified by an extensive simulation study upon the ns-2 network simulator and some typical network topologies.
61072281
A new scheme for lightpath restoration in wdm networks
All-optical networks with wavelength division multiplexing capability are the promising candidates for the next generation Internet. As these networks carry enormous bandwidth, it is not optional for them to be survivable. Although the available proactive restoration schemes provide 100% restoration guarantee, they require a huge extra capacity and usually result in an extremely high blocking probability. In this paper, we propose a novel active scheme that uses multiple predefined but not reserved backup paths along a working path to restore the lightpath in the event of link-failure. Simulation results based on two typical networks indicate that our new restoration method can reduce blocking probability and capacity requirement significantly while guaranteeing a very high restoration probability.
12399461
On the Minimum Common Supergraph of Two Graphs
Abstract The minimum common supergraph of two graphs, g1 and g2, is defined as the smallest graph that includes, as subgraphs, both g1 and g2. It is shown that minimum common supergraph computation can be solved by means of maximum common subgraph computation. For the latter problem, algorithms are known from the literature. It will also be shown that for a certain class of cost functions, the concept of graph edit distance is closely related with the minimum common supergraph.