Side-Channel Leaks in Web Applications: A Reality Today, a Challenge Tomorrow
With software-as-a-service becoming mainstream, more and more applications are delivered to the client through the Web. Unlike a desktop application, a web application is split into browser-side and server-side components. A subset of the application’s internal information flows are inevitably exposed on the network. We show that despite encryption, such a side-channel information leak is a realistic and serious threat to user privacy. Specifically, we found that surprisingly detailed sensitive information is being leaked out from a number of high-profile, top-of-the-line web applications in healthcare, taxation, investment and web search: an eavesdropper can infer the illnesses/medications/surgeries of the user, her family income and investment secrets, despite HTTPS protection; a stranger on the street can glean enterprise employees' web search queries, despite WPA/WPA2 Wi-Fi encryption. More importantly, the root causes of the problem are some fundamental characteristics of web applications: stateful communication, low entropy input for better interaction, and significant traffic distinctions. As a result, the scope of the problem seems industry-wide. We further present a concrete analysis to demonstrate the challenges of mitigating such a threat, which points to the necessity of a disciplined engineering practice for side-channel mitigations in future web application developments.

title: Panalyst: Privacy-Aware Remote Error Analysis on Commodity Software
abstract: Remote error analysis aims at timely detection and remedy of software vulnerabilities through analyzing run-time errors that occur on the client. This objective can only be achieved by offering users effective protection of their private information and minimizing the performance impact of the analysis on their systems without undermining the amount of information the server can access for understanding errors. To this end, we propose in the paper a new technique for privacy-aware remote analysis, called Panalyst. Panalyst includes a client component and a server component. Once a runtime exception happens to an application, Panalyst client sends the server an initial error report that includes only public information regarding the error, such as the length of the packet that triggers the exception. Using an input built from the report, Panalyst server performs a taint analysis and symbolic execution on the application, and adjusts the input by querying the client about the information upon which the execution of the application depends. The client agrees to answer only when the reply does not give away too much user information. In this way, an input that reproduces the error can be gradually built on the server under the client's consent. Our experimental study of this technique demonstrates that it exposes a very small amount of user information, introduces negligible overheads to the client and enables the server to effectively analyze an error.

title: Solving P2P Traffic Identification Problems Via Optimized Support Vector Machines
abstract: Since the emergence of peer-to-peer (P2P) networking in the last 90s, P2P traffic has become one of the most significant portions of the network traffic. Accurate identification of P2P traffic makes great sense for efficient network management and reasonable utility of network resources. Application level classification of P2P traffic, especially without payload feature detection, is still a challenging problem. This paper proposes a new method for P2P traffic identification and application level classification, which merely uses transport layer information. The method uses support vector machines which have been optimized for performing large learning tasks, rendering that this method become more suitable for large network traffic. The experimental results show that this method achieved high efficiency and is suitable for real-time identification. And carefully tuning the parameters could make the method achieve high accuracy.

title: A Cognitive Study on the Effectiveness of an Augmented Virtuality-Based Collaborative Design Space
abstract: This paper presents one empirical study on an Augmented Virtuality (AV)-based virtual environment dedicated for remote collaboration. This AV-based system enables a remote designer to explore a virtual counterpart of a remote built environment that needs to be re-designed. Results of the study demonstrate that the AV system is effective and achieves good overall satisfaction, but involves some issues. Results also reveals that the participants all gain a similar sense in the AV environment as experienced in the real space.

title: Real-time KD-tree construction on graphics hardware
abstract: We present an algorithm for constructing kd-trees on GPUs. This algorithm achieves real-time performance by exploiting the GPU's streaming architecture at all stages of kd-tree construction. Unlike previous parallel kd-tree algorithms, our method builds tree nodes completely in BFS (breadth-first search) order. We also develop a special strategy for large nodes at upper tree levels so as to further exploit the fine-grained parallelism of GPUs. For these nodes, we parallelize the computation over all geometric primitives instead of nodes at each level. Finally, in order to maintain kd-tree quality, we introduce novel schemes for fast evaluation of node split costs.
 As far as we know, ours is the first real-time kd-tree algorithm on the GPU. The kd-trees built by our algorithm are of comparable quality as those constructed by off-line CPU algorithms. In terms of speed, our algorithm is significantly faster than well-optimized single-core CPU algorithms and competitive with multi-core CPU algorithms. Our algorithm provides a general way for handling dynamic scenes on the GPU. We demonstrate the potential of our algorithm in applications involving dynamic scenes, including GPU ray tracing, interactive photon mapping, and point cloud modeling.

title: Web mapping service on second life compatible virtual world system
abstract: Online virtual world such as second life becomes more and more popular nowadays. And way-finding in large-scale virtual worlds becomes important problem for both novices and experts. Similar to the physical world, a well-designed mapping system would play an important role in way-finding process. However, Second Life only supports thumbnail map system right now. The thumbnail map system could only provide an overview of the area and with no query support. There are several challenges to develop a better virtual mapping system. First, identify the virtual world geo-features and to develop proper criteria and algorithms to generate features from primitive which is the basic unit in virtual world. Second, provide web service for data access through the Internet from systems with different architectures. In this paper, we implemented a prototype map service system called VWMS conformed to OWS specification from OpenGIS consortium. The prototype includes an AJAX style map site and a feature generalization server-module extracting geo-feature from Open Simulator primitive database. Besides, the system also provides a Web Map Service interface for

title: Information Synthesis for Answer Validation
abstract: This paper proposes an integration of Recognizing Textual Entailment (RTE) with other additional information to deal with the Answer Validation task. The additional information used in our participation in the Answer Validation Exercise (AVE 2008) is from named-entity (NE) recognizer, question analysis component, etc. We have submitted two runs, one run for English and the other for German, achieving f-measures of 0.64 and 0.61 respectively. Compared with our system last year, which purely depends on the output of the RTE system, the extra information does show its effectiveness.

title: Online B-tree merging
abstract: Many scenarios involve merging of two B-tree indexes, both covering the same key range. Increasing demand for continuous availability and high performance requires that such merging be done online, with minimal interference to normal user transactions. In this paper we present an online B-tree merging method, in which the merging of leaf pages in two B-trees are piggybacked lazily with normal user transactions, thus making the merging I/O efficient and allowing user transactions to access only one index instead of both. The concurrency control mechanism is designed to interfere as little as possible with ongoing user transactions. Merging is made forward recoverable by following a conventional logging protocol, with a few extensions. Should a system failure occur, both indexes being merged can be recovered to a consistent state and no merging work is lost. Experiments and analysis show the I/O savings and the performance, and compare variations on the basic algorithm.