waashk/dblp huggingface dataset:
brooery: a graphical environment for analysis of security-relevant network activity. we present the design and implementation of the brooery, a system for graphical analysis of network activity reported by instances of the bro intrusion detection system. it supports multiple input streams and provides a web-based graphical user interface to allow the user to analyze the reported activity. the brooery understands activity at different abstraction levels, allows for quick drill-down searches by focusing on contextuality when moving through the history of events, and provides user-friendly and semantically strong hierarchical filtering to reduce the amount of information presented.
measuring cpu overhead for i/o processing in the xen virtual machine monitor. virtual machine monitors (vmms) are gaining popularity in enterprise environments as a software-based solution for building shared hardware infrastructures via virtualization. in this work, using the xen vmm, we present a light weight monitoring system for measuring the cpu usage of different virtual machines including the cpu overhead in the device driver domain caused by i/o processing on behalf of a particular virtual machine. our performance study attempts to quantify and analyze this overhead for a set of i/o intensive workloads.
binder: an extrusion-based break-in detector for personal computers. compromised computers have been a menace to both personal and business computing. in this paper, we tackle the problem of automated detection of break-ins of new unknown threats such as worms, spyware and adware on personal computers. we propose break-in detector (binder), a host-based break-in detection system. our key observation is that many break-ins make extrusions, stealthy malicious outgoing network connections. binder exploits a unique characteristic of personal computers, that most network activities are directly or indirectly triggered by user input. since threats tend to run as background precesses and thus do not receive any user input, the intuition behind binder is that only threats generate connections without user input. by correlating outgoing network connections and processing information with user activities, binder can capture extrusions and thus break-ins.
performance of multithreaded chip multiprocessors and implications for operating system design. we investigated how operating system design should be adapted for multithreaded chip multiprocessors (cmt) - a new generation of processors that exploit thread-level parallelism to mask the memory latency in modern workloads. we determined that the l2 cache is a critical shared resource on cmt and that an insufficient amount of l2 cache can undermine the ability to hide memory latency on these processors. to use the l2 cache as efficiently as possible, we propose an l2-conscious scheduling algorithm and quantify its performance potential. using this algorithm it is possible to reduce miss ratios in the l2 cache by 25-37% and improve processor throughput by 27-45%.
a tool for automated iptables firewall analysis. we describe itval, a tool that enables the efficient analysis of an iptables-based firewall. the underlying basis of itval is a library for the efficient manipulation of multi-way decision diagrams. we represent iptables rule sets and queries about the firewall defined by those rule sets as multi-way decision diagrams, and determine answers for the queries by manipulating the diagrams. in addition to discussing the design and implementation of itval, we describe how it can be used to detect and correct common firewall errors.
pulse: a dynamic deadlock detection mechanism using speculative execution. deadlock can occur wherever multiple processes interact. most existing static and dynamic deadlock detection tools focus on simple types of deadlock, such as those caused by incorrect ordering of lock acquisitions. in this paper, we propose pulse, a novel operating system mechanism that dynamically detects various types of deadlock in application programs. pulse runs as a system daemon. periodically, it scans the system for processes that have been blocked for a long time (e.g., waiting on i/o events). to determine if these processes are deadlocked, pulse speculatively executes them ahead to discover their dependences. based on this information, it constructs a general resource graph and detects deadlock by checking if the graph contains cycles. the ability to look into the future allows pulse to detect deadlocks involving consumable resources, such as synchronization semaphores and pipes, which no existing tools can detect. we evaluate pulse by showing that it can detect deadlocks in the classical dining-philosophers and smokers problems. furthermore, we show that pulse can detect a well-known deadlock scenario, which is widely referred to as a denial-of-service vulnerability, in the apache web server. our results show that pulse can detect all these deadlocks within three seconds, and it introduces little performance overhead to normal applications that do not deadlock.
scmbug: policy-based integration of software configuration management with bug-tracking. software configuration management(scm) and bug-tracking are key components of a successful software engineering project. existing systems integrating the two have failed to meet the needs of the asu scalable computing lab, powered by open-source software. an improved solution to the integration problem, designed to accomodate both free and commercial systems alike, is presented. scmbug offers a policy-based mechanism of capturing and handling integration of scm events, such as committing software change-sets and labeling software releases, with a bug-tracking system. synchronous verification checks and the flexibilty to match multiple development models separate this approach from related work. we address design limitations of existing integration efforts, suggest improvements in scm and bug-tracking systems required to achieve a scalable solution, and document our early integration experiences.
loose synchronization for large-scale networked systems. traditionally, synchronization barriers ensure that no cooperating process advances beyond a specified point until all processes have reached that point. in heterogeneous large-scale distributed computing environments, with unreliable network links and machines that may become overloaded and unresponsive, traditional barrier semantics are too strict to be effective for a range of emerging applications. in this paper, we explore several relaxations, and introduce a partial barrier, a synchronization primitive designed to enhance liveness in loosely coupled networked systems. partial barriers are robust to variable network conditions; rather than attempting to hide the asynchrony inherent to wide-area settings, they enable appropriate application-level responses. we evaluate the improved performance of partial barriers by integrating them into three publicly available distributed applications running across planetlab. further, we show how partial barriers simplify a re-implementation of mapreduce that targets wide-area environments.
stealth probing: efficient data-plane security for ip routing. ip routing is notoriously vulnerable to accidental misconfiguration and malicious attack. although secure routing protocols are an important defense, the data plane must be part of any complete solution. existing proposals for secure (link-level) forwarding are heavy-weight, requiring cryptographic operations at each hop in a path. instead, we propose a light-weight data-plane mechanism (called stealth probing) that monitors the availability of paths in a secure fashion, while enabling the management plane to home in on the location of adversaries by combining the results of probes from different vantage points (called byzantine tomography). we illustrate how stealth probing and byzantine tomography can be applied in today's routing architecture, without requiring support from end hosts or internal routers.
ip only server. present day servers must support a variety of legacy i/o devices and protocols that are rarely used in the day to day server operation, at a significant cost in board layout complexity, reliability, power consumption, heat dissipation, and ease of management. we present a design of an ip only server, which has a single, unified i/o interface: ip network. all of the server's i/o is emulated and redirected over ip/ethernet to a remote management station, except for the hard disks which are accessed via iscsi. the emulation is done in hardware, and is available from power-on to shutdown, including the pre-os and post-os (crash) stages, unlike alternative solutions such as vnc that can only function when the os is operational. the server's software stack -- the bios, the os, and applications -- will run without any modifications. we have developed a prototype ip only server, based on a cots fpga running our embedded i/o emulation firmware. the remote station is a commodity pc running a vnc client for video, keyboard and mouse. initial performance evaluations with unmodified bios and windows and linux operating systems indicate negligible network overhead and acceptable user experience. this prototype is the first attempt to create a diskless and headless x86 server that runs unmodified industry standard software (bios, os, and applications).
compare-by-hash: a reasoned analysis. compare-by-hash is the now-common practice used by systems designers who assume that when the digest of a cryptographic hash function is equal on two distinct files, then those files are identical. this approach has been used in both real projects and in research efforts (for example rysnc [16] and lbfs [12]). a recent paper by henson criticized this practice [8]. the present paper revisits the topic from an advocate's standpoint: we claim that compare-by-hash is completely reasonable, and we offer various arguments in support of this viewpoint in addition to addressing concerns raised by henson.
flux: a language for programming high-performance servers. programming high-performance server applications is challenging: it is both complicated and error-prone to write the concurrent code required to deliver high performance and scalability. server performance bottlenecks are difficult to identify and correct. finally, it is difficult to predict server performance prior to deployment. this paper presents flux, a language that dramatically simplifies the construction of scalable high-performance server applications. flux lets programmers compose off-the-shelf, sequential c or c++ functions into concurrent servers. flux programs are type-checked and guaranteed to be deadlock-free. we have built a number of servers in flux, including a web server with php support, an image-rendering server, a bittorrent peer, and a game server. these flux servers match or exceed the performance of their counterparts written entirely in c. by tracking hot paths through a running server, flux simplifies the identification of performance bottlenecks. the flux compiler also automatically generates discrete event simulators that accurately predict actual server performance under load and with different hardware resources.
transparent contribution of memory. a multitude of research and commercial projects have proposed contributory systems that utilize wasted cpu cycles, idle memory and free disk space found on end-user machines. these applications include distributed computation such as signal processing and protein folding, peer-to-peer backup, and large-scale distributed storage. while users are generally willing to give up unused cpu cycles, the use of memory by contributory applications deters participation in such systems. contributory applications pollute the machine's memory, forcing user pages to be evicted to disk. this paging can disrupt user activity for seconds or even minutes. in this paper, we describe the design and implementation of an operating system mechanism to support transparent contribution of memory. a transparent memory manager (tmm) controls memory usage by contributory applications, ensuring that users will not notice an increase in the miss rate of their applications. tmm is able to protect user pages such that page miss overhead is limited to 1.7%, while donating hundreds of megabytes of memory.
proper: privileged operations in a virtualised system environment. virtualised systems have experienced a resurgence in popularity in recent years, particularly in supporting a large number of independent services on a single host. this paper describes our work designing and implementing proper, a service running on the planetlab system, that allows other services to perform privileged operations in a safe, controlled manner. we describe how implementing such a system in a traditional unix environment is non-trivial, and discuss the practical use of proper.
integrated scientific workflow management for the emulab network testbed. the main forces that shaped current network testbeds were the needs for realism and scale. now that several testbeds support large and complex experiments, management of experimentation processes and results has become more difficult and a barrier to high-quality systems research. the popularity of network testbeds means that new tools for managing experiment workflows, addressing the ready-made base of testbed users, can have important and significant impacts. we are now evolving emulab, our large and popular network testbed, to support experiments that are organized around scientific workflows. this paper summarizes the opportunities in this area, the new approaches we are taking, our implementation in progress, and the challenges in adapting scientific workflow concepts for testbed-based research. with our system, we expect to demonstrate that a network testbed with integrated scientific workflow management can be an important tool to aid research in networking and distributed systems.
cutting through the confusion: a measurement study of homograph attacks. web homograph attacks have existed for some time, and the recent adoption of international domain names (idns) support by browsers and dns registrars has exacerbated the problem [gabr02]. many international letters have similar glyphs, such as the cyrillic letter p (lower case 'er,' unicode 0x0440) and the latin letter p. because of the large potential for misuse of idns, browser vendors, policy advocates, and researchers have been exploring techniques for mitigating homograph attacks [=mozi05, appl05, oper05, mark05]. there has been plenty of attention on the problem recently, but we are not aware of any data that quantifies the degree to which web homograph attacks are currently taking place. in this paper, we use a combination of passive network tracing and active dns probing to measure several aspects of web homographs. our main findings are four-fold. first, many authoritative web sites that users visit have several confusable domain names registered. popular web sites are much more likely to have such confusable domains registered. second, registered confusable domain names tend to consist of single character substitutions from their authoritative domains, though we saw instances of five-character substitutions. most confusables currently use latin character homographs, but we did find a non-trivial number of idn homographs. third, web sites associated with non-authoritative confusable domains most commonly show users advertisements. less common functions include redirecting victims to competitor sites and spoofing the content of authoritative site. fourth, during our nine-day trace, none of the 828 web clients we observed visited a non-authoritative confusable web site. overall, our measurement results suggest that homograph attacks currently are rare and not severe in nature. however, given the recent increases in phishing incidents, homograph attacks seem like an attractive future method for attackers to lure users to spoofed sites.
efficient query subscription processing for prospective search engines. current web search engines are retrospective in that they limit users to searches against already existing pages. prospective search engines, on the other hand, allow users to upload queries that will be applied to newly discovered pages in the future. we study and compare algorithms for efficiently matching large numbers of simple keyword queries against a stream of newly discovered pages.
sharing networked resources with brokered leases. this paper presents the design and implementation of shirako, a system for on-demand leasing of shared networked resources. shirako is a prototype of a service-oriented architecture for resource providers and consumers to negotiate access to resources over time, arbitrated by brokers. it is based on a general lease abstraction: a lease represents a contract for some quantity of a typed resource over an interval of time. resource types have attributes that define their performance behavior and degree of isolation. shirako decouples fundamental leasing mechanisms from resource allocation policies and the details of managing a specific resource or service. it offers an extensible interface for custom resource management policies and new resource types. we show how shirako enables applications to lease groups of resources across multiple autonomous sites, adapt to the dynamics of resource competition and changing load, and guide configuration and deployment. experiments with the prototype quantify the costs and scalability of the leasing mechanisms, and the impact of lease terms on fidelity and adaptation.
implementation and evaluation of moderate parallelism in the bind9 dns server. suboptimal performance of the isc bind9 dns server with multiple threads is a well known problem. this paper explores practical approaches addressing this long-standing issue. first, intensive profiling identifies major bottlenecks occurring due to overheads for thread synchronization. these bottlenecks are then eliminated by giving separate work areas with a large memory pool to threads, introducing faster operations on reference counters, and implementing efficient reader-writer locks. whereas some of the solutions developed depend on atomic operations specific to hardware architecture, which are less portable, the resulting implementation still supports the same platforms as before through abstract apis. the improved implementation scales well with up to four processors whether it is operating as an authoritative-only dns server, with or without dynamic updates, or as a caching dns server. it also reduces the memory footprint for large dns databases. acceptance of this new sever will also have a positive side effect in that bind9, and its new features such as dnssec, should get wider acceptance. the direct result has other ramifications: first, the better performance at the application level reveals a kernel bottleneck in freebsd; also, while the results described here are based on our experience with bind9, the techniques should be applicable to other thread-based applications.
antfarm: tracking processes in a virtual machine environment. in a virtualized environment, the vmm is the system's primary resource manager. some services usually implemented at the os layer, like i/o scheduling or certain kinds of security monitoring, are therefore more naturally implemented inside the vmm. implementing such services at the vmm layer can be complicated by the lack of os and application-level knowledge within a vmm. this paper describes techniques that can be used by a vmm to independently overcome part of the "semantic gap" separating it from the guest operating systems it supports. these techniques enable the vmm to track the existence and activities of operating system processes. antfarm is an implementation of these techniques that works without detailed knowledge of a guest's internal architecture or implementation. an evaluation of antfarm for two virtualization environments and two operating systems shows that it can accurately infer process events while incurring only a small 2.5% runtime overhead in the worst case. to demonstrate the practical benefits of process information in a vmm we implement an anticipatory disk scheduler at the vmm level. this case study shows that significant disk throughput improvements are possible in a virtualized environment by exploiting process information within a vmm.
towards a resilient operating system for wireless sensor networks. active research has recently been conducted on large scale wireless sensor networks, especially network management and maintenance, but the technique for managing application errors on mmu-less sensor node devices has not been seriously considered. this paper presents a resilient operating system mechanism for wireless sensor networks. the proposed mechanism separates the kernel from the user execution area via dual mode operation, and the access violation of applications is controlled by static/dynamic code checking. the experiment results on a common sensor node show that the proposed mechanisms effectively protect the system from errant applications.
resilient connections for ssh and tls. disconnection of an ssh shell or a secure application session due to network outages or travel is a familiar problem to many internet users today. in this paper, we extend the ssh and tls protocols to support resilient connections that can span several sequential tcp connections. the extensions allow sessions to survive both changes in ip addresses and long periods of disconnection. our design emphasizes deployability in real-world environments, and addresses many of the challenges identified in previous work, including assumptions made about network middleboxes such as firewalls and nats. we have also implemented the extensions in the openssh and puretls software packages and tested them in practice.
high performance vmm-bypass i/o in virtual machines. currently, i/o device virtualization models in virtual machine (vm) environments require involvement of a virtual machine monitor (vmm) and/or a privileged vm for each i/o operation, which may turn out to be a performance bottleneck for systems with high i/o demands, especially those equipped with modern high speed interconnects such as infiniband. in this paper, we propose a new device virtualization model called vmm-bypass i/o, which extends the idea of os-bypass originated from user-level communication. essentially, vmm-bypass allows time-critical i/o operations to be carried out directly in guest vms without involvement of the vmm and/or a privileged vm. by exploiting the intelligence found in modern high speed network interfaces, vmm-bypass can significantly improve i/o and communication performance for vms without sacrificing safety or isolation. to demonstrate the idea of vmm-bypass, we have developed a prototype called xen-ib, which offers infiniband virtualization support in the xen 3.0 vm environment. xen-ib runs with current infiniband hardware and does not require modifications to existing user-level applications or kernel-level drivers that use infiniband. our performance measurements show that xen-ib is able to achieve nearly the same raw performance as the original infiniband driver running in a non-virtualized environment.