Alper K. Caglayan

An experimental evaluation of software redundancy as a strategy for improving reliability

The strategy of using multiple versions of independently developed software as a means to tolerate residual software design faults is discussed. The effectiveness of multiversion software is studied by comparing estimates of the failure probabilities of these systems with the failure probabilities of single versions. The estimates are obtained under a model of dependent failures and compared with estimates obtained when failures are assumed to be independent. The experimental results are based on 20 versions of an aerospace application developed and independently validated by 60 programmers from 4 universities. Descriptions of the application and development process are given, together with an analysis of the 20 versions. >

A theoretical investigation of generalized voters for redundant systems

The authors generalize several commonly used voting techniques to arbitrary N-version systems with arbitrary output types using a metric space framework. In particular, they introduce the generalized median voter, which extends the thresholdless midvalue selection technique to arbitrary metric spaces and obviates most of the problems associated with inexact voting. They also introduce the formalized majority voter, which allows an inexact notion of equality between version outputs using a threshold. The authors then show that the median output determined by the generalized median voter will always be contained in the set of consensus outputs produced by the formalized majority voter. In addition, the authors introduce the formalized plurality voter which generalizes two-out-of-N type voters and the weighted averaging voter which generalizes dynamic voting. The performance of these voters under different postulated failure scenarios is compared.<<ETX>>

Real-Time Detection of Fast Flux Service Networks

Here we present the first empirical study of detecting and classifying fast flux service networks (FFSNs) in real time. FFSNs exploit a network of compromised machines (zombies) for illegal activities such as spam, phishing and malware delivery using DNS record manipulation techniques. Previous studies have focused on actively monitoring these activities over a large window (days, months) to detect such FFSNs and measure their footprint. In this paper, we present a Fast Flux Monitor (FFM) that can detect and classify a FFSN in the order of minutes using both active and passive DNS monitoring, which complements long term surveillance of FFSNs.

A large scale second generation experiment in multi-version software: description and early results

The second-generation experiment is a large-scale empirical study of the development and operation of multiversion software systems that has engaged researchers at five universities and three research institutes. The authors present the history and current status of this experiment. The primary objective for the second generation experiments is an examination of multiple-version reliability improvement. Experimentation concerns have been focused on the development of multiversion software (MVS) systems, primarily design and testing issues, and the modeling and analysis of these systems. A preliminary analysis of the multiple software versions has been performed and is reported.<<ETX>>

Learn sesame a learning agent engine

Open Sesame! 1.0-released in 1993-was the worlds first commercial user interface learning agent. The development of this agent involved a number of decisions about basic design issues that had not been previously addressed, including the expected types of agents and the preferred form and frequency of interaction. In the 2 years after shipping Open Sesame! 1.0, we have compiled a rich database of customer feedback. Many of our design choices have been validated by the general approval of our customers, while some were not received as favorably. Thanks to the overwhelming amount of feedback, we were able to substantially improve the design for Open Sesame! 2.0 and develop a cross-platform learning engine-Learn Sesame-that can be used to add learning agent functionality to any third-party application. In this article, we present a summary of the lessons learned from customer feedback, an outline of resulting design changes, the details of the developed learning agent engine, and planned research.

Analysis of faults detected in a large-scale multi-version software development experiment

In a multiversion software experiment, twenty programs were built to the same specification of an inertial navigation problem. The programs were then subjected to a three-phase testing and debugging process: an acceptance test, a certification test, and an operational test. Less than 20% of the faults discovered during the certification and operational testing were nonunique, i.e. the same or very similar faults would be found in more than one program. However, some of these common faults spanned as many as half of the versions. Faults discovered during the certification testing were due to specification errors and ambiguities, inadequate programmer background knowledge, insufficient programming experience, incomplete analysis, and insufficient acceptance testing. Faults discovered during the operational testing were of a more subtle nature, and were mostly due to various programmer knowledge defects and incomplete analysis errors. Techniques that might have prevented the observed faults are discussed.<<ETX>>

Behavioral analysis of botnets for threat intelligence

This paper examines the behavioral patterns of fast-flux botnets for threat intelligence. The Threat Intelligence infrastructure, which we have specifically developed for fast-flux botnet detection and monitoring, enables this analysis. Cyber criminals and attackers use botnets to conduct a wide range of operations including spam campaigns, phishing scams, malware delivery, denial of service attacks, and click fraud. The most advanced botnet operators use fast-flux infrastructure and DNS record manipulation techniques to make their networks more stealthy, scalable, and resilient. Our analysis shows that such networks share common lifecycle characteristics, and form clusters based on size, growth and type of malicious behavior. We introduce a social network connectivity metric, and show that command and control and malware botnets have similar scores with this metric while spam and phishing botnets have similar scores. We describe how a Guilt-by-Association approach and connectivity metric can be used to predict membership in particular botnet families. Finally, we discuss the intelligence utility of fast-flux botnet behavior analysis as a cyber defense tool against advanced persistent threats.

An experimental investigation of software diversity in a fault-tolerant avionics application

Highly reliable and effective failure detection and isolation (FDI) software is crucial in modern avionics systems that tolerate hardware failures in real time. The FDI function is an excellent opportunity for applying the principal of software design diversity to the fullest, i.e., algorithm diversity, in order to provide gains in functional performance as well as potentially enhancing the reliability of the software. The authors examine algorithm diversity applied to the redundancy management software for a hardware fault-tolerant sensor array. Results of an experiment are presented that show the performance gains that can be provided by utilizing the consensus of three diverse algorithms for sensor FDI.<<ETX>>

Automatic target recognition in laser radar imagery

This paper presents an automatic target recognition (ATR) system for laser radar (LADAR) imagery, designed to classify objects at multiple levels of discrimination (target detection, classification, and recognition) from single LADAR images. Segmentation is performed in both the range and non-range LADAR channels and results combined to increase object detection rate or decrease false positive detection rate. Through use of the range data, object subimages are projected and rotated to canonical orientations, providing invariance to translation, scale and rotations in 3-D. Global features are extracted for rapid target detection and local receptive field features are computed for target recognition 100% detection and recognition rates are shown for a small set of real LADAR data.

Increasing agent autonomy in dynamic environments

1. ABSTRACT In this paper, we present an event based agent architecture for increased agent autonomy in dynamic environments. Our approach is based on an event description language called MDL that has been developed to facilitate application modeling by associating events with concepts such as objects and attributes. Events can model a wide variety of real-world scenarios ranging from database transactions to user interactions. Our architecture employs a novel learning service for the integration of event sequences to produce facts about the environment for increased agent autonomy. This generic architccturc has been successfully instantiated in a number of research and commercial application domains of which the following two arc described in this paper: 1) A spacecraft data analysis agent that identifies recurring patterns within spacecraft telemetry data to characterize normal spacecraft operations, 2) A Macintosh desktop interface agent that finds repetitive user patterns by observing user actions in the background and automating upon approval. 1.1