waashk/dblp huggingface dataset:
trickle: a userland bandwidth shaper for unix-like systems. as with any finite resource, it is often necessary to apply policies to the shared usage of network resources. existing solutions typically implement this by employing traffic management in edge routers. however, users of smaller networks regularly find themselves in need of nothing more than ad-hoc rate limiting. such networks are typically unmanaged, with no network administrator(s) to manage complicated traffic management schemes. trickle bridges this gap by providing a simple and portable solution to rate limit the tcp connections of a given process or group of processes. trickle takes advantage of the unix dynamic loader's preloading functionality to interposition itself in front of the bsd socket api provided by the system's libc. running entirely in user space, shapes network traffic by delaying and truncating socket i/os without requiring administrator privileges. instances of trickle can cooperate, even across networks allowing for the specification of global rate limiting policies. due to the prevalence of bsd sockets and dynamic loaders, trickle enjoys the benefit of portability accross a multitude of unix-like platforms.
a parts-of-file file system. the parts-of-file file system (poffs) allows read-write accesses to different views of a given file or set of files in order to help the user separate and manipulate different concerns. the set of files is considered as a mount point from which views can be selected as read-write files via directories. paths are formulas mentioning properties of a desired view. each directory contain a file (the view) which contains the parts of the mounted files that satisfy the properties. this service is offered generically at the file system level, and a plug-in interface permits that file formats, or application-specific details are handled by user-defined operators. special plug-ins called transducers can be defined for automatically attaching properties to parts of files. performances are encouraging; files of 100 000 lines are handled efficiently.
freevga: architecture independent video graphics initialization for linuxbios. linuxbios is fast becoming a widely accepted alternative to the traditional pc bios for cluster computing applications. however, in the process it is gaining attention from developers of internet appliance, desktop and visualization applications, who also wish to take advantage of the features provided by linuxbios, such as minimizing user interaction, increasing system reliability, and faster boot times. unlike cluster computing, these applications tend to rely heavily on graphical user interfaces, so it is important that the vga hardware is correctly initialized early in the boot process in additional to the hardware initialization currently performed by linuxbios. unfortunately, the open-source nature of linuxbios means that many graphic card vendors are reluctant to expose code relating to the initialization of their hardware in the fear that this might allow competitors access to proprietary chipset information. as a consequence, in many cases the only way to initialize the vga hardware is to use the vendor provided, proprietary, vga bios. to achieve this it is necessary to provide a compatibility layer that operates between the vga bios and linuxbios in order to simulate the environment that the vga bios assumes is available. in this paper we present our preliminary results on freevga, an x86 emulator based on x86emu that can be used as such a compatibility layer. we will show how we have successfully used freevga to initialize vga cards from both ati and nvidia on a tyan s2885 platform.
building a reactive immune system for software services. we propose a reactive approach for handling a wide variety of software failures, ranging from remotely exploitable vulnerabilities to more mundane bugs that cause abnormal program termination (e.g., illegal memory dereference) or other recognizable bad behavior (e.g., computational denial of service). our emphasis is in creating "self-healing" software that can protect itself against a recurring fault until a more comprehensive fix is applied. briefly, our system monitors an application during its execution using a variety of external software probes, trying to localize (in terms of code regions) observed faults. in future runs of the application, the "faulty" region of code will be executed by an instruction-level emulator. the emulator will check for recurrences of previously seen faults before each instruction is executed. when a fault is detected, we recover program execution to a safe control flow. using the emulator for small pieces of code, as directed by the observed failure, allows us to minimize the performance impact on the immunized application. we discuss the overall system architecture and a prototype implementation for the x86 platform. we show the effectiveness of our approach against a range of attacks and other software failures in real applications such as apache, sshd, and bind. our preliminary performance evaluation shows that although full emulation can be prohibitively expensive, selective emulation can incur as little as 30% performance overhead relative to an uninstrumented (but failure-prone) instance of apache. although this overhead is significant, we believe our work is a promising first step in developing self-healing software.
amp: program context specific buffer caching. we present adaptive multi-policy disk caching (amp), which uses multiple caching policies within one application, and adapts both which policies to use and their relative fraction of the cache, based on program-context specific information. amp differentiate disk requests based on the program contexts, or code locations, that issue them. compared to recent work, amp is unique in that it employs a new robust scheme for detecting looping patterns in access streams, as well as a low-overhead randomized way of managing many cache partitions. we show that amp outperforms non-detection-based caching algorithms on a variety of workloads by up to 50% in miss rate reduction. compared to other detection-based schemes, we show that amp detects access patterns more accurately for a series of synthesized workloads, and incurs up to 15% fewer misses for one application trace.
netstate: a network version tracking system. network administrators and security analysts often do not know what network services are being run in every corner of their networks. if they do have a vague grasp of the services running on their networks, they often do not know what specific versions of those services are running. actively scanning for services and versions does not always yield complete results, and patch and service management, therefore, suffer. we present net-state, a system for monitoring, storing, and reporting application and operating system version information for a network. netstate gives security and network administrators the ability to know what is running on their networks while allowing for user-managed machines and complex host configurations. our architecture uses distributed modules to collect network information and a centralized server that stores and issues reports on that collected version information. we discuss some of the challenges to building and operating netstate as well as the legal issues surrounding the promiscuous capture of network data. we conclude that this tool can solve some key problems in network management and has a wide range of possibilities for future uses.
comparison-based file server verification. comparison-based server verification involves testing a server by comparing its responses to those of a reference server. an intermediary, called a "server tee," interposes between clients and the reference server, synchronizes the system-under-test (sut) to match the reference server's state, duplicates each request for the sut, and compares each pair of responses to identify any discrepancies. the result is a detailed view into any differences in how the sut satisfies the client-server protocol specification, which can be invaluable in debugging servers, achieving bug compatibility, and isolating performance differences. this paper introduces, develops, and illustrates the use of comparison-based server verification. as a concrete example, it describes a nfsv3 tee and reports on its use in identifying interesting differences in several production nfs servers and in debugging a prototype nfs server. these experiences confirm that comparison-based server verification can be a useful tool for server implementors.
ourmon and network monitoring performance. ourmon is an open-source network management and anomaly detection system that has been developed over a period of several years at portland state university. ourmon monitors a target network both to highlight abnormal network traffic and measure normal traffic loads. in this paper, we describe the features and performance characteristics of ourmon. ourmon features include a novel mechanism for running multiple concurrent berkeley packet filter (bpf) expressions bound to a single rrdtool-style graph, as well as various types of top talker (top-n) filters aimed at conventional network flow measurements and anomaly detection. these features permit a variety of useful and easily-understood measurements. one problem that sniffer-based network monitor systems face is network-intensive attacks that can overwhelm monitoring and analysis resources. lab experiments with an ixia high-speed packet generator, as well as experiences with ourmon in a real network environment, demonstrate this problem. some recent modifications to ourmon have greatly improved its performance. however, minimum-size packets in a high-speed network can still easily make a host lose packets even at relatively slow rates and low monitor workloads. we contend that small packet performance is a general network security problem faced by current monitoring systems including both open source systems such as ourmon and snort, and commercial systems.
sarc: sequential prefetching in adaptive replacement cache. sequentiality of reference is an ubiquitous access pattern dating back at least to multics. sequential workloads lend themselves to highly accurate prediction and prefetching. in spite of the simplicity of the workload, design and analysis of a good sequential prefetching algorithm and associated cache replacement policy turns out to be surprisingly intricate. as first contribution, we uncover and remedy an anomaly (akin to famous belady's anomaly) that plagues sequential prefetching when integrated with caching. typical workloads contain a mix of sequential and random streams. as second contribution, we design a self-tuning, low overhead, simple to implement, locally adaptive, novel cache management policy sarc that dynamically and adaptively partitions the cache space amongst sequential and random streams so as to reduce the read misses. as third contribution, we implemented sarc along with two popular state-of-the-art lru variants on hardware for ibm's flagship storage controller shark. on shark hardware with 8 gb cache and 16 raid-5 arrays that is serving a workload akin to storage performance council's widely adopted spc-1 benchmark, sarc consistently and dramatically outperforms the two lru variants shifting the throughput-response time curve to the right and thus fundamentally increasing the capacity of the system. as anecdotal evidence, at the peak throughput, sarc has average response time of 5.18ms as compared to 33.35ms and 8.92ms for the two lru variants.
clock-pro: an effective improvement of the clock replacement. with the ever-growing performance gap between memory systems and disks, and rapidly improving cpu performance, virtual memory (vm) management becomes increasingly important for overall system performance. however, one of its critical components, the page replacement policy, is still dominated by clock, a replacement policy developed almost 40 years ago. while pure lru has an unaffordable cost in vm, clock simulates the lru replacement algorithm with a low cost acceptable in vm management. over the last three decades, the inability of lru as well as clock to handle weak locality accesses has become increasingly serious, and an effective fix becomes increasingly desirable. inspired by our i/o buffer cache replacement algorithm, lirs [13], we propose an improved clock replacement policy, called clock-pro. by additionally keeping track of a limited number of replaced pages, clock-pro works in a similar fashion as clock with a vm-affordable cost. furthermore, it brings all the much-needed performance advantages from lirs into clock. measurements from an implementation of clock-pro in linux kernel 2.4.21 show that the execution times of some commonly used programs can be reduced by up to 47%.
chameleon: a self-evolving, fully-adaptive resource arbitrator for storage systems. enterprise applications typically depend on guaranteed performance from the storage subsystem, lest they fail. however, unregulated competition is unlikely to result in a fair, predictable apportioning of resources. given that widespread access protocols and scheduling policies are largely best-effort, the problem of providing performance guarantees on a shared system is a very difficult one. clients typically lack accurate information on the storage system's capabilities and on the access patterns of the workloads using it, thereby compounding the problem. chameleon is an adaptive arbitrator for shared storage resources; it relies on a combination of self-refining models and constrained optimization to provide performance guarantees to clients. this process depends on minimal information from clients, and is fully adaptive; decisions are based on device and workload models automatically inferred, and continuously refined, at run-time. corrective actions taken by chameleon are only as radical as warranted by the current degree of knowledge about the system's behavior. in our experiments on a real storage system chameleon identified, analyzed, and corrected performance violations in 3-14 minutes--which compares very favorably with the time a human administrator would have needed. our learning-based paradigm is a most promising way of deploying large-scale storage systems that service variable workloads on an ever-changing mix of device types.
build buddy for fun and profit. we present a build and packaging system called build buddy. the system is comprised of a set of tools for building and maintaining software packages on multiple operating systems and architectures.
running virtualized native drivers in user mode linux. a simulation infrastructure for wireless network emulation based on user mode linux and on the virtualisation of the hostap driver is proposed. the interconnection of these components is first described and the architecture of the resulting network emulator is explained. two practical applications are then detailed : the testing of an implementation of the aodv routing protocol in a highly realistic environment and the study of the interactions between the hostap driver and the card it drives.
opencsg: a library for image-based csg rendering. we present the design and implementation of a real-time 3d graphics library for image-based constructive solid geometry (csg). this major approach of 3d modeling has not been supported by real-time computer graphics until recently. we explain two essential image-based csg rendering algorithms, and we introduce an api that provides a compact access to their complex functionality and implementation. as an important feature, the csg library seam lessly integrates application-defined 3d shapes as primitives of csg operations to ensure high adaptability and openness. we also outline optimization techniques to improve the performance in the case of complex csg models. a number of use cases demonstrate potential applications of the library.
maintaining high-bandwidth under dynamic network conditions. the need to distribute large files across multiple wide-area sites is becoming increasingly common, for instance, in support of scientific computing, configuring distributed systems, distributing software updates such as open source isos or windows patches, or disseminating multimedia content. recently a number of techniques have been proposed for simultaneously retrieving portions of a file from multiple remote sites with the twin goals of filling the client's pipe and overcoming any performance bottlenecks between the client and any individual server. while there are a number of interesting tradeoffs in locating appropriate download sites in the face of dynamically changing network conditions, to date there has been no systematic evaluation of the merits of different protocols. this paper explores the design space of file distribution protocols and conducts a detailed performance evaluation of a number of competing systems running in both controlled emulation environments and live across the internet. based on our experience with these systems under a variety of conditions, we propose, implement and evaluate bullet' (bullet prime), a mesh based high bandwidth data dissemination system that outperforms previous techniques under both static and dynamic conditions.
automatic synthesis of filters to discard buffer overflow attacks: a step towards realizing self-healing systems. buffer overflows have become the most common target for network-based attacks. they are also the primary propagation mechanism used by worms. although many techniques (such as stackguard) have been developed to protect servers from being compromised by buffer overflow attacks, these techniques cause the server to crash. in the face of automated, repetitive attacks such as those due to worms, these protection mechanisms lead to repeated restarts of the victim application, rendering its service unavailable. in contrast, we present a promising new approach that learns the characteristics of inputs associated with attacks, and filters them out in the future. it can be implemented without changing the server code, or even having access to its source. since attack-bearing inputs are dropped before they corrupt the victim process, there is no need to restart the victim; as a result, recovery from attacks can be very fast. we tested our approach on 8 buffer overflow attacks reported in the past few years on securityfocus.com and were available with working exploit code, and found that it generated accurate filters for 7 out of these 8 attacks.
using valgrind to detect undefined value errors with bit-precision. we present memcheck, a tool that has been implemented with the dynamic binary instrumentation framework valgrind. memcheck detects a wide range of memory errors in programs as they run. this paper focuses on one kind of error that memcheck detects: undefined value errors. such errors are common, and often cause bugs that are hard to find in programs written in languages such as c, c++ and fortran. memcheck's definedness checking improves on that of previous tools by being accurate to the level of individual bits. this accuracy gives memcheck a low false positive and false negative rate. the definedness checking involves shadowing every bit of data in registers and memory with a second bit that indicates if the bit has a defined value. every value-creating operation is instrumented with a shadow operation that propagates shadow bits appropriately. memcheck uses these shadow bits to detect uses of undefined values that could adversely affect a program's behaviour. under memcheck, programs typically run 20-30 times slower than normal. this is fast enough to use with large programs. memcheck finds many errors in real programs, and has been used during the past two years by thousands of programmers on a wide range of systems, including openoffice, mozilla, opera, kde, gnome, mysql, perl, samba, the gimp, and unreal tournament.
the ethernet speaker system. if we wish to distribute audio in a large room, building, or even a campus, we need multiple speakers. these speakers must be jointly managed and synchronized. the ethernet speaker (es) system presented in this paper can be thought of as a distributed audio amplifier and speakers, it does not "play" any particular format, but rather relies on off-the-shelf audio applications (e.g., mpg123 player, real audio player) to act as the audio source. the ethernet speaker, consists of three elements: (a) a system that converts the audio output of the unmodified audio application to a network stream containing configuration and timing information (rebroad-caster), (b) the devices that generate sound from the audio stream (ethernet speakers), and (c) the protocol that ensures that all the speakers in a lan play the same sounds. this paper covers all three elements, discussing design considerations, experiences from the prototype implementations, and our plans for extending the system to provide additional features such as automatic volume control, local user interfaces, and security.
linux physical memory analysis. we present a tool suite for analysis of physical memory usage within the linux kernel environment. this tool suite can be used to collect and analyze how the physical memory within a linux environment is being used.
transparent checkpoint-restart of multiple processes on commodity operating systems. the ability to checkpoint a running application and restart it later can provide many useful benefits including fault recovery, advanced resources sharing, dynamic load balancing and improved service availability. however, applications often involve multiple processes which have dependencies through the operating system. we present a transparent mechanism for commodity operating systems that can checkpoint multiple processes in a consistent state so that they can be restarted correctly at a later time. we introduce an efficient algorithm for recording process relationships and correctly saving and restoring shared state in a manner that leverages existing operating system kernel functionality. we have implemented our system as a loadable kernel module and user-space utilities in linux. we demonstrate its ability on real-world applications to provide transparent checkpoint-restart functionality without modifying, recompiling, or relinking applications, libraries, or the operating system kernel. our results show checkpoint and restart times 3 to 55 times faster than openvz and 5 to 1100 times faster than xen.
qemu, a fast and portable dynamic translator. we present the internals of qemu, a fast machine emulator using an original portable dynamic translator. it emulates several cpus (x86, powerpc, arm and sparc) on several hosts (x86, powerpc, arm, sparc, alpha and mips). qemu supports full system emulation in which a complete and unmodified operating system is run in a virtual machine and linux user mode emulation where a linux process compiled for one target cpu can be run on another cpu.
active internet traffic filtering: real-time response to denial-of-service attacks. this paper describes active internet traffic filtering (aitf), a mechanism for blocking highly distributed denial-of-service (ddos) attacks. these attacks are an acute contemporary problem, with few practical solutions available today; we describe in this paper the reasons why no effective ddos filtering mechanism has been deployed yet. we show that the current internet's routers have sufficient filtering resources to thwart such attacks, with the condition that attack traffic be blocked close to its sources; aitf leverages this observation. our results demonstrate that aitf can block a million-flow attack within seconds, while it requires only tens of thousands of wire-speed filters per participating router -- an amount easily accommodated by today's routers. aitf can be deployed incrementally and yields benefits even to the very first adopters.