Developing a Distributed e-Monitoring System for Enterprise Website and Web Services: An Experience Report with Free Libraries and Tools
Enterprises value monitoring as it provides dependable e-services, whether it is an interactive Web site or programmatic Web service. However, this task becomes non-trivial when enterprises begin to require support from thousands of servers across geographical areas. How can the communications between a monitoring systems and remote servers be minimized? Could the task be achieved easily based on a readily available technology such as SNMP? How can we monitor thousands of servers powered by, say, Tomcat, which lacks SNMP support? How may a poorly responsive site be identified prior to being reported as a failure by SNMP? In this paper, we propose a unified e-monitoring system that enables system administrators to remotely monitor the health of distributed e-services in both the form of Web site and Web services. We further discuss our implementation experience based on a pragmatic prototype.

title: Contextual local analysis in the design of distributed systems
abstract: Compositional Reachability Analysis is a popular technique for studying behaviour of finite-state distributed systems. The technique is applied by a repetition oflocal analyses, the basic steps of which are to construct and examine the behaviour of subsystems. In most cases, behaviour of the subsystem is constrained by its environment (calledcontext) formed by neighbouring components. These behaviour constraints are normally not considered when using local analysis in conventional techniques of compositional reachability analysis. As a result, many execution paths derived in the local analysis may not be actually traversed by the subsystem. These paths are made impossible to traverse by the constraints. The paths are unnecessary for understanding the subsystem behaviour and their removal greatly simplifies the local analysis. In this paper, we describe an elegant technique, calledcontextual local analysis, to include these behaviour constraints in conventional local analysis. The technique can alleviate dramatically the state explosion problem encountered in local analysis. It also facilitates early detection of anomalous behaviour of a distributed system at its design stage. The technique works by composing an interface process with the subsystem being examined. That interface process is so chosen that it captures behaviour constraints enforced by the environment while its composition with the subsystem does not affect the global system behaviour. This interface process can be automatically derived using a simple algorithm. The contextual local analysis technique results in a simplified labelled transition system which can be used as a substitute for the original subsystem in the construction of the global system behaviour. The contextual local analysis technique is illustrated with a clients/server example implementing a round-robin protocol.

title: Constraint-based negotiation in a multi-agent information system with multiple platform support
abstract: Agent technologies have been deployed to model and implement e-commerce activities as multi-agent information systems (MAIS). Agents provide services to one another for mutual gain on behalf of their users. This paper presents an MAIS infrastructure based on belief-desire-in tension (BDI) agent architecture, constraint technology, and contemporary Web services to facilitate negotiation support. Further, the MAIS infrastructure also supports customizable degree of agent delegation for users on different platforms, with or without agent support. We present a constraint-based negotiation protocol extended for a MAIS environment and detail the required adaptations on different platforms from a three-tier implementation architecture aspect.

title: A three-layer architecture for e-contract enforcement in an e-service environment
abstract: In an e-service environment, contracts are important for attaining business process interoperability and enforcing their proper enactment.  In the document layer, contracts are composed of different types of clauses. In the business layer, e-contract enforcement activities are defined through the realization of contract clauses as business rules in event-condition-action (ECA) form. In the implementation layer, cross-organizational e-contract enforcement interfaces are implemented with contemporary Enterprise Java Bean and Web services. We present a methodology for the engineering of e-contracts enforcement from a high-level document-view down to the implementation layer based on this architecture, using a supply-chain example. As a result, e-contracts can be seamlessly defined and enforced. Conceptual models of various layers are given in the Unified Modeling Language (UML).

title: Enhancing compositional reachability analysis with context constraints
abstract: Compositional techniques have been proposed for traditional reachability analysis in order to introduce modularity and to control the state explosion problem. While modularity has been achived, state explosion is still a problem. Indeed, this problem may even be exacerbated as a locally minimised subsystem may contain many states and transitions forbidden by its context or environments. This paper presents a method to alleviate this problem effectively by including context constraints in local subsystem minimisation. The global behaviour generated using the method is observationally equivalent to that generated by compositional reachability analysis without the inclusion of context constraints.Context constraints, specified as interface processes, are restrictions imposed by the environment on subsystem behaviour. The minimisation produces a simplified machine that describes the behaviour of the subsystem constrained by its context. This machine can also be used as a substitute for the original subsystem in the subsequent steps of the compositional reachability analysis. Interface processes capturing context constraints can be specified by users or automatically constructd using a simple algorithm. The concepts in the paper are illustrated with a clients/server system.

title: Checking safety properties using compositional reachability analysis
abstract: The software architecture of a distributed program can be represented by a hierarchical composition of subsystems, with interacting processes at the leaves of the hierarchy. Compositional reachability analysis (CRA) is a promising state reduction technique which can be automated and used in stages to derive the overall behavior of a distributed program based on its architecture. CRA is particularly suitable for the analysis of programs that are subject to evolutionary change. When a program evolves, only the behaviors of those subsystems affected by the change need be reevaluated. The technique however has a limitation. The properties available for analysis are constrained by the set of actions that remain globally observable. Properties involving actions encapsulated by subsystems may therefore not be analyzed. In this article, we enhance the CRA technique to check safety properties which may contain actions that are not globally observable. To achieve this, the state machine model is augmented with a special trap state labeled as π. We propose a scheme to transform, in stages, a property that involves hidden actions to one that involves only globally observable actions. The enhanced technique also includes a mechanism aiming at reducing the debugging effort. The technique is illustrated using a gas station system example.

title: Insensitive bounds for the moments of the sojourn time distribution in the M/G/1 processor-sharing queue
abstract: This paper studies the M/G/1 processor-sharing (PS) queue, in particular the sojourn time distribution conditioned on the initial job size. Although several expressions for the Laplace-Stieltjes transform (LST) are known, these expressions are not suitable for computational purposes. This paper derives readily applicable insensitive bounds for all moments of the conditional sojourn time distribution. The instantaneous sojourn time, i.e., the sojourn time of an infinitesimally small job, leads to insensitive upper bounds requiring only knowledge of the traffic intensity and the initial job size. Interestingly, the upper bounds involve polynomials with so-called Eulerian numbers as coefficients. In addition, stochastic ordering and moment ordering results for the sojourn time distribution are obtained.

title: A formal-specification based approach for protecting the domain name system
abstract: Many network applications depend on the security of the domain name system (DNS). Attacks on the DNS can cause denial of service and entity authentication to fail. In our approach, we use formal specifications to characterize DNS clients and DNS name servers, and to define a security goal. A name server should only use DNS data that is consistent with data from name servers that manage the corresponding domains (i.e. authoritative name servers). To enforce the security goal, we formally specify a DNS wrapper that examines the incoming and outgoing DNS messages of a name server to detect messages that could cause violations of the security goal, cooperates with the corresponding authoritative name servers to diagnose those messages, and drops the messages that are identified as threats. Based on the wrapper specification, we implemented a wrapper prototype and evaluated its performance. Out experiments show that the wrapper incurs reasonable overhead and is effective against DNS attacks such as cache poisoning and certain spoofing attacks.

title: Decomposing the queue length distribution of processor-sharing models into queue lengths of permanent customer queues
abstract: We obtain a decomposition result for the steady state queue length distribution in egalitarian processor-sharing (PS) models. In particular, for multi-class egalitarian PS queues, we show that the marginal queue length distribution for each class equals the queue length distribution of an equivalent single class PS model with a random number of permanent customers. Similarly, the mean sojourn time (conditioned on the initial service requirement) for each class can be obtained by conditioning on the number of permanent customers. The decomposition result implies linear relations between the marginal queue length probabilities, which also hold for other PS models such as the egalitarian PS models with state-dependent system capacity that only depends on the total number of customers in the system. Based on the exact decomposition result for egalitarian PS queues, we propose a similar decomposition for discriminatory processor-sharing (DPS) models, and numerically show that the approximation is accurate for moderate differences in service weights.

title: Dependable Intrusion Tolerance: technology demo
abstract: The Dependable Intrusion Tolerance (DIT) architecture is a flexible, adaptive, and intrusion-tolerant server design. We briefly discuss its prototype implementation and validation, and demonstrate how it resists sample attacks.

title: Modeling multistep cyber attacks for scenario recognition
abstract: Efforts toward automated detection and identification of multistep cyber attack scenarios would benefit significantly from a methodology and language for modeling such scenarios. The Correlated Attack Modeling Language (CAML) uses a modular approach, where a module represents an inference step and modules can be linked together to detect multistep scenarios. CAML is accompanied by a library of predicates, which functions as a vocabulary to describe the properties of system states and events. The concept of attack patterns is introduced to facilitate reuse of generic modules in the attack modeling process. CAML is used in a prototype implementation of a scenario recognition engine that consumes first-level security alerts in real time and produces reports that identify multistep attack scenarios discovered in the alert stream.