1558516
Strider: a black-box, state-based approach to change and configuration management and support
Abstract We describe a new approach, called Strider, to Change and Configuration Management and Support (CCMS). Strider is a black-box approach: without relying on specifications, it uses state differencing to identify potential causes of differing program behaviors, uses state tracing to identify actual, run-time state dependencies, and uses statistical behavior modeling for noise filtering. Strider is a state-based approach: instead of linking vague, high level descriptions and symptoms to relevant actions, it models management and support problems in terms of individual, named pieces of low level configuration state and provides precise mappings to user-friendly information through a computer genomics database. We use troubleshooting of configuration failures to demonstrate that the Strider approach reduces problem complexity by several orders of magnitude, making root-cause analysis possible.
16068554
The SIMBA user alert service architecture for dependable alert delivery
Alerts refer to the delivery of user-subscribed information to the user. As the number of alert services and the types of information delivery devices increase, a new model that allows users to manage alert delivery and avoid alert overflow is needed. The unique dependability challenge in the management of alerts is in the proper use of redundancy to achieve timeliness and reliability without being unduly intrusive or cumbersome. We describe the design, implementation, and user experience of an alert service architecture, called SIMBA. SIMBA utilizes Instant Messaging with acknowledgements as the universal, reliable alert delivery channel, with emails being the fallback channel. All alerts that a user subscribes to are first directed to the user's MyAlertBuddy, which allows centralized delivery preference customization and acts as a personal alert router to protect the privacy of user addresses. Delivery modes, each of which involves multiple user addresses to accommodate communication failures, are supported as an abstraction for specifying personalized dependability levels. A working implementation of the SIMBA system, which integrates five different types of alert services, is described. Challenges and techniques in maintaining a highly available MyAlertBuddy to avoid single-point of failure are discussed. The concept of exception handling automation is introduced for enhancing the robustness of applications that drive third-party communication client software through automation interfaces.
15335137
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities
Internet attacks that use malicious web sites to install malware programs by exploiting browser vulnerabilities are a serious emerging threat. In response, we have developed an automated web patrol system to automatically identify and monitor these malicious sites. We describe the design and implementation of the Strider HoneyMonkey Exploit Detection System, which consists of a pipeline of “monkey programs” running possibly vulnerable browsers on virtual machines with different patch levels and patrolling the Web to seek out and classify web sites that exploit browser vulnerabilities. Within the first month of utilizing this system, we identified 752 unique URLs hosted on 288 web sites that could successfully exploit unpatched Windows XP machines. The system automatically constructed topology graphs based on traffic redirection to capture the relationship between the exploit sites. This allowed us to identify several major players who are responsible for a large number of exploit pages. By monitoring these 752 exploit-URLs on a daily basis, we discovered a malicious web site that was performing zero-day exploits of the unpatched javaprxy.dll vulnerability and was operating behind 25 exploit-URLs. It was confirmed as the first “inthe-wild”, zero-day exploit of this vulnerability that was reported to the Microsoft Security Response Center. Additionally, by scanning the most popular one million URLs as classified by a search engine, we found over seven hundred exploit-URLs, many of which serve popular content related to celebrities, song lyrics, wallpapers, video game cheats, and wrestling.
16817937
COMERA: COM Extensible Remoting Architecture
In a distributed object system, remoting architecture refers to the infrastructure that allows client programs to invoke methods on remote server objects in a transparent way. In this paper, we study the strength and limitations of current remoting architecture of COM (Component Object Model), and propose a new architecture called COMERA (COM Extensible Remoting Architecture) to enhance the extensibility and flexibility. We describe several application scenarios and implementations to demonstrate the power of such a componentized remoting architecture.
9300546
Detecting stealth software with Strider GhostBuster
Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of the Internet. Resource hiding is a powerful stealth technique commonly used by malware to evade detection by computer users and anti-malware scanners. In this paper, we focus on a subclass of malware, termed "ghostware", which hide files, configuration settings, processes, and loaded modules from the operating system's query and enumeration application programming interfaces (APIs). Instead of targeting individual stealth implementations, we describe a systematic framework for detecting multiple types of hidden resources by leveraging the hiding behavior as a detection mechanism. Specifically, we adopt a cross-view diff-based approach to ghostware detection by comparing a high-level infected scan with a low-level clean scan and alternatively comparing an inside-the-box infected scan with an outside-the-box clean scan. We describe the design and implementation of the Strider GhostBuster tool and demonstrate its efficiency and effectiveness in detecting resources hidden by real-world malware such as rootkits, Trojans, and key-loggers.
28971506
Statistical identification of encrypted Web browsing traffic
Encryption is often proposed as a tool for protecting the privacy of World Wide Web browsing. However, encryption-particularly as typically implemented in, or in concert with popular Web browsers-does not hide all information about the encrypted plaintext. Specifically, HTTP object count and sizes are often revealed (or at least incompletely concealed). We investigate the identifiability of World Wide Web traffic based on this unconcealed information in a large sample of Web pages, and show that it suffices to identify a significant fraction of them quite reliably. We also suggest some possible countermeasures against the exposure of this kind of information and experimentally evaluate their effectiveness.
6864548
A modified fuzzy logarithmic least squares method for fuzzy analytic hierarchy process
This paper revisits the fuzzy logarithmic least squares method (LLSM) in the analytic hierarchy process and points out its incorrectness in the normalization of local fuzzy weights, infeasibility in deriving the local fuzzy weights of a fuzzy comparison matrix when the lower bound value of a non-normalized fuzzy weight turns out to be greater than its upper bound value, uncertainty of local fuzzy weights for incomplete fuzzy comparison matrices, and unreality of global fuzzy weights. A modified fuzzy LLSM, which is formulated as a constrained nonlinear optimization model, is therefore suggested to tackle all these problems. A numerical example is examined to show the applicability of the modified fuzzy LLSM and its advantages.
11256201
On the normalization of interval and fuzzy weights
The normalization of interval and fuzzy weights is often necessary in multiple criteria decision analysis (MCDA) under uncertainty, especially in analytic hierarchy process (AHP) with interval or fuzzy judgements. The existing normalization methods based on interval arithmetic and fuzzy arithmetic are found flawed and need to be revised. This paper presents the correct normalization methods for interval and fuzzy weights and offers relevant theorems in support of them. Numerical examples are examined to show the correctness of the proposed normalization methods and their differences from those existing normalization methods.
9203132
Nonlinear Estimation and Modeling of fMRI Data Using Spatio-temporal Support Vector Regression
This paper presents a new and general nonlinear framework for fMRI data analysis based on statistical learning methodology: support vector machines. Unlike most current methods which assume a linear model for simplicity, the estimation and analysis of fMRI signal within the proposed framework is nonlinear, which matches recent findings on the dynamics underlying neural activity and hemodynamic physiology. The approach utilizes spatio-temporal support vector regression (SVR), within which the intrinsic spatio-temporal autocorrelations in fMRI data are reflected. The novel formulation of the problem allows merging model-driven with data-driven methods, and therefore unifies these two currently separate modes of fMRI analysis. In addition, multiresolution signal analysis is achieved and developed. Other advantages of the approach are: avoidance of interpolation after motion estimation, embedded removal of low-frequency noise components, and easy incorporation of multi-run, multi-subject, and multi-task studies into the framework.
312809
Segmenting molecular surfaces
This paper presents a new method for segmentation of molecular surfaces. Topological analysis of a scalar function defined on the surface and its associated gradient field reveals the relationship between the features of interest and critical points of the scalar function. The segmentation is obtained by associating segments with local minima/maxima. Controlled simplification of the function merges segments resulting in a hierarchical segmentation of the molecular surface. This segmentation is used to identify rigid components of protein molecules and to study the role of cavities and protrusions in protein-protein interactions.
6114683
The evidential reasoning approach for MADA under both probabilistic and fuzzy uncertainties
Abstract Many multiple attribute decision analysis (MADA) problems are characterised by both quantitative and qualitative attributes with various types of uncertainties. Incompleteness (or ignorance) and vagueness (or fuzziness) are among the most common uncertainties in decision analysis. The evidential reasoning (ER) approach has been developed in the 1990s and in the recent years to support the solution of MADA problems with ignorance, a kind of probabilistic uncertainty. In this paper, the ER approach is further developed to deal with MADA problems with both probabilistic and fuzzy uncertainties. In this newly developed ER approach, precise data, ignorance and fuzziness are all modelled under the unified framework of a distributed fuzzy belief structure, leading to a fuzzy belief decision matrix. A utility-based grade match method is proposed to transform both numerical data and qualitative (fuzzy) assessment information of various formats into the fuzzy belief structure. A new fuzzy ER algorithm is developed to aggregate multiple attributes using the information contained in the fuzzy belief matrix, resulting in an aggregated fuzzy distributed assessment for each alternative. Different from the existing ER algorithm that is of a recursive nature, the new fuzzy ER algorithm provides an analytical means for combining all attributes without iteration, thus providing scope and flexibility for sensitivity analysis and optimisation. A numerical example is provided to illustrate the detailed implementation process of the new ER approach and its validity and wide applicability.