Deborah A. Frincke

Analysis of an algorithm for distributed recognition and accountability

Computer and network systems are vulnerable to attacks. Abandoning the existing huge infrastructure of possibly-insecure computer and network systems is impossible, and replacing them by totally secure systems may not be feasible or cost effective. A common element in many attacks is that a single user will often attempt to intrude upon multiple resources throughout a network. Detecting the attack can become significantly easier by compiling and integrating evidence of such intrusion attempts across the network rather than attempting to assess the situation from the vantage point of only a single host. To solve this problem, we suggest an approach for distributed recognition and accountability (DRA), which consists of algorithms which “process”, at a central location, distributed and asynchronous “reports” generated by computers (or a subset thereof) throughout the network. Our highest-priority objectives are to observe ways by which an individual moves around in a network of computers, including changing user names to possibly hide his/her true identity, and to associate all activities of multiple instances of the same individual to the same networkwide user. We present the DRA algorithm and a sketch of its proof under an initial set of simplifying albeit realistic assumptions. Later, we relax these assumptions to accommodate pragmatic aspects such as missing or delayed “reports”, clock skew, tampered “reports”, etc. We believe that such algorithms will have widespread applications in the future, particularly in intrusion-detection systems.

A template for rapid prototyping of operating systems

Rapid prototyping of many classes of systems can be facilitated by starting from an executable template specification appropriate to that class. A system template serves several useful purposes. It organizes ones thinking about the particular system to be specified, and speeds the specification process by pre-specifying structures and operations common to all systems in a class. If executable, it can be developed into a system prototype. Though beyond the scope of this paper, it can organize proofs of properties of the specification and its implementations by making it possible to isolate the relevant proof obligations. The authors templates have an additional property: they classify sub-specifications according to kinds that needs to be completed differently. The authors illustrate rapid prototyping from a template for operating systems, specifically showing how to obtain a rapid prototype of the MINIX system. This approach may also be useful for other classes of systems, such as architectures.<<ETX>>

Towards survivable intrusion detection system

Intrusion detection systems (IDS) are increasingly a key part of system defense, often operating under a high level of privilege to achieve their purposes. Therefore, the ability of an IDS to withstand attack is important in a production system. In this paper, we address the issue of survivable IDS. We begin by categorizing potential vulnerabilities in a generic IDS and classifying methods used to enhance IDS survivability. We then propose an efficient fault tolerance based Survivable IDS (SIDS) along with a systematic way to transform an original IDS architecture into this survivable architecture. Key components of SIDS include: a dual-functionality forward-ahead (DFFA) structure, backup communication paths, component recycling, system reconfiguration, and an anomaly detector. Use of the SIDS transformation should result in an improvement in IDS survivability at low cost.

Formal specification and verification of graphical user interfaces

A technique for the fully formal specification and verification of graphical user interfaces is described. The technique is based on the algebraic specification of abstract datatypes. Both application program and user interface are defined in the same form, using equational axioms to specify formal semantics. The relationship between an application and its interface is defined using display axioms that specify the connection between abstract application operations and the corresponding operations of the interface. Using these display axioms, one can formally verify that an interface is correct with respect to the underlying application. In addition, the display axioms can be treated as a form of executable specification, used at runtime to maintain correspondence between the application program and its interface.<<ETX>>

Effectiveness of operating system prototyping from a template: application to MINIX

In a previous paper, M. Archer et al. (1990) presented a tool for the rapid prototyping of operating systems based on an executable template operating system specification. By extending the template specification, a designer can generate a rapid prototype of a specific operating system. The template specification consists of sorts (object classes) arranged in a hierarchy of three kinds, where the design decisions made in the template for each kind are in some sense more general than those made for its successor kind. The FASE (final algebra specification and execution) system language was used as the language for the specification. It is the authors belief that the SRM template is general enough to be used as a basis for rapid prototyping nearly any non-distributed operating system at the system call level. It is important to test this belief, and to show that the speed of prototype development and the execution speed of a rapid prototype are great enough for the development of a prototype to be useful for testing the properties of a design. The authors answer these questions, demonstrate the usefulness of having a rapid prototype of an operating system, and evaluate the template methodology in general.<<ETX>>

Meeting the Information Assurance Crisis in the U.S. Now

Abstract T he only difference etween evolution and revolution is the speed at which each occurs.

Techniques for secure system development

Computer security has become an increasingly important topic as societal reliance on computer systems grows. This minitrack is intended to address techniques for secure system development. Such techniques encompass both protocol development issues and assurance.

Creating and customizing reusable interface objects using stimulus response demonstration

The development of user interfaces has become easier with the advent of graphical layout systems. Such systems allow a developer to locate and size predefined interactive objects directly in the interface he is developing. However, the objects provided in graphical layout systems have restricted forms and behaviors. Thus, the developer has limited flexibility in the kinds of interfaces he can create. DEMO is a user interface development system (UIDS) that allows interface objects to be created from scratch. Using a drawing editor, the developer specifies the interactive behavior of the objects by stimulus-response demonstration. DEMO generalizes from the demonstrations, and automatically generates an implementation of the interface.<<ETX>>

An application of template methodology: rapid prototyping of user interface management systems

Probably the most important characteristic of a user interface is its look and feel. One can model the look and feel of user interfaces via rapid prototyping. However, the behavior of a particular user interface is greatly influenced by the particular user interface management system (UIMS) upon which it is built, so it is necessary to prototype an interface with regard to a particular user interface management system. Moving an application and its user interface to a different UIMS may result in a user interface that behaves in a substantially different manner. The authors describe a methodology that may be used to develop a UIMS prototype using a template. This template will assist developers not only in developing new UIMSs but in evaluating the behavior of user interfaces when the underlying UIMS changes.<<ETX>>

CTPLAN: A Planning-based Approach To Automatically Detecting Flaws In Concurrent Algorithms

Development of correct algorithms for the synchronization of concurrently executing processes can be a difficult task. Most concurrent program debuggers have been developed in order to assist, the programmer once an error has appeared. This paper takes an alternate approach of attempting to discover the presence of possibly undetected flaws. This approach is embodied in a prototype system (CTPLAN) that may be used to develop tests for common flaws in concurrent programs. To illustrate our methodology, CTPLAN has been used to detect errors in several algorithms, most notably the incorrect simplification of Dekkers algorithm described in [Hym66]. CTPLAN can in principle be used to detect indeterminacy, deadlock, livelock, violation of mutual exclusion, unfairness, and starvation.