9110240
Shield: vulnerability-driven network filters for preventing known vulnerability exploits
Software patching has not been effective as a first-line defense against large-scale worm attacks, even when patches have long been available for their corresponding vulnerabilities. Generally, people have been reluctant to patch their systems immediately, because patches are perceived to be unreliable and disruptive to apply. To address this problem, we propose a first-line worm defense in the network stack, using shields -- vulnerability-specific, exploit-generic network filters installed in end systems once a vulnerability is discovered, but before a patch is applied. These filters examine the incoming or outgoing traffic of vulnerable applications, and correct traffic that exploits vulnerabilities. Shields are less disruptive to install and uninstall, easier to test for bad side effects, and hence more reliable than traditional software patches. Further, shields are resilient to polymorphic or metamorphic variations of exploits [43].In this paper, we show that this concept is feasible by describing a prototype Shield framework implementation that filters traffic above the transport layer. We have designed a safe and restrictive language to describe vulnerabilities as partial state machines of the vulnerable application. The expressiveness of the language has been verified by encoding the signatures of several known vulnerabilites. Our evaluation provides evidence of Shield's low false positive rate and small impact on application throughput. An examination of a sample set of known vulnerabilities suggests that Shield could be used to prevent exploitation of a substantial fraction of the most dangerous ones.
13895152
ShieldGen: Automatic Data Patch Generation for Unknown Vulnerabilities with Informed Probing
In this paper, we present ShieldGen, a system for automatically generating a data patch or a vulnerability signature for an unknown vulnerability, given a zero-day attack instance. The key novelty in our work is that we leverage knowledge of the data format to generate new potential attack instances, which we call probes, and use a zero-day detector as an oracle to determine if an instance can still exploit the vulnerability; the feedback of the oracle guides our search for the vulnerability signature. We have implemented a ShieldGen prototype and experimented with three known vulnerabilities. The generated signatures have no false positives and a low rate of false negatives due to imperfect data format specifications and the sampling technique used in our probe generation. Overall, they are significantly more precise than the signatures generated by existing schemes. We have also conducted a detailed study of 25 vulnerabilities for which Microsoft has issued security bulletins between 2003 and 2006. We estimate that ShieldGen can produce high quality signatures for a large portion of those vulnerabilities and that the signatures are superior to the signatures generated by existing schemes.
9905659
A signaling system using lightweight call sessions
Because of the emergence of heterogeneous access devices and diverse wired and wireless networks, and a substantial lack of support for integrating these networks, we are building a communication network and a service infrastructure that provides integrated telephony and data services across these networks. We generalize the basic call service to support communication between two or more call parties using any number of devices through any media. Call setup has already been addressed by protocols such as the session initiation protocol (SIP), so we focus on a missing component: scalable and fault-tolerant call session maintenance and control after call setup. In this paper, we present a new signaling protocol that offers scalability, high availability, robustness, and flexibility in creating new call processing services. The protocol is compatible with existing call setup protocols, but provides lightweight call session management using a completely decentralized, soft-state group control protocol. We show that this approach simplifies the implementation of the basic call service, including multi-device calling and service handoff between diverse access networks. The design of our protocol follows the principle of separation of control (signaling information) from data. The signaling protocol has been implemented in ICEBERG, an IP-based core network testbed with access to heterogeneous networks.
1513566
Passive network tomography using Bayesian inference
In this paper, we investigate the problem of identifying lossy links in the interior of the Internet by passively observing the end-to-end performance of existing traffic between a server and its clients. This is in contrast to the previous work on network tomography (e.g., [1]) that has been based on active probing. The key advantage of a passive approach is that it does not introduce wasteful traffic which might perturb the object of inference, i.e., the link loss rates. Moreover, our techniques depend only on knowing the number of lost and successful packets sent to each client rather than the exact loss sequence required by previous techniques such as [1]. While accuracy of link loss rate inference may consequently suffer, our techniques can still pinpoint the trouble spots in the network (e.g., highly lossy links). We have developed three techniques for passive network tomography: Random Sampling, Linear Optimization, and Bayesian Inference using Gibbs Sampling. We have evaluated these techniques using simulations and traces gathered at a busy Web server. In this paper, we focus on the Gibbs Sampling technique; more information on the three techniques appears in [3].
42916380
Policy-enabled handoffs across heterogeneous wireless networks
"Access is the killer app" is the vision of the Daedalus project at UC Berkeley. Being able to be connected seamlessly anytime anywhere to the best network still remains an unfulfilled goal. Often, even determining the "best" network is a challenging task because of the widespread deployment of overlapping wireless networks. We describe a policy-enabled handoff system that allows users to express policies on what is the "best" wireless system at any moment, and make tradeoffs among network characteristics and dynamics such as cost, performance and power consumption. We designed a performance reporting scheme estimating current network conditions, which serves as input to the policy specification. A primary goal of this work is to make it possible to balance the bandwidth load across networks with comparable performance. To avoid the problem of handoff instability, i.e., many mobile hosts making the same handoff decision at essentially the same time, we designed randomization into our mechanism. Given the current "best" network, our system determines whether the handoff is worthwhile based on the handoff overhead and potential network usage duration.
17331850
A Systematic Approach to Uncover Security Flaws in GUI Logic
To achieve end-to-end security, traditional machine-to-machine security measures are insufficient if the integrity of the human-computer interface is compromised. GUI logic flaws are a category of software vulnerabilities that result from logic bugs in GUI design/implementation. Visual spoofing attacks that exploit these flaws can lure even security- conscious users to perform unintended actions. The focus of this paper is to formulate the problem of GUI logic flaws and to develop a methodology for uncovering them in software implementations. Specifically, based on an in-depth study of key subsets of Internet Explorer (IE) browser source code, we have developed a formal model for the browser GUI logic and have applied formal reasoning to uncover new spoofing scenarios, including nine for status bar spoofing and four for address bar spoofing. The IE development team has confirmed all these scenarios and has fixed most of them in their latest build. Through this work, we demonstrate that a crucial subset of visual spoofing vulnerabilities originate from GUI logic flaws, which have a well-defined mathematical meaning allowing a systematic analysis.
19896198
Cross-Layer Design for Multimedia Delivery over Wireless Networks
Video summarization has gained increased popularity in the emerging multimedia and communications applications. However, very limited work has been conducted to address the transmission problem of video summary frames. In this paper, we propose a cross-layer optimization framework for delivering video summaries over wireless networks. Within a rate-distortion theoretical framework, the source coding, allowable retransmission, and adaptive modulation and coding have been jointly optimized, which reflects the joint selection of parameters in physical, data link and application layers. The goal here is to achieve the best video quality and content coverage from the received summary frames as well as meet the delay constraint. In this paper, this problem is formulated and solved by using Lagrangian relaxation and dynamic programming. Simulation results indicate the effectiveness and efficiency of the proposed optimization framework, especially when the delay budget imposed by the upper layer applications is small, where more than 12% distortion gain can be achieved
28149553
Fingerprint Indexing Based On Symmetrical Measurement
Due to the small number of classes and uneven distribution, the Henry's fingerprint classification approach is not able to provide an efficient way to narrow down the search when identifying a person in a large database. In this paper, three symmetrical filters are used to measure different orientation structures. We proposed a new fingerprint indexing approach based on these three symmetrical measurements. Experiments conducted on the NIST database 4 show the effectiveness of the proposed approach
15118493
Anomaly intrusion detection using multi-objective genetic fuzzy system and agent-based evolutionary computation framework
In this paper, we present a multi-objective genetic fuzzy system for anomaly intrusion detection. The proposed system extracts accurate and interpret able fuzzy rule-based knowledge from network data using an agent-based evolutionary computation framework. The experimental results on KDD-Cup99 intrusion detection benchmark data demonstrate that our system can achieve high detection rate for intrusion attacks and low false positive rate for normal network traffic.
1232229
Active Mining of Data Streams
Most previously proposed mining methods on data streams make an unrealistic assumption that “labelled” data stream is readily available and can be mined at anytime. However, in most real-world problems, labelled data streams are rarely immediately available. Due to this reason, models are refreshed periodically, that is usually synchronized with data availability schedule. There are several undesirable consequences of this “passive periodic refresh”. In this paper, we propose a new concept of demand-driven active data mining. It estimates the error of the model on the new data stream without knowing the true class labels. When significantly higher error is suspected, it investigates the true class labels of a selected number of examples in the most recent data stream to verify the suspected higher error. 1 State-of-the-art Stream Mining State-of-the-art work on mining data streams concentrates on capturing time-evolving trends and patterns with “labeled” data. However, one important aspect that is often ignored or unrealistically assumed is the availability of “class labels” of data streams. Most algorithms make an implicit and impractical assumption that labeled data is readily available. Most works focus on how to detect the change in patterns and how to update the model to reflect such changes when there are “labelled” instances to be learned. However, for many applications, the class labels are not “immediately” available unless dedicated efforts and substantial costs are spent to investigate these labels right away. If the true class labels were readily available, data mining models would not be very useful we might just wait. In credit card fraud detection, we usually do not know if a particular transaction is a fraud until at least one month later after the account holder receives and reviews the monthly statement. Due to these facts, most current applications obtain class labels and update existing models in preset frequency, usually synchronized with data refresh. The effectiveness of the passive mode is dictated by some “statuary and static constraints”, yet not by the “demand” for a better model with a lower loss. Such a passive mode to mine data streams results in a number of potential undesirable consequences that contradict the notions of “streaming” and “continuous”. First, it may incur possibly higher loss due to neglected pattern drifts. If either the concept or data distribution drifts rapidly at an un-forecasted rate that statuary constraints do not catch up, the models are likely to be out-of-date on the data stream and important business opportunities might be missed. Second, it may have unnecessary model refresh. If there is neither conceptual nor distributional change, periodic passive model refresh and re-validation is a waste of resources. 1.1 Demand-driven Active Mining of Data Streams We are proposing a demand-driven active stream data mining process that solves the problems of passive stream data mining. As a summary, our particular implementation of active stream data mining has three simple steps: 1. Detect potential changes of data streams “on the fly” when the existing model classifies continuous data streams. The detection process does not use or know any true labels of the stream. One of the change detection methods is a “guess” of the actual loss or error rate of the model on the new data stream. 2. If the guessed loss or error rate of the model in step 1 is much higher than an application-specific tolerable maximum, we choose a small number of data records in the new data stream to investigate their true class labels. With these true class labels, we statistically estimate the true loss of the model. 3. If the statistically estimated loss in step 2 is verified to be higher than the tolerable maximum, we reconstruct the old model by using the same true class labels sampled in the previous step. In this paper, we concentrate on the first two steps. Our particular implementation extends on classification trees.
1344510
COPE: traffic engineering in dynamic networks
Traffic engineering plays a critical role in determining the performance and reliability of a network. A major challenge in traffic engineering is how to cope with dynamic and unpredictable changes in traffic demand. In this paper, we propose COPE, a class of traffic engineering algorithms that optimize for the expected scenarios while providing a worst-case guarantee for unexpected scenarios. Using extensive evaluations based on real topologies and traffic traces, we show that COPE can achieve efficient resource utilization and avoid network congestion in a wide variety of scenarios.