Denial of service against the Domain Name System
Because many network services rely on the Domain Name System, denial-of-service attacks against it can be particularly damaging. This article analyzes such threats and reviews existing and proposed countermeasures for addressing them.

title: Dependable Intrusion Tolerance: technology demo
abstract: The Dependable Intrusion Tolerance (DIT) architecture is a flexible, adaptive, and intrusion-tolerant server design. We briefly discuss its prototype implementation and validation, and demonstrate how it resists sample attacks.

title: Routing with Locality on Meshes with Buses
abstract: Routing with locality is studied for meshes with buses. In this problem, packets' distances are bounded by a value,d, which is less than the diameter of the network. This problem arises naturally when specific known algorithms are implemented on meshes. Solving this problem in ordinary meshes requires at least a routing time ofdsteps. To do better than this, we propose adding a kind of short bus to ordinary meshes. By using a technique which we call iterative walk-and-ride, we show how the routing time can be reduced by approximately one-third for solving the problem (including the multipacket version) on one- and two-dimensional short-bus meshes. The bounds we develop are tight.

title: Automatic analysis of firewall and network intrusion detection system configurations
abstract: Given a network that deploys multiple firewalls and network intrusion detection systems (NIDSs), ensuring that these security components are correctly configured is a challenging problem. Although models have been developed to reason independently about the effectiveness of firewalls and NIDSs, there is no common framework to analyze their interaction. This paper presents an integrated, constraint-based approach for modeling and reasoning about these configurations. Our approach considers the dependencies among the two types of components, and can reason automatically about their combined behavior. We have developed a tool for the specification and verification of networks that include multiple firewalls and NIDSs, based on this approach. This tool can also be used to automatically generate NIDS configurations that are optimal relative to a given cost function.

title: A formal-specification based approach for protecting the domain name system
abstract: Many network applications depend on the security of the domain name system (DNS). Attacks on the DNS can cause denial of service and entity authentication to fail. In our approach, we use formal specifications to characterize DNS clients and DNS name servers, and to define a security goal. A name server should only use DNS data that is consistent with data from name servers that manage the corresponding domains (i.e. authoritative name servers). To enforce the security goal, we formally specify a DNS wrapper that examines the incoming and outgoing DNS messages of a name server to detect messages that could cause violations of the security goal, cooperates with the corresponding authoritative name servers to diagnose those messages, and drops the messages that are identified as threats. Based on the wrapper specification, we implemented a wrapper prototype and evaluated its performance. Out experiments show that the wrapper incurs reasonable overhead and is effective against DNS attacks such as cache poisoning and certain spoofing attacks.

title: Modeling multistep cyber attacks for scenario recognition
abstract: Efforts toward automated detection and identification of multistep cyber attack scenarios would benefit significantly from a methodology and language for modeling such scenarios. The Correlated Attack Modeling Language (CAML) uses a modular approach, where a module represents an inference step and modules can be linked together to detect multistep scenarios. CAML is accompanied by a library of predicates, which functions as a vocabulary to describe the properties of system states and events. The concept of attack patterns is introduced to facilitate reuse of generic modules in the attack modeling process. CAML is used in a prototype implementation of a scenario recognition engine that consumes first-level security alerts in real time and produces reports that identify multistep attack scenarios discovered in the alert stream.

title: Facilitating e-Negotiation Processes with Semantic Web Technologies
abstract: Semantic Web technologies have recently been maturing to make e-commerce interactions and cross-organizational processes more flexible and automated. Ontology has also been developed in various business domains. However, researches in Semantic Web have largely focused on the facilitation of successful matchmaking but not much on the negotiation upon matchmaking failures and exceptions. In this paper, we propose a novel application of Semantic Web technologies for the facilitation of e-Negotiation processes. We discuss how the elicitation of negotiation issues, alternatives, and tradeoff can be streamlined. We further propose a novel methodology for the elicitation of dependencies among negotiation issues so that negotiators can focus on tradeoff among inter-related issues, instead of arguing about single issues. A negotiation plan can thus be derived to observe negotiation orders across different issues. As a result, negotiators can have a better cognition of their negotiation tasks and the overall e-Negotiation process can be streamlined. We are extending a negotiation support system to demonstrate the feasibility of our approach, which is the most useful to repeatable and semi-structured negotiations in business-to-business (B2B) e-Commerce and e-Marketplace envi-ronments.

title: A Multi-Agent Infrastructure for Mobile Workforce Management in a Service Oriented Enterprise
abstract: With recent advances in mobile technologies and infrastructures, there are increasing demands for the support of mobile workforce management (MWM) across multiple platforms. Mobile users can interact with the MWM system through SMS messages or Web browsers from personal computers, PDA devices, or WAP phones. MWM typically involves tight collaboration, negotiation, and sophisticated business domain knowledge. Therefore, the main challenge of MWM for a service oriented enterprise is the integration of disparate business function for its mobile professional workforce and the management with a unified infrastructure, together with the provision of personalized assistance and automation. These requirements can be facilitated with the use of intelligent software agents, but has not been adequately studied before. As mobile devices become more powerful, intelligent software agents can now be deployed on these devices and hence also subject to mobility. Thus, MWM systems have to accommodate these requirements as well as the support of heterogeneous platforms. In this paper, we formulate a scalable, flexible, and intelligent multi-agent information system (MAIS) infrastructure for MWM with agent clusters in the context of a large service oriented enterprise. Each agent cluster comprise several types of agents to achieve the goal of each phase of the workforce management process, namely, task formulation, matchmaking, brokering, commuting, and service. We evaluate our approach against different stakeholders' perspective.

title: Developing e-Negotiation Process Support by Web Services

title: A metamodel based model transformation approach
abstract: The information transformation problem of model driven software development (MDSD) processes is gaining increasing attentions. In this paper, we present an indepth analysis of the major causes leading to the ambiguities of existing transformation. A metamodel based approach is then proposed to address these causes. A mechanism to generate transformation rules is devised based on a classification of the UML metamodel elements to be used in subsequent transformation processes. Some other critical issues relating to the generated transformation system are also discussed.

title: Efficient video similarity measurement with video signature
abstract: The proliferation of video content on the Web makes similarity detection an indispensable tool in Web data management, searching, and navigation. We propose a number of algorithms to efficiently measure video similarity. We define video as a set of frames, which are represented as high dimensional vectors in a feature space. Our goal is to measure ideal video similarity (IVS), defined as the percentage of clusters of similar frames shared between two video sequences. Since IVS is too complex to be deployed in large database applications, we approximate it with Voronoi video similarity (VVS), defined as the volume of the intersection between Voronoi cells of similar clusters. We propose a class of randomized algorithms to estimate VVS by first summarizing each video with a small set of its sampled frames, called the video signature (ViSig), and then calculating the distances between corresponding frames from the two ViSigs. By generating samples with a probability distribution that describes the video statistics, and ranking them based upon their likelihood of making an error in the estimation, we show analytically that ViSig can provide an unbiased estimate of IVS. Experimental results on a large dataset of Web video and a set of MPEG-7 test sequences with artificially generated similar versions are provided to demonstrate the retrieval performance of our proposed techniques.