Model Generalization and Its Implications on Intrusion Detection
To make up for the incompleteness of the known behaviors of a computing resource, model generalization is utilized to infer more behaviors in the behavior model besides the known behaviors. In principle, model generalization can improve the detection rate but may also degrade the detection performance. Therefore, the relation between model generalization and detection performance is critical for intrusion detection. However, most of past research only evaluates the overall efficiency of an intrusion detection technique via detection rate and false alarm/positive rate, rather than the usefulness of model generalization for intrusion detection. In this paper, we try to do such evaluation, and then to find the implications of model generalization on intrusion detection. Within our proposed methodology, model generalization can be achieved in three levels. In this paper, we evaluate the first level model generalization. The experimental results show that the first level model generalization is useful mostly to enhance the detection performance of intrusion detection. However, its implications for intrusion detection are different with respect to different detection techniques. Our studies show that in general, though it is useful to generalize the normal behavior model so that more normal behaviors can be identified as such, the same is not advisable for the intrusive behavior model. Therefore, the intrusion signatures should be built compactly without first level generalization.

title: Efficient Signature Validation Based on a New PKI
abstract: Digital signatures usually serve as irrefutable cryptographic evidence to support dispute resolution in electronic transactions. Trusted time-stamping and certificate revocation services, although very costly in practice, must be available to prevent big loss due to compromising of the signing key. In this paper, we employ a revocation-free public-key framework to improve the efficiency in maintaining the validity of digital signatures as non-repudiation evidence. The new PKI allows an end user to control the validity of his own public-key certificate and enables certificate verification without retrieving the revocation information from the CA. Based on this new PKI, we could validate generic digital signatures using a TSA only. Moreover, we could validate forward-secure digital signatures without the TTP’s involvement.

title: An intensive survey of fair non-repudiation protocols
abstract: With the phenomenal growth of the Internet and open networks in general, security services, such as non-repudiation, become crucial to many applications. Non-repudiation services must ensure that when Alice sends some information to Bob over a network, neither Alice nor Bob can deny having participated in a part or the whole of this communication. Therefore a fair non-repudiation protocol has to generate non-repudiation of origin evidences intended to Bob, and non-repudiation of receipt evidences destined to Alice. In this paper, we clearly define the properties a fair non-repudiation protocol must respect, and give a survey of the most important non-repudiation protocols without and with trusted third party (TTP). For the later ones we discuss the evolution of the TTP's involvement and, between others, describe the most recent protocol using a transparent TTP. We also discuss some ad-hoc problems related to the management of non-repudiation evidences.

title: Non-Repudiation in Electronic Commerce
abstract: Electronic Commerce and Security. Repudiation and Dispute Resolution. Non-Repudiation and Network Security. Non-Repudiation in Message Handling Systems. Non-Repudiation in Electronic Payment Systems. Book Outline. Fundamentals of Non-Repudiation - Goals of Non-Repudiation. Non-Repudiation Services. Non-Repudiation Evidence. Roles of Trusted Third Parties. Phases of Non-Repudiation. Non-Repudiation Policy. Requirements for Non-Repudiation. Securing Digital Signatures for Non-Repudiation - Security Requirements on Digital Signatures. Time Stamps in Digital Signatures. Securing TTP's Digital Signatures. Time-Stamping Approach.  One-Way Sequential Link Approach.   Achieving Fair Non-Repudiation - Factors against Fair Non-Repudiation. Approaches for Fair Non-Repudiation.  Using Light-Weighted On-Line TTP.  Using Off-Line TTP without Timely Termination.  Using Off-Line TTP with Timely Termination.  Using In-Line TTP for Timely Delivery.  Related Work on Fair Non-Repudiation - Protocols Using In-Line TTP. Protocols Using On-Line TTP. Protocols Using Off-Line TTP. Protocols with Probablistic Fairness.  ISO's Non-Repudiation Mechanisms - Overview of ISO/IEC 13888. Mechanisms Using Symmetric Techniques. Mechanisms Using Asymmetric Techniques. Time-Stamping Evidence.  Case Studies - Non-Repudiation in Electronic Payment. Undeniable Billing in Mobile Communication.  Towards Formal Verification of Non-Repudiation - The SVO Logic. Formalization of Non-Repudiation. Verification of a Non-Repudiation Protocol.

title: Securing digital signatures for non-repudiation
abstract: Dispute of transactions is a common problem that could jeopardise business. Hence non-repudiation services are essential in business transactions which provide evidence to enable dispute resolution. To be eligible as non-repudiation evidence, the digital signature on an electronic document should remain valid until its expiry date which is specified by some non-repudiation policy. The conventional approaches are either inefficient or insecure to achieve non-repudiation in electronic commerce. This article presents a practical scheme to secure digital signatures as non-repudiation evidence with an adjustable degree of risk.

title: Observations on Non-repudiation
abstract: This paper discusses non-repudiation services regarding the transfer of a message and classifies the roles of trusted third parties involved in non-repudiation services. We examine the selective receipt problem and the generation of time evidence, analyse the current state of the ISO/IEC 13888 drafts on non-repudiation mechanisms, and present a fair non-repudiation protocol including time evidence to promote the development of these drafts.

title: Improving Database Performance on Simultaneous Multithreading Processors
abstract: Simultaneous multithreading (SMT) allows multiple threads to supply instructions to the instruction pipeline of a superscalar processor. Because threads share processor resources, an SMT system is inherently different from a multiprocessor system and, therefore, utilizing multiple threads on an SMT processor creates new challenges for database implementers.We investigate three thread-based techniques to exploit SMT architectures on memory-resident data. First, we consider running independent operations in separate threads, a technique applied to conventional multi-processor systems. Second, we describe a novel implementation strategy in which individual operators are implemented in a multi-threaded fashion. Finally, we introduce a new data-structure called a work-ahead set that allows us to use one of the threads to aggressively preload data into the cache.We evaluate each method with respect to its performance, implementation complexity, and other measures. We also provide guidance regarding when and how to best utilize the various threading techniques. Our experimental results show that by taking advantage of SMT technology we achieve a 30% to 70% improvement in throughput over single threaded implementations on in-memory database operations.

title: Automatic detection of premature ventricular contraction using quantum neural networks
abstract: Premature ventricular contractions (PVCs) are ectopic heart beats originating from ventricular area. It is a common form of heart arrhythmia. Electrocardiogram (ECG) recordings have been widely used to assist cardiologists to diagnose the problem. In this paper, we study the automatic detection of PVC using a fuzzy artificial neural network named Quantum Neural Network (QNN). With the quantum neurons in the network, trained QNN can model the levels of uncertainty arising from complex classification problems. This fuzzy feature is expected to enhance the reliability of the algorithm, which is critical for the applications in the biomedical domain. Experiments were conducted on ECG records in the MIT-BIH Arrhythmia Database. Results showed consistently higher or same reliability of QNN on all the available records compared to the backpropagation network. QNN, however, has a relatively higher resource requirement for training.

title: An Overlay Subscription Network for Live Internet TV Broadcast
abstract: We propose a framework, called overlay subscription network (OSN), for live Internet TV broadcast, where a subscriber can choose to watch at any time. This framework allows the source server to incrementally build a topology graph that contains the network connections not only from the server to each subscriber, but also among the subscribers themselves. With such a topology graph in place, we consider efficient overlay multicast for scalable OSN services. We first show that idling nodes, which do not receive video data for their own playback, can actually be used for data forwarding to significantly reduce the cost of overlay multicast. In light of this observation, we then propose a novel overlay multicast technique that distinguishes itself from existing schemes with these three aspects. First, the proposed technique is centered on the topology graph and can take advantage of the actual network connections among the subscribing nodes. Second, the new scheme is able to find and incorporate appropriate idling nodes in multicast to reduce network traffic. Third, with our approach, a node can be used in multiple multicast trees for data forwarding to improve the overall system performance. We evaluate the performance of the proposed technique through simulation. Our extensive studies show that the proposed framework has the potential to enable the Internet, a vehicle up to date mainly for transferring text and image data, for large-scale and cost-effective TV broadcast

title: Buffering databse operations for enhanced instruction cache performance
abstract: As more and more query processing work can be done in main memory access is becoming a significant cost component of database operations. Recent database research has shown that most of the memory stalls are due to second-level cache data misses and first-level instruction cache misses. While a lot of research has focused on reducing the data cache misses, relatively little research has been done on improving the instruction cache performance of database systems.We first answer the question "Why does a database system incur so many instruction cache misses?" We demonstrate that current demand-pull pipelined query execution engines suffer from significant instruction cache thrashing between different operators. We propose techniques to buffer database operations during query execution to avoid instruction cache thrashing. We implement a new light-weight "buffer" operator and study various factors which may affect the cache performance. We also introduce a plan refinement algorithm that considers the query plan and decides whether it is beneficial to add additional "buffer" operators and where to put them. The benefit is mainly from better instruction locality and better hardware branch prediction. Our techniques can be easily integrated into current database systems without significant changes. Our experiments in a memory-resident PostgreSQL database system show that buffering techniques can reduce the number of instruction cache misses by up to 80% and improve query performance by up to 15%.

title: An alternative time management mechanism for distributed simulations
abstract: Over the past few years, there has been a keen interest in the management of time in distributed simulation environments. Previous emphasis in time management (TM) services has been based on time stamp ordering, which is both computation and bandwidth intensive. This article discusses an alternative approach to time management based on causal ordering. Traditional causal ordering protocols incur a large amount of communication overhead, which is generally of the order of N2 for a distributed system of N processes. A new causal ordering protocol proposed by the authors, the Modified Schiper-Eggli-Sandoz (MSES) protocol, is presented in this article. This new protocol minimizes the control information overhead of causal ordering by using the direct dependency tracking technique. The MSES protocol works well in both unicast and multicast environments, without relying on information about the underlying network topology and communication pattern among the processes of the distributed system. The MSES protocol has been successfully implemented as a middleware on top of DMSO RTI. Experiments have been conducted to benchmark the performance of the new time management mechanism with respect to the existing TM mechanisms available in DMSO RTI. The simulation scenarios of the experiments vary with different degrees of inter-federate dependency and federate event granularities. The ordering limitations of the causality based TM mechanism are addressed in this article and the trade-off of the degree of event ordering and execution speed of simulations is discussed.