An Architecture for an Adaptive Intrusion-Tolerant Server
We describe a general architecture for intrusion-tolerant enterprise systems and the implementation of an intrusion-tolerant Web server as a specific instance. The architecture comprises functionally redundant COTS servers running on diverse operating systems and platforms, hardened intrusion-tolerance proxies that mediate client requests and verify the behavior of servers and other proxies, and monitoring and alert management components based on the EMERALD intrusion-detection framework. Integrity and availability are maintained by dynamically adapting the system configuration in response to intrusions or other faults. The dynamic configuration specifies the servers assigned to each client request, the agreement protocol used to validate server replies, and the resources spent on monitoring and detection. Alerts trigger increasingly strict regimes to ensure continued service, with graceful degradation of performance, even if some servers or proxies are compromised or faulty. The system returns to less stringent regimes as threats diminish. Servers and proxies can be isolated, repaired, and reinserted without interrupting service.

title: Automatic analysis of firewall and network intrusion detection system configurations
abstract: Given a network that deploys multiple firewalls and network intrusion detection systems (NIDSs), ensuring that these security components are correctly configured is a challenging problem. Although models have been developed to reason independently about the effectiveness of firewalls and NIDSs, there is no common framework to analyze their interaction. This paper presents an integrated, constraint-based approach for modeling and reasoning about these configurations. Our approach considers the dependencies among the two types of components, and can reason automatically about their combined behavior. We have developed a tool for the specification and verification of networks that include multiple firewalls and NIDSs, based on this approach. This tool can also be used to automatically generate NIDS configurations that are optimal relative to a given cost function.

title: Time Lower Bounds for Permutation Routing on Multi-Dimensional Bused Meshes
abstract: We present time lower bounds for the permutation routing problem on three- and higher-dimensional n x…x n meshes with buses. We prove an (r–1)n/r lower bound for the general case of an r-dimensional bused mesh, r≥2, which is not as strong for low-dimensional as for higher-dimensional cases. We then use a different approach to construct a 0.705n lower bound for the three-dimensional case.

title: Modeling multistep cyber attacks for scenario recognition
abstract: Efforts toward automated detection and identification of multistep cyber attack scenarios would benefit significantly from a methodology and language for modeling such scenarios. The Correlated Attack Modeling Language (CAML) uses a modular approach, where a module represents an inference step and modules can be linked together to detect multistep scenarios. CAML is accompanied by a library of predicates, which functions as a vocabulary to describe the properties of system states and events. The concept of attack patterns is introduced to facilitate reuse of generic modules in the attack modeling process. CAML is used in a prototype implementation of a scenario recognition engine that consumes first-level security alerts in real time and produces reports that identify multistep attack scenarios discovered in the alert stream.

title: Denial of service against the Domain Name System
abstract: Because many network services rely on the Domain Name System, denial-of-service attacks against it can be particularly damaging. This article analyzes such threats and reviews existing and proposed countermeasures for addressing them.

title: Routing with Locality on Meshes with Buses
abstract: Routing with locality is studied for meshes with buses. In this problem, packets' distances are bounded by a value,d, which is less than the diameter of the network. This problem arises naturally when specific known algorithms are implemented on meshes. Solving this problem in ordinary meshes requires at least a routing time ofdsteps. To do better than this, we propose adding a kind of short bus to ordinary meshes. By using a technique which we call iterative walk-and-ride, we show how the routing time can be reduced by approximately one-third for solving the problem (including the multipacket version) on one- and two-dimensional short-bus meshes. The bounds we develop are tight.

title: Alert-driven e-service management
abstract: Process management technology has recently been employed not only within businesses but also in provision of e-services over the Internet. Urgent requests and critical messages in these systems (referred to as alerts) should be delivered and handled timely. In particular, humans are often involved in critical conditions. Presently, most e-service systems cannot address these requirements, and alerts are often handled in an ad-hoc manner. In this paper, we propose a sophisticated alert management system for effective e-service integration under urgent constraints. We develop a model for specifying alerts, in which alerts are associated with service requests and a set of parameters are captured for their routing. The alert monitor matches the service provider to receive an alert, based on the alert specification. We then propose a routing mechanism that is initiated when the alert message is not acknowledged or serviced within the deadline, so that the alert can be forwarded to other suitable services if necessary. Monitoring is especially essential to ensure timeliness and availability of services, otherwise suitable exceptions should be raised and handled. We outline our implementation framework of an alert management system (AMS) which includes Web services for B2B interactions, together with multiple-platform support for human users. We demonstrate our approach with an example medical house-call AMS.

title: Checking safety properties using compositional reachability analysis
abstract: The software architecture of a distributed program can be represented by a hierarchical composition of subsystems, with interacting processes at the leaves of the hierarchy. Compositional reachability analysis (CRA) is a promising state reduction technique which can be automated and used in stages to derive the overall behavior of a distributed program based on its architecture. CRA is particularly suitable for the analysis of programs that are subject to evolutionary change. When a program evolves, only the behaviors of those subsystems affected by the change need be reevaluated. The technique however has a limitation. The properties available for analysis are constrained by the set of actions that remain globally observable. Properties involving actions encapsulated by subsystems may therefore not be analyzed. In this article, we enhance the CRA technique to check safety properties which may contain actions that are not globally observable. To achieve this, the state machine model is augmented with a special trap state labeled as π. We propose a scheme to transform, in stages, a property that involves hidden actions to one that involves only globally observable actions. The enhanced technique also includes a mechanism aiming at reducing the debugging effort. The technique is illustrated using a gas station system example.

title: A Framework for Distributed Object-Oriented Testing
abstract: Distributed programming and object-oriented programming are two popular programming paradigms. The former is driven by advances in networking technology whereas the latter provides vigorous software principles needed in developing complex software systems. While more and more distributed object-oriented software has appeared, not much work exists on the testing of these systems in an integrated manner. Instead, the distributed and object features have been tested separately. In this paper, we propose an integrated framework known as DOOT for incremental testing of distributed object-oriented software systems. It combines various testing techniques to provide comprehensive test coverage at four levels — class testing, intra-cluster testing, inter-cluster testing and system testing. Each level uses a specific fault model, test strategy and test case generation that build on the previous test level to reduce the overall test effort. They are designed to handle the distinct requirements of the two paradigms at each level. Moreover, a reduction algorithm for testing the inherited class is also included in the framework. The approach is illustrated using a real life example of a conferencing system.

title: Developing a Distributed e-Monitoring System for Enterprise Website and Web Services: An Experience Report with Free Libraries and Tools
abstract: Enterprises value monitoring as it provides dependable e-services, whether it is an interactive Web site or programmatic Web service. However, this task becomes non-trivial when enterprises begin to require support from thousands of servers across geographical areas. How can the communications between a monitoring systems and remote servers be minimized? Could the task be achieved easily based on a readily available technology such as SNMP? How can we monitor thousands of servers powered by, say, Tomcat, which lacks SNMP support? How may a poorly responsive site be identified prior to being reported as a failure by SNMP? In this paper, we propose a unified e-monitoring system that enables system administrators to remotely monitor the health of distributed e-services in both the form of Web site and Web services. We further discuss our implementation experience based on a pragmatic prototype.

title: Efficient video similarity measurement and search
abstract: We consider the use of meta-data and/or video-domain methods to detect similar videos on the Web. Meta-data is extracted from the textual and hyperlink information associated with each video clip. In the video domain, we apply an efficient similarity detection algorithm called video signature. The idea is to form a signature for each clip by selecting a small number of its frames that are most similar to a set of random seed images. We then apply a statistical pruning algorithm to allow fast detection on very large databases. Using a small ground-truth set, we achieve 90% recall and 95% precision using only 8% of the total number of operations required without pruning. For a database of around 46,000 video clips crawled from the Web, the video signature technique significantly outperforms meta-data in precision and recall. We show that even better performance can be achieved by combining them together. Based on our measurements, each video clip in our database has, on average, 1.53 similar copies.