A formal-specification based approach for protecting the domain name system
Many network applications depend on the security of the domain name system (DNS). Attacks on the DNS can cause denial of service and entity authentication to fail. In our approach, we use formal specifications to characterize DNS clients and DNS name servers, and to define a security goal. A name server should only use DNS data that is consistent with data from name servers that manage the corresponding domains (i.e. authoritative name servers). To enforce the security goal, we formally specify a DNS wrapper that examines the incoming and outgoing DNS messages of a name server to detect messages that could cause violations of the security goal, cooperates with the corresponding authoritative name servers to diagnose those messages, and drops the messages that are identified as threats. Based on the wrapper specification, we implemented a wrapper prototype and evaluated its performance. Out experiments show that the wrapper incurs reasonable overhead and is effective against DNS attacks such as cache poisoning and certain spoofing attacks.

title: Dependable Intrusion Tolerance: technology demo
abstract: The Dependable Intrusion Tolerance (DIT) architecture is a flexible, adaptive, and intrusion-tolerant server design. We briefly discuss its prototype implementation and validation, and demonstrate how it resists sample attacks.

title: Routing with Locality on Meshes with Buses
abstract: Routing with locality is studied for meshes with buses. In this problem, packets' distances are bounded by a value,d, which is less than the diameter of the network. This problem arises naturally when specific known algorithms are implemented on meshes. Solving this problem in ordinary meshes requires at least a routing time ofdsteps. To do better than this, we propose adding a kind of short bus to ordinary meshes. By using a technique which we call iterative walk-and-ride, we show how the routing time can be reduced by approximately one-third for solving the problem (including the multipacket version) on one- and two-dimensional short-bus meshes. The bounds we develop are tight.

title: An Architecture for an Adaptive Intrusion-Tolerant Server
abstract: We describe a general architecture for intrusion-tolerant enterprise systems and the implementation of an intrusion-tolerant Web server as a specific instance. The architecture comprises functionally redundant COTS servers running on diverse operating systems and platforms, hardened intrusion-tolerance proxies that mediate client requests and verify the behavior of servers and other proxies, and monitoring and alert management components based on the EMERALD intrusion-detection framework. Integrity and availability are maintained by dynamically adapting the system configuration in response to intrusions or other faults. The dynamic configuration specifies the servers assigned to each client request, the agreement protocol used to validate server replies, and the resources spent on monitoring and detection. Alerts trigger increasingly strict regimes to ensure continued service, with graceful degradation of performance, even if some servers or proxies are compromised or faulty. The system returns to less stringent regimes as threats diminish. Servers and proxies can be isolated, repaired, and reinserted without interrupting service.

title: Automatic analysis of firewall and network intrusion detection system configurations
abstract: Given a network that deploys multiple firewalls and network intrusion detection systems (NIDSs), ensuring that these security components are correctly configured is a challenging problem. Although models have been developed to reason independently about the effectiveness of firewalls and NIDSs, there is no common framework to analyze their interaction. This paper presents an integrated, constraint-based approach for modeling and reasoning about these configurations. Our approach considers the dependencies among the two types of components, and can reason automatically about their combined behavior. We have developed a tool for the specification and verification of networks that include multiple firewalls and NIDSs, based on this approach. This tool can also be used to automatically generate NIDS configurations that are optimal relative to a given cost function.

title: Modeling multistep cyber attacks for scenario recognition
abstract: Efforts toward automated detection and identification of multistep cyber attack scenarios would benefit significantly from a methodology and language for modeling such scenarios. The Correlated Attack Modeling Language (CAML) uses a modular approach, where a module represents an inference step and modules can be linked together to detect multistep scenarios. CAML is accompanied by a library of predicates, which functions as a vocabulary to describe the properties of system states and events. The concept of attack patterns is introduced to facilitate reuse of generic modules in the attack modeling process. CAML is used in a prototype implementation of a scenario recognition engine that consumes first-level security alerts in real time and produces reports that identify multistep attack scenarios discovered in the alert stream.

title: Behaviour Analysis of Distributed Systems Using the Tracta Approach
abstract: Behaviour analysis should form an integral part of the software development process. This is particularly important in the design of concurrent and distributed systems, where complex interactions can cause unexpected and undesired system behaviour. We advocate the use of a compositional approach to analysis. The software architecture of a distributed program is represented by a hierarchical composition of subsystems, with interacting processes at the leaves of the hierarchy. Compositional reachability analysis (CRA) exploits the compositional hierarchy for incrementally constructing the overall behaviour of the system from that of its subsystems. In the Tracta CRA approach, both processes and properties reflecting system specifications are modelled as state machines. Property state machines are composed into the system and violations are detected on the global reachability graph obtained. The property checking mechanism has been specifically designed to deal with compositional techniques. Tracta is supported by an automated tool compatible with our environment for the development of distributed applications.

title: Decomposing the queue length distribution of processor-sharing models into queue lengths of permanent customer queues
abstract: We obtain a decomposition result for the steady state queue length distribution in egalitarian processor-sharing (PS) models. In particular, for multi-class egalitarian PS queues, we show that the marginal queue length distribution for each class equals the queue length distribution of an equivalent single class PS model with a random number of permanent customers. Similarly, the mean sojourn time (conditioned on the initial service requirement) for each class can be obtained by conditioning on the number of permanent customers. The decomposition result implies linear relations between the marginal queue length probabilities, which also hold for other PS models such as the egalitarian PS models with state-dependent system capacity that only depends on the total number of customers in the system. Based on the exact decomposition result for egalitarian PS queues, we propose a similar decomposition for discriminatory processor-sharing (DPS) models, and numerically show that the approximation is accurate for moderate differences in service weights.

title: A two-tier technique for authoring distributed multimedia applications
abstract: Distributed multimedia systems have stringent quality of service requirements which make them difficult to specify and implement. These include near-real-time constraints and synchronization requirements as well as complex user interaction patterns. Traditional approaches to the development of distributed multimedia applications have focused on specifying temporal constraints. Not much attention has been paid to interactive multimedia applications. The objective of this paper is to propose a two-tier approach for the development of multimedia applications which facilitates modular design. As a proof of concept, a prototype with runtime support has been developed and used to construct several non-trivial distributed multimedia applications, including a videoconferencing system, a video phone system and a virtual city tour.

title: Stress Testing of Distributed Multimedia Software Systems
abstract: With the advance in network technologies, the use of distributed multimedia data has become very popular. Distributed multimedia systems are complex and error prone. While there are well established testing techniques for the functionalities of such systems, the technique of stress testing to improve test efficiency has not received much attention. It has been argued that faults are more likely to occur in situations where there is a fierce competition for resources. When the system is heavily loaded, errors like mismanagement of buffers can be easily identified. In this paper, we present several criteria for selecting test cases, and describe two methods for generating test cases which maximize system resource usage. Our approach is based on symbolic execution and constraint solving. An example is given to illustrate the concepts and techniques.

title: A model-based authorware for the construction of distributed multimedia systems
abstract: Distributed multimedia systems typically involve a sophisticated user interaction. Further, objects are allocated on physically distributed computing systems, and multimedia data must be transferred across heterogeneous networks in a timely manner. These systems often have complex requirements on a user interaction, quality of service and temporal order among media streams. The design and implementation of these requirements are inherently complex and present an extraordinary design and programming challenge. Generally, these complex requirements cannot be adequately captured using a single model or a design notation. The challenge amounts to (i) identification of multiple, often orthogonal models, each capturing a specific aspect of the requirements, and (ii) provision of an authorware that supports the composition of these models. In this paper, we propose to capture the multimedia requirements in three different models: configuration, user control and presentation, and demonstrate how the composition of these models can be supported by an authorware using the Java and CORBA technologies. The concepts are illustrated using a real-life example based on a virtual city tour application that features distributed controls, collaborative work and multimedia presentations. Various distributed multimedia applications like video phone, video conferencing and distributed presentation have been successfully constructed using the proposed multiple models and authorware. The results are encouraging and the approach can shorten the development of multimedia applications considerably.