Recent coe_cs items

Generalizing Tanglegrams

Mon, 30 Jul 2018 00:00:00 +0000

Tanglegrams are a tool to infer joint evolution of species. Tanglegrams are widely used in ecology to study joint evolution history of parasitic or symbiotically linked species. Visually, a tanglegram is a pair of evolutionary trees drawn with the leaves facing at each other. One species at the leaf of one trees is related ecologically to a species at a leaf of another tree. Related species from the two trees are connected by an edge. The number of crossings between the edges joining the leaves indicate the relatedness of the trees. Earlier work on tanglegrams considered the same number of leaves on both the trees and one edge between the leaves of the two trees. In this paper we consider multiple edges from a leaf in the trees. These edges correspond to ecological events like duplication, host switching etc. We generalize the definition of tanglegrams to admit multiple edges between the leaves. We show integer programs for optimizing the number of crossings. The integer...

Applying Machine Learning to Identify NUMA End-System Bottlenecks for Network I/O

Tue, 3 Jul 2018 00:00:00 +0000

Performance bottlenecks across distributed nodes, such as in high performance computing grids or cloud computing, have raised concerns about the use of Non-Uniform Memory Access (NUMA) processors and high-speed commodity interconnects. Performance engineering studies have investigated this with varying degrees of success. However, with continuous evolution in end-system hardware, along with changes in the Linux networking stack, this study has become increasingly complex and difficult due to the many tightly-coupled performance tuning parameters involved. In response to this, we present the Networked End- System Characterization and Adaptive Tuning tool, or NESCAT, a partially automated performance engineering tool that uses machine learning to study high-speed network connectivity within end-systems. NESCAT exploits several novel techniques for systems performance engineering. These include using k-means clustering and Artificial Neural Networks (ANNs) to effectively learn and...

Parametrization and Effectiveness of Moving Target Defense Security Protections for Industrial Control Systems

Tue, 13 Mar 2018 00:00:00 +0000

Critical infrastructure systems continue to foster predictable communication patterns and static configurations over extended periods of time. The static nature of these systems eases the process of gathering reconnaissance information that can be used to design, develop, and launch attacks by adversaries. In this research effort, the early phases of an attack vector will be disrupted by randomizing application port numbers, IP addresses, and communication paths dynamically through the use of overlay networks within Industrial Control Systems (ICS). These protective measures convert static systems into "moving targets," adding an additional layer of defense. Moving Target Defense (MTD) is an active area of research that periodically changes the attack surface of a system to create uncertainty and increase the workload for an adversary. To assess the effectiveness of MTD strategies within an ICS environment, performance metrics have been captured to quantify the impacts introduced...

Parametrization and Effectiveness of Moving Target Defense Security Protections within Industrial Control Systems

Tue, 13 Mar 2018 00:00:00 +0000

Critical infrastructure systems continue to foster predictable communication patterns and static configurations over extended periods of time. The static nature of these systems ease the process of gathering reconnaissance information that can be used to design, develop and launch attacks by adversaries. In this research effort, the early phases of an attack vector will be disrupted by randomizing port numbers, IP addresses, and communication paths dynamically through the use of overlay networks. These protective measures convert static systems into "moving targets," adding an additional layer of defense. Moving Target Defense (MTD) is an active area of research that periodically changes the attack surface of a system to create uncertainty and increase the workload for an adversary. To assess the effectiveness of MTD strategies within a critical infrastructure environment, performance metrics have been captured to quantify the impacts introduced to the opera- tional network...

Modeling Systems Using Side Channel Information

Tue, 13 Mar 2018 00:00:00 +0000

Side channel analysis is the process of examining information leaked by a computing device during use, and leveraging such data to make inferences about various aspects of the system. Historically, side channels have been exploited for malicious purposes, from inferring sensitive data to infringing on the privacy of users. For example, power consumption has been exploited to reveal secret cryptographic keys, and features of wireless network traffic have been leveraged to reveal web browsing activity of a user. The goal of this dissertation is not only to explore the potential of using side channels to determine what types of activity a computing system is engaged in but also study the relationship between the operations performed by the system and the side channel.

In this dissertation we present two key concepts: the application of side channel analysis for security and privacy purposes, particularly for monitoring systems, and the development of a model for defining...

Leveraging Security Metrics to Enhance System and Network Resilience

Fri, 18 Aug 2017 00:00:00 +0000

Resilience is a relatively new concept in computer security that is continuing to evolve. The research community has not settled on an exact definition for resilience, but most agree that this security property should include resistence to attack, damage recovery, and the ability for a system to learn and better resist such an attack in the future. Much of the existing research has focused on resilience solely in terms of availability, or in defining metrics to describe and compare the resilience of systems. The goal of this dissertation is to not only explore the possibility of a more general framework for resilience, but to also analyze the effectiveness of methods and technologies that can be used to measure and provide resilience.

The dissertation begins by covering common elements of computer security, providing exam- ples, addressing vulnerabilities and exploits, and suggesting potential solutions. In later sections, we examine the feasibility of the proposed solutions....

Technology, Training, and Transformation

Thu, 6 Jul 2017 00:00:00 +0000

As advances in technology transform society, so must it transform how people interact with that technology. However, technology advances much faster than do society and people. Most people don't care how the technology works--they care only that it does work. Current models are unsatisfactory because people must understand more of the underlying technology than is needed to perform their jobs. The view of this evolution explored here proposes that the training and maintenance will rest in the hands of the vendors and service personnel and not the average user. Perhaps this is heretical, given the proposals for improved "security awareness" and similar educational programs.

A Clinic for "Secure" Programming

Thu, 6 Jul 2017 00:00:00 +0000

In this paper, the author mentions that despite the reliance on software in everything from televisions and cars to medical equipment, it often doesn't work correctly. Everyone has had problems with software like text editors that freeze, answering machines that won't answer. Others are far more serious, such as the program on a satellite that contains an error, causing the loss of expensive equipment, or Web servers that have bugs enabling an attacker to break in and steal personal data. In the case of medical equipment, poor software could cost lives. To develop a better software, one way is to make good programming as much a part of learning computer science as good writing is a part of studying English and law. To test this idea, a secure-programming clinic was developed. Principles of robust programming are widely taught in beginning and advanced programming courses. They're a large part of good programming style and require the realization that things can go wrong. A user...

Multi-Stage Delivery of Malware

Mon, 3 Jul 2017 00:00:00 +0000

Malware signature detectors use patterns of bytes, or variations of patterns of bytes, to detect malware attempting to enter a systems. This approach assumes the signatures are both or sufficient length to identify the malware, and to distinguish it from non-malware objects entering the system. We describe a technique that can increase the difficulty of both to an arbitrary degree. This technique can exploit an optimization that many anti-virus systems use to make inserting the malware simple; fortunately, this particular exploit is easy to detect, provided the optimization is not present. We describe some experiments to test the effectiveness of this technique in evading existing signature-based malware detectors.

Demythifying Cybersecurity

Mon, 3 Jul 2017 00:00:00 +0000

A large part of computer security education is tackling myths that support much of the practice in the field. By examining these myths and the underlying truths or heuristics they reflect, we learn three things. First, students and practitioners learn to separate what is empirically and theoretically supported from what is supported solely by untested anecdotes or handed-down "best practices." Second, a key part of education is the human dimension of convincing others that stories that sound right aren't proven and might in fact be wrong. They aren't necessarily wrong-but this possibility must be considered. Finally, we can consider myths from the perspective of teaching stories, because many evolve from activities that at one time were true or that have some accurate elements.

Antimalware Software: Do We Measure Resilience?

Tue, 4 Apr 2017 00:00:00 +0000

Antimalware Software: Do We Measure Resilience?

Insider Attack Identification and Prevention Using a Declarative Approach

Tue, 4 Apr 2017 00:00:00 +0000

Insider Attack Identification and Prevention Using a Declarative Approach

Caution: Danger Ahead (with Big Data)

Tue, 4 Apr 2017 00:00:00 +0000

Caution: Danger Ahead (with Big Data)

Map navigation app with social posting

Thu, 17 Nov 2016 00:00:00 +0000

Map navigation app with social posting

NetSage: Open Privacy-Aware Network Measurement, Analysis, And Visualization Service

Fri, 5 Aug 2016 00:00:00 +0000

NetSage is a project to develop a unified open, privacy-aware network measurement, and visualization service to address the needs of today’s international networks. Modern science is increasingly data-driven and collaborative in nature, producing petabytes of data that can be shared by tens to thousands of scientists all over the world. The National Science, Foundation-supported International Research Network Connections (IRNC) links, have been essential to performing these science experiments. Recent deployment of Science DMZs [Dart, E. et al., 2013], both in the US and other countries, is starting to raise expectations for data throughput performance for wide-area data transfers. New capabilities to measure and analyze the capacity of international wide-area networks are essential to ensure end-users are able to take full advantage of such infrastructure.

NetSage will provide the network engineering community, both US domestic and international, with a suite of tools...

Security Analysis of Scantegrity, an Electronic Voting System

Thu, 7 Jul 2016 00:00:00 +0000

Electronic voting machines are becoming an increasingly popular alternative to paper ballots. With this increase in use we must analyze how well these machines adhere to voting requirements, including those relating to security, privacy, and anonymity. This paper includes analysis of the security and auditing mechanisms of the open-source electronic voting system Scantegrity. We focus on Scantegrity, not to single it out as a vulnerable system, but because it is a popular system that has actually been used in practice. It may contain design flaws and vulnerabilities that might exist in other systems of similar designs, current or future. Therefore, it is our hope that the vulnerabilities that we bring to light will be considered by current and future designers of electronic voting systems, and that the solutions that we propose will also be considered as possible remediations.

Distributed Helios - Mitigating Denial of Service Attacks in Online Voting

Wed, 30 Mar 2016 00:00:00 +0000

One of many major issues that plagues Internet voting is the potential for a distributed denial of service attack on the voting servers. These denial of service attacks are harmful because they block voting during the downtime. In addition, most current online voting protocols are centralized with only one voting server, making such an attack likely to disenfranchise some voters. The question is how to combat these attacks. One solution is to distribute the servers in a parallel manner, so in case one server goes down, the others can still provide service to voters. Whereas many online voting systems assume the constant availability of the voting infrastructure, we focus on the event that a server becomes unavailable. We extend a previously established online voting protocol, Helios, by adding multiserver capability. These servers communicate using the Paxos protocol, an algorithm for fault tolerant distributed environments. An analysis of this solution concludes that a multi-server...

CSE-92-18 - An Evaluation of Feature Selection Methodsand Their Application to Computer Security

Thu, 14 May 2015 00:00:00 +0000

University of California Davis, Department of Computer Science, Report number CSE-92-18

Dynamic, Flexible, and Optimistic Access Control

Fri, 13 Mar 2015 00:00:00 +0000

Traditional access controls have evolved from being static and coarse-grained to being dynamic and very fine-grained. However, a balance still must be struck: too little access inhibits usefulness, effectively creating a denial of service for people trying to do their jobs; and too much access invites breaches of security. "Break-the-glass" techniques and adaptive access control have previously been developed to address this issue. But gaps in these techniques still exist. We extend these techniques as follows: consider a system in which prohibitions fall into two classes. Core prohibitions prevent disaster, and are axiomatic to the system. Ancillary prohibitions, derived from core prohibitions, hinder the ability of an attacker to violate core prohibitions, but are not in and of themselves critical to the security of the system. We introduce optimistic access control, a framework in which core prohibitions are always enforced, and ancillary prohibitions are enforced...

Summit on Education in Secure Software Final Report

Mon, 16 Feb 2015 00:00:00 +0000

Summit on Education in Secure Software Final Report

Lightweight Change Detection and Response Inspired by Biological Systems

Fri, 5 Dec 2014 00:00:00 +0000

The state of computer security is complex. With computers taking multiple forms including such lightweight devices as smartphones and virtual machines and then connecting these devices to the open Internet, the task of securing devices become harder. To attempt to provide protection from threats it is a common practice to install Security Event Monitors. In this thesis, we present a lightweight host-based security event monitoring and response system called the Hive Mind that is designed to enable coordination among participating nodes for improved detection combined with reduced resource usage. We also present a model for automatic response in such lightweight systems. The Hive Mind is a host-based security event monitor (SEM), a system that monitors intermittently for potential threats and indirectly communicates the existence of a problem to other nodes using a stigmergic approach inspired from biological systems. When we apply the system on example scenarios, the results demonstrate...

What Do Firewalls Protect?An Empirical Study of Firewalls, Vulnerabilities, and Attacks

Thu, 6 Nov 2014 00:00:00 +0000

Firewalls are a cornerstone of how sites implement "defense in depth." Many security policies assume that outside attackers must first penetrate a firewall configured to block their access. This paper examines what firewalls protect against, and whether those protections are sufficient to warrant placing the current level of trust in firewalls.

Your Security Policy is What??

Thu, 6 Nov 2014 00:00:00 +0000

Your Security Policy is What??

Systems and infrastructure rarely enforce a site’s security policy precisely. Conversely, determining the policy (or policy components) that the systems and infrastructure do enforce is difficult because of the plethora of configuration files and systems at the site. We propose a way to unify these problems by applying a bi-directional method of enforcing and reverse-engineering system and infrastructure policy. The process uses a platform-independent intermediate policy representation (IPR) to bridge the gap between a high-level expression of policy and a machine-dependent, system configuration. The result of these methods, shown along with a detailed example, is that both policy discovery and enforcement can be made into a much more rigorous process.

Resolving the Unexpected in Elections: Election Officials' Options

Thu, 6 Nov 2014 00:00:00 +0000

This paper seeks to assist election officials and their lawyers in effectively handling the technical issues that can be difficult to understand and analyze, allowing them to protect themselves and the public interest from unfair accusations, inaccuracies in results, and conspiracy theories. The paper helps to empower officials to recognize which types of voting system events and indicators need a more structured analysis and what steps to take to set up the evaluations (or forensic assessments) using computer experts.

A Pade Approximate Linearization for Solving the Quadratic Eigenvalue Problem with Low-Rank Damping

Mon, 30 Jun 2014 00:00:00 +0000

A Pade Approximate Linearization for Solving the Quadratic Eigenvalue Problem with Low-Rank Damping

The Hive Mind: Applying a Distributed Security Sensor Network to GENI- GENI Spiral 2 Final Project Report

Tue, 24 Jun 2014 00:00:00 +0000

The Hive Mind: Applying a Distributed Security Sensor Network to GENI- GENI Spiral 2 Final Project Report

Extracting and visualizing topological information from large high-dimensional data sets

Thu, 8 May 2014 00:00:00 +0000

Extracting and visualizing topological information from large high-dimensional data sets

Evolution vs. Intelligent Design in Program Patching

Tue, 29 Apr 2014 00:00:00 +0000

Evolution vs. Intelligent Design in Program Patching