9035709
Persistent-state checkpoint comparison for troubleshooting configuration failures
Application failures characterized by the phrases, “it worked yesterday, but it doesn’t work today” and “it worked on that machine, but it doesn’t work on this machine” are a major source of computer user frustration and a major component in the total cost of ownership. The typical symptom-based troubleshooting approach relies too much on creative thinking and may lead users or support technicians in directions far from the actual root cause. In this paper, we propose a state-based troubleshooting approach for configuration failures that aims at making the diagnostic process as mechanical as possible. In the narrow-down phase, we use checkpoint comparison and application tracing to determine which pieces of persistent state have changed and are affecting current application execution; ongoing self-monitoring of persistent-state changes by the machine is used to help eliminate false positives. In the solution-query phase, state-to-task mapping and searches of online databases are used to translate low-level state information into highlevel user interfaces and articles. We describe the design and implementation of a troubleshooter that uses this state-based approach and present preliminary results to demonstrate its effectiveness in diagnosing several actual configuration failures.
16817937
COMERA: COM Extensible Remoting Architecture
In a distributed object system, remoting architecture refers to the infrastructure that allows client programs to invoke methods on remote server objects in a transparent way. In this paper, we study the strength and limitations of current remoting architecture of COM (Component Object Model), and propose a new architecture called COMERA (COM Extensible Remoting Architecture) to enhance the extensibility and flexibility. We describe several application scenarios and implementations to demonstrate the power of such a componentized remoting architecture.
16068554
The SIMBA user alert service architecture for dependable alert delivery
Alerts refer to the delivery of user-subscribed information to the user. As the number of alert services and the types of information delivery devices increase, a new model that allows users to manage alert delivery and avoid alert overflow is needed. The unique dependability challenge in the management of alerts is in the proper use of redundancy to achieve timeliness and reliability without being unduly intrusive or cumbersome. We describe the design, implementation, and user experience of an alert service architecture, called SIMBA. SIMBA utilizes Instant Messaging with acknowledgements as the universal, reliable alert delivery channel, with emails being the fallback channel. All alerts that a user subscribes to are first directed to the user's MyAlertBuddy, which allows centralized delivery preference customization and acts as a personal alert router to protect the privacy of user addresses. Delivery modes, each of which involves multiple user addresses to accommodate communication failures, are supported as an abstraction for specifying personalized dependability levels. A working implementation of the SIMBA system, which integrates five different types of alert services, is described. Challenges and techniques in maintaining a highly available MyAlertBuddy to avoid single-point of failure are discussed. The concept of exception handling automation is introduced for enhancing the robustness of applications that drive third-party communication client software through automation interfaces.
9300546
Detecting stealth software with Strider GhostBuster
Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of the Internet. Resource hiding is a powerful stealth technique commonly used by malware to evade detection by computer users and anti-malware scanners. In this paper, we focus on a subclass of malware, termed "ghostware", which hide files, configuration settings, processes, and loaded modules from the operating system's query and enumeration application programming interfaces (APIs). Instead of targeting individual stealth implementations, we describe a systematic framework for detecting multiple types of hidden resources by leveraging the hiding behavior as a detection mechanism. Specifically, we adopt a cross-view diff-based approach to ghostware detection by comparing a high-level infected scan with a low-level clean scan and alternatively comparing an inside-the-box infected scan with an outside-the-box clean scan. We describe the design and implementation of the Strider GhostBuster tool and demonstrate its efficiency and effectiveness in detecting resources hidden by real-world malware such as rootkits, Trojans, and key-loggers.
28971506
Statistical identification of encrypted Web browsing traffic
Encryption is often proposed as a tool for protecting the privacy of World Wide Web browsing. However, encryption-particularly as typically implemented in, or in concert with popular Web browsers-does not hide all information about the encrypted plaintext. Specifically, HTTP object count and sizes are often revealed (or at least incompletely concealed). We investigate the identifiability of World Wide Web traffic based on this unconcealed information in a large sample of Web pages, and show that it suffices to identify a significant fraction of them quite reliably. We also suggest some possible countermeasures against the exposure of this kind of information and experimentally evaluate their effectiveness.
15335137
Automated Web Patrol with Strider HoneyMonkeys: Finding Web Sites That Exploit Browser Vulnerabilities
Internet attacks that use malicious web sites to install malware programs by exploiting browser vulnerabilities are a serious emerging threat. In response, we have developed an automated web patrol system to automatically identify and monitor these malicious sites. We describe the design and implementation of the Strider HoneyMonkey Exploit Detection System, which consists of a pipeline of “monkey programs” running possibly vulnerable browsers on virtual machines with different patch levels and patrolling the Web to seek out and classify web sites that exploit browser vulnerabilities. Within the first month of utilizing this system, we identified 752 unique URLs hosted on 288 web sites that could successfully exploit unpatched Windows XP machines. The system automatically constructed topology graphs based on traffic redirection to capture the relationship between the exploit sites. This allowed us to identify several major players who are responsible for a large number of exploit pages. By monitoring these 752 exploit-URLs on a daily basis, we discovered a malicious web site that was performing zero-day exploits of the unpatched javaprxy.dll vulnerability and was operating behind 25 exploit-URLs. It was confirmed as the first “inthe-wild”, zero-day exploit of this vulnerability that was reported to the Microsoft Security Response Center. Additionally, by scanning the most popular one million URLs as classified by a search engine, we found over seven hundred exploit-URLs, many of which serve popular content related to celebrities, song lyrics, wallpapers, video game cheats, and wrestling.
6612123
Automatic Misconfiguration Troubleshooting with PeerPressure
Technical support contributes 17% of the total cost of ownership of today's desktop PCs [25]. An important element of technical support is troubleshooting miscon-figured applications. Misconfiguration troubleshooting is particularly challenging, because configuration information is shared and altered by multiple applications. 
 
In this paper, we present a novel troubleshooting system: PeerPressure, which uses statistics from a set of sample machines to diagnose the root-cause misconfigurations on a sick machine. This is in contrast with methods that require manual identification on a healthy machine for diagnosing misconfigurations [30]. The elimination of this manual operation makes a significant step towards automated misconfiguration troubleshooting. 
 
In PeerPressure, we introduce a ranking metric for misconfiguration candidates. This metric is based on empirical Bayesian estimation. We have prototyped a PeerPressure troubleshooting system and used a database of 87 machine configuration snapshots to evaluate its performance. With 20 real-world troubleshooting cases, PeerPressure can effectively pinpoint the root-cause misconfigurations for 12 of these cases. For the remaining cases, PeerPressure significantly narrows down the number of root-cause candidates by three orders of magnitude.
695051
PeerPressure for automatic troubleshooting
Technical support contributes 17% of the total cost of ownershipof today’s desktop PCs [3]. An important element of technical sup-port is troubleshooting misconﬁgured applications. Misconﬁgura-tion troubleshooting is particularly challenging, because conﬁgura-tion information can be shared and altered by multiple applications.Maintaining healthy conﬁgurations of a computer platform with alarge installed base and numerous third-party software packageshas been recognized as a daunting task [1]. The considerable num-ber of possible conﬁgurations and the difﬁculty in specifying the“golden state” [4], the perfect conﬁguration, have made the prob-lem appear to be intractable.In this paper, we address the problem of misconﬁguration trou-bleshooting. There are two essential goals in designing such a trou-bleshooting system:1. Troubleshooting effectiveness: the system should effectivelyidentify a small set of sick conﬁguration candidates with ashort response time;2. Automation: the system should minimize the number of man-ual steps and the number of users involved.To diagnose misconﬁgurations of an application on a sick ma-chine, it is natural to ﬁnd a healthy machine to compare against [7].Then, the conﬁgurations that differ between the healthy and the sickare misconﬁguration suspects. However, it is difﬁcult to identify a
2653351
Fingerprint images encryption via multi-scroll chaotic attractors
This paper proposes a chaotic fingerprint images encryption approach. An image of a fingerprint is encrypted via a two-dimensional (2D) chaotic sequence obtained from multi-scroll chaotic attractors. Initial values of the chaotic attractors are served as the private key, which can be generated from the pixel distribution of the binary images of the captured fingerprints. Due to the dynamic uncertainties in the acquisition process of fingerprint images, the keys generated from the pixel value distribution are virtually random. With the elaborately designed 2D chaotic sequence, the encrypted fingerprint images have balanced 0-1 ratio and ideal nonlinearity. Only with the valid private key can the images of fingerprint be recovered. Simulation results and 2D-DFT validate this chaotic encryption approach.
2059756
Design of a Cognitive Complexities Measurement and Analysis Tool
The complexities of software systems are more prominent now than ever, due to progression of simple software applications to large integrated systems, either centralized or distributed. The challenges to software engineer somehow to understand and manage such large software systems and deal with software cognitive complexities. Although there are research areas such as human machine interface or human factor engineering, there is still little research on how to quantitatively measure and analyze human cognitive complexities in comprehending and understanding complex software systems. This paper studies human interaction with software programs in the cognitive perspective on software complexity. Based on the findings, a pilot software cognitive complexity measurement and analyses tool (CCMAT) is presented
205452349
A preemptive goal programming method for aggregating OWA operator weights in group decision making
This paper reveals that OWA operator weights cannot be aggregated by the weighted arithmetic or geometric average method in group decision making. A preemptive goal programming method (PGPM) is proposed for aggregating OWA operator weights, which is an extension of the minimax disparity approach developed earlier by the same authors. The effectiveness of PGPM is illustrated with a numerical example.