waashk/dblp huggingface dataset:
bump in the ether: a framework for securing sensitive user input. we present bump in the ether (bite), an approach for preventing user-space malware from accessing sensitive user input and providing the user with additional confidence that her input is being delivered to the expected application. rather than preventing malware from running or detecting already-running malware, we facilitate user input that bypasses common avenues of attack. user input traverses a trusted tunnel from the input device to the application. this trusted tunnel is implemented using a trusted mobile device working in tandem with a host platform capable of attesting to its current software state. based on a received attestation, the mobile device verifies the integrity of the host platform and application, provides a trusted display through which the user selects the application to which her inputs should be directed, and encrypts those inputs so that only the expected application can decrypt them. we describe the design and implementation of bite, with emphasis on both usability and security issues.
provenance-aware storage systems. a provenance-aware storage system (pass) is a storage system that automatically collects and maintains provenance or lineage, the complete history or ancestry of an item. we discuss the advantages of treating provenance as meta-data collected and maintained by the storage system, rather than as manual annotations stored in a separately administered database. we describe a pass implementation, discussing the challenges it presents, performance cost it incurs, and the new functionality it enables. we show that with reasonable overhead, we can provide useful functionality not available in today's file systems or provenance management systems.
design tradeoffs in applying content addressable storage to enterprise-scale systems based on virtual machines. this paper analyzes the usage data from a live deployment of an enterprise client management system based on virtual machine (vm) technology. over a period of seven months, twenty-three volunteers used vm-based computing environments hosted by the system and created over 800 checkpoints of vm state, where each checkpoint included the virtual memory and disk states. using this data, we study the design tradeoffs in applying content addressable storage (cas) to such vm-based systems. in particular, we explore the impact on storage requirements and network load of different privacy properties and data granularities in the design of the underlying cas system. the study clearly demonstrates that relaxing privacy can reduce the resource requirements of the system, and identifies designs that provide reasonable compromises between privacy and resource demands.
understanding and validating database system administration. a large number of enterprises need their commodity database systems to remain available at all times. although administrator mistakes are a significant source of unavailability and cost in these systems, no study to date has sought to quantify the frequency of mistakes in the field, understand the context in which they occur, or develop system support to deal with them explicitly. in this paper, we first characterize the typical administrator tasks, testing environments, and mistakes using results from an extensive survey we have conducted of 51 experienced administrators. given the results of this survey, we next propose system support to validate administrator actions before they are made visible to users. our prototype implementation creates a validation environment that is an extension of a replicated database system, where administrator actions can be validated using real workloads. the prototype implements three forms of validation, including a novel form in which the behavior of a database replica can be validated even without an example of correct behavior for comparison. our results show that the prototype can detect the major classes of administrator mistakes.
service placement in a shared wide-area platform. emerging federated computing environments offer attractive platforms to test and deploy global-scale distributed applications. when nodes in these platforms are timeshared among competing applications, available resources vary across nodes and over time. thus, one open architectural question in such systems is how to map applications to available nodes--that is, how to discover and select resources. using a six-month trace of planetlab resource utilization data and of resource demands from three long-running planetlab services, we quantitatively characterize resource availability and application usage behavior across nodes and over time, and investigate the potential to mitigate the application impact of resource variability through intelligent service placement and migration. we find that usage of cpu and network resources is heavy and highly variable. we argue that this variability calls for intelligently mapping applications to available nodes. further, we find that node placement decisions can become ill-suited after about 30 minutes, suggesting that some applications can benefit from migration at that timescale, and that placement and migration decisions can be safely based on data collected at roughly that timescale. we find that inter-node latency is stable and is a good predictor of available bandwidth; this observation argues for collecting latency data at relatively coarse timescales and bandwidth data at even coarser timescales, using the former to predict the latter between measurements. finally, we find that although the utilization of a particular resource on a particular node is a good predictor of that node's utilization of that resource in the near future, there do not exist correlations to support predicting one resource's availability based on availability of other resources on the same node at the same time, on availability of the same resource on other nodes at the same site, or on time-series forecasts that assume a daily or weekly regression to the mean.
securing web service by automatic robot detection. web sites are routinely visited by automated agents known as web robots, that perform acts ranging from the beneficial, such as indexing for search engines, to the malicious, such as searching for vulnerabilities, attempting to crack passwords, or spamming bulletin boards. previous work to identify malicious robots has relied on ad-hoc signature matching and has been performed on a per-site basis. as web robots evolve and diversify, these techniques have not been scaling. we approach the problem as a special form of the turing test and defend the system by inferring if the traffic source is human or robot. by extracting the implicit patterns of human web browsing, we develop simple yet effective algorithms to detect human users. our experiments with the codeen content distribution network show that 95% of human users are detected within the first 57 requests, and 80% can be identified in only 20 requests, with a maximum false positive rate of 2.4%. in the time that this system has been deployed on codeen, robot-related abuse complaints have dropped by a factor of 10.
structured and unstructured overlays under the microscope: a measurement-based view of two p2p systems that people use. existing peer-to-peer systems rely on overlay network protocols for object storage and retrieval and message routing. these overlay protocols can be broadly classified as structured and unstructured - structured overlays impose constraints on the network topology for efficient object discovery, while unstructured overlays organize nodes in a random graph topology that is arguably more resilient to peer population transiency. there is an ongoing discussion on the pros and cons of both approaches. this paper contributes to the discussion a multiple-site, measurement-based study of two operational and widely-deployed file-sharing systems. the two protocols are evaluated in terms of resilience, message overhead, and query performance. we validate our findings and further extend our conclusions through detailed analysis and simulation experiments.
disk drive level workload characterization. in this paper, we present a characterization of disk drive workloads measured in systems representing the enterprise, desktop, and consumer electronics environments. we observe that the common characteristics across all traces are disk drive idleness and workload burstiness. our analysis shows that the majority of characteristics, including request disk arrival rate, response time, service time, write performance, and request size, are environment dependent. however, characteristics such as read/write ratio and access pattern are application dependent.
understanding and addressing blocking-induced network server latency. we investigate the origin and components of network server latency under various loads and find that filesystem-related kernel queues exhibit head-of-line blocking, which leads to bursty behavior in event delivery and process scheduling. in turn, these problems degrade the existing fairness and scheduling policies in the operating system, causing requests that could have been served in memory, with low latency, to unnecessarily wait on disk-bound requests. while this batching behavior only mildly affects throughput, it severely degrades latency. this problem manifests itself in fairness and service quality degradation, a phenomenon we call service inversion. we show a portable solution that avoids these problems without kernel or filesystem modifications, we modify two different web servers to use this approach, and demonstrate a qualitatively different change in their latency profiles, generating more than an order of magnitude reduction in latency. the resulting systems are able to serve most requests without being tied to disk performance, and they scale better with improvements in processor speed. these results are not dependent on server software architecture, and can be profitably applied to experimental and production servers.
lads: large-scale automated ddos detection system. many denial of service attacks use brute-force bandwidth flooding of intended victims. such volume-based attacks aggregate at a target's access router, suggesting that (i) detection and mitigation are best done by providers in their networks; and (ii) attacks are most readily detectable at access routers, where their impact is strongest. in-network detection presents a tension between scalability and accuracy. specifically, accuracy of detection dictates fine grained traffic monitoring, but performing such monitoring for the tens or hundreds of thousands of access interfaces in a large provider network presents serious scalability issues. we investigate the design space for in-network ddos detection and propose a triggered, multi-stage approach that addresses both scalability and accuracy. our contribution is the design and implementation of lads (large-scale automated ddos detection system). the attractiveness of this system lies in the fact that it makes use of data that is readily available to an isp, namely, snmp and netflow feeds from routers, without dependence on proprietary hardware solutions. we report our experiences using lads to detect ddos attacks in a tier-1 isp.
smart: an integrated multi-action advisor for storage systems. the designers of clustered file systems, storage resource management software and storage virtualization devices are trying to provide the necessary planning functionality in their products to facilitate the invocation of the appropriate corrective actions in order to satisfy user specified service level objectives (slos). however, most existing approaches only perform planning for a single type of action such as workload throttling, or data migration, or addition of new resources. as will be shown in this paper, single action based plans are not always cost effective. in this paper we present a framework smart that considers multiple types of corrective actions in an integrated manner and generates a combined corrective action schedule. furthermore, often times, the best cost-effective schedule for a one-week lookahead could be different from the best cost-effective schedule for a one-year lookahead. an advantage of the smart framework is that it considers this lookahead time window in coming up with its corrective action schedules. finally, another key advantage of this framework is that it has a built-in mechanism to handle unexpected surges in workloads. we have implemented our framework and algorithm as part of a clustered file system and performed various experiments to show the benefits of our approach.
fast transparent migration for virtual machines. this paper describes the design and implementation of a system that uses virtual machine technology [1] to provide fast, transparent application migration. this is the first system that can migrate unmodified applications on unmodified mainstream intel x86-based operating system, including microsoft windows, linux, novell netware and others. neither the application nor any clients communicating with the application can tell that the application has been migrated. experimental measurements show that for a variety of workloads, application downtime caused by migration is less than a second.
analysis and evolution of journaling file systems. we develop and apply two new methods for analyzing file system behavior and evaluating file system changes. first, semantic block-level analysis (sba) combines knowledge of on-disk data structures with a trace of disk traffic to infer file system behavior; in contrast to standard benchmarking approaches, sba enables users to understand why the file system behaves as it does. second, semantic trace playback (stp) enables traces of disk traffic to be easily modified to represent changes in the file system implementation; in contrast to directly modifying the file system, stp enables users to rapidly gauge the benefits of new policies. we use sba to analyze linux ext3, reiserfs, jfs, and windows ntfs; in the process, we uncover many strengths and weaknesses of these journaling file systems. we also apply stp to evaluate several modifications to ext3, demonstrating the benefits of various optimizations without incurring the costs of a real implementation.
reclaiming network-wide visibility using ubiquitous endsystem monitors. network-centric tools like netflow and security systems like idses provide essential data about the availability, reliability, and security of network devices and applications. however, the increased use of encryption and tunnelling has reduced the visibility of monitoring applications into packet headers and payloads (e.g. 93% of traffic on our enterprise network is ipsec encapsulated). the result is the inability to collect the required information using network-only measurements. to regain the lost visibility we propose that measurement systems must themselves apply the end-to-end principle: only endsystems can correctly attach semantics to traffic they send and receive. we present such an end-to-end monitoring platform that ubiquitously records per-flow data and then we show that this approach is feasible and practical using data from our enterprise network.
making scheduling "cool": temperature-aware workload placement in data centers. trends towards consolidation and higher-density computing configurations make the problem of heat management one of the critical challenges in emerging data centers. conventional approaches to addressing this problem have focused at the facilities level to develop new cooling technologies or optimize the delivery of cooling. in contrast to these approaches, our paper explores an alternate dimension to address this problem, namely a systems-level solution to control the heat generation through temperature-aware workload placement. we first examine a theoretic thermodynamic formulation that uses information about steady state hot spots and cold spots in the data center and develop real-world scheduling algorithms. based on the insights from these results, we develop an alternate approach. our new approach leverages the non-intuitive observation that the source of cooling inefficiencies can often be in locations spatially uncorrelated with its manifested consequences; this enables additional energy savings. overall, our results demonstrate up to a factor of two reduction in annual data center cooling costs over location-agnostic workload distribution, purely through software optimizations without the need for any costly capital investment.
drive-thru: fast, accurate evaluation of storage power management. running traces of realistic user activity is an important step in evaluating storage power management. unfortunately, existing methodologies that replay traces as fast as possible on a live system cannot be used to evaluate timeout-based power management policies. other methodologies that slow down replay to preserve the recorded delays between operations are too time-consuming. we propose a hybrid approach, called drive-thru, that provides both accuracy and speed of evaluation by separating time-dependent and time-independent activity. we first synchronously replay file system activity on the target platform to create a base trace that captures the semantic relationship between file system activity and storage accesses. we then use the base trace as input to a simulator that can evaluate different disk, network, file cache, and file system power management policies. we use drive-thru to study the benefit of several recent proposals to reduce file system energy usage.
grave robbers from outer space: using 9p2000 under linux. this paper describes the implementation and use of the plan 9 distributed resource protocol 9p under the linux 2.6 operating system. the use of the 9p protocol along with the recent addition of private name spaces to the 2.6 kernel creates a foundation for seamless distributed computing using linux. we review the design principles and benefits of plan 9 distributed systems, go over the basics of the 9p protocol, describe 9p extensions to better support unix® file systems, and show some example linux distributed applications using 9p to provide system and application services. we conclude by providing a performance analysis of the protocol versus nfs for sharing a static file system.
addressing email loss with suremail: measurement, design, and evaluation. we consider the problem of silent email loss in the internet, where neither the sender nor the intended recipient is notified of the loss. our detailed measurement study over several months shows a silent email loss rate of 0.71% to 1.02%. the silent loss of an important email can impose a high cost on users. we further show that spam filtering can be the significant cause of silent email loss, but not the sole cause. suremail augments the existing smtp-based email infrastructure with a notification system to make intended recipients aware of email they are missing. a notification is a short, fixed-format fingerprint of an email, constructed so as to preserve sender and recipient privacy, and prevent spoofing by spammers. suremail is designed to be usable immediately by users without requiring the cooperation of their email providers, so it leaves the existing email infrastructure (including anti-spam infrastructure) untouched and does not require a pki for email users. it places minimal demands on users, by automating the tasks of generating, retrieving, and verifying notifications. it alerts users only when there is actual email loss. our prototype implementation demonstrates the effectiveness of suremail in notifying recipients upon email loss.
providing dynamic update in an operating system. dynamic update is a mechanism that allows software updates and patches to be applied to a running system without loss of service or down-time. operating systems would benefit from dynamic update, but place unique demands on any implementation of such features. these demands stem from the event-driven nature of operating systems, from their restricted run-time execution environment, and from their role in simultaneously servicing multiple clients. we have implemented a dynamic update mechanism in the k42 research operating system, and tested it using previous modifications of the system by kernel developers. our system supports updates changing both kernel code and data structures. in this paper we identify requirements needed to provide a dynamically updatable operating system, describe our implementation, and present our experiences in designing and using the dynamic update mechanism. we also discuss its applicability to other operating systems.
group ratio round-robin: o(1) proportional share scheduling for uniprocessor and multiprocessor systems. we present group ratio round-robin (gr3), the first proportional share scheduler that combines accurate proportional fairness scheduling behavior with o(1) scheduling overhead on both uniprocessor and multiprocessor systems. gr3 uses a simple grouping strategy to organize clients into groups of similar processor allocations which can be more easily scheduled. using this strategy, gr3 combines the benefits of low overhead round-robin execution with a novel ratio-based scheduling algorithm. gr3 introduces a novel frontlog mechanism and weight readjustment algorithm to operate effectively on multiprocessors. gr3 provides fairness within a constant factor of the ideal generalized processor sharing model for client weights with a fixed upper bound and preserves its fairness properties on multiprocessor systems. we have implemented gr3 in linux and measured its performance. our experimental results show that gr3 provides much lower scheduling overhead and much better scheduling accuracy than other schedulers commonly used in research and practice.
server network scalability and tcp offload. server network performance is increasingly dominated by poorly scaling operations such as i/o bus crossings, cache misses and interrupts. their overhead prevents performance from scaling even with increased cpu, link or i/o bus bandwidths. these operations can be reduced by redesigning the host/adapter interface to exploit additional processing on the adapter. offloading processing to the adapter is bene cial not only because it allows more cycles to be applied but also of the changes it enables in the host/adapter interface. as opposed to other approaches such as rdma, tcp offload provides benets without requiring changes to either the transport protocol or api. we have designed a new host/adapter interface that exploits offloaded processing to reduce poorly scaling operations. we have implemented a prototype of the design including both host and adapter software components. experimental evaluation with simple network benchmarks indicates our design significantly reduces i/o bus crossings and holds promise to reduce other poorly scaling operations as well.
attrition defenses for a peer-to-peer digital preservation system. in peer-to-peer systems, attrition attacks include both traditional, network-level denial of service attacks as well as application-level attacks in which malign peers conspire to waste loyal peers' resources. we describe several defenses for the lockss peer-to-peer digital preservation system that help ensure that application-level attrition attacks even from powerful adversaries are less effective than simple network-level attacks, and that network-level attacks must be intense, widespread, and prolonged to impair the system.