Vicraj T. Thomas

Information modeling for intrusion report aggregation

The paper describes the SCYLLARUS approach to fusing reports from multiple intrusion detection systems (ID-Ses) to provide an overall approach to intrusion situation awareness. The overall view provided by SCYLLARUS centers around the sites security goals, aggregating large numbers of individual IDS reports based on their impact. The overall view reduces information overload by aggregating multiple IDS reports in a rep-down view; and by reducing false positives by weighing evidence provided by multiple ID-Ses and other information sources. Unlike previous efforts in this area, SCYLLARUS is centered around its intrusion reference model (IRM). The SCYLLARUS IRM contains both dynamic and static (configuration) information. A network entity/relationship database (NERD), providing information about the sites hardware and software; a security goal database, describing the sites objectives and security policy; and an event dictionary, describing important events, both intrusions and benign; comprise the static portion of the IRM. The set of IDS reports; the events SCYLLARUS hypothesizes to explain them; and the resulting judgment of the state of site security goals comprise the dynamic part of the IRM.

Programming language support for writing fault-tolerant distributed software

Good programming language support can simplify the task of writing fault-tolerant distributed software. Here, an approach to providing such support is described in which a general high-level distributed programming language is augmented with mechanisms for fault tolerance. Unlike approaches based on sequential languages or specialized languages oriented towards a given fault-tolerance technique, this approach gives the programmer a high level of abstraction, while still maintaining flexibility and execution efficiency. The paper first describes a programming model that captures the important characteristics that should be supported by a programming language of this type. It then presents a realization of this approach in the form of FT-SR, a programming language that augments the SR distributed programming language with features for replication, recovery, and failure notification. In addition to outlining these extensions, an example program consisting of a data manager and its associated stable storage is given. Finally, an implementation of the language that uses the x-kernel and runs standalone on a network of Sun workstations is discussed. The overall structure and several of the algorithms used in the runtime are interesting in their own right. >

Resource scavenging in object-oriented, real-time, fault-tolerant control systems

This paper presents a variety of resource management techniques for real-time, fault-tolerant control systems. These techniques are based on resource scavenging, a concept that is introduced in this paper. Resource scavenging techniques attempt to meet transient resource shortfalls in one part of the system by reassigning resources from other parts of the system. The techniques presented take advantage of properties of real-time, fault-tolerant systems in general and some specific properties of control applications. At the same time, the techniques are constrained by control related requirements of the applications. The specific properties of a control application and its requirements are communicated to the system infrastructure entirely in terms of control concepts. Such a system infrastructure is also described in the paper. Finally, the paper proposes an extension to the programming language C++ that will simplify the development of applications that take advantage of resource scavenging techniques.

An open software architecture for high-integrity and high-availability avionics

We describe a software architecture that can greatly reduce re-certification costs associated with the re-hosting of avionics applications from one platform to another. This is achieved by (1) enabling the development of core application components independent of platform specific concerns related to I/O and fault-tolerance, (2) defining abstractions of platform I/O and fault-tolerance strategies for use by application components, and (3) providing transforms that enable system integrators to build a system with its specific I/O and fault-tolerance requirements using platform-independent application components. Application component and transform source code (and in many cases, binaries) can be moved from one platform to another without the need for modification. The system configuration and any new transforms developed still need to be recertified. The I/O abstractions defined by the architecture are key to enable the development of platform independent application components. Inputs to components are simple values (signals) with attributes such as refresh rate and units. On different platforms, these values may be generated at different rates, in different units, and in different ways (by combining values from multiple sources, produced by a fail-stop source, etc.). Transforms mask these platform differences from application components. Similarly, differences in component output attributes and those required by the platform are handled by transforms. The architecture makes provision for application specific built-in-tests, fault-detectors, and reconfiguration strategies. Again, these are specified and implemented independent of core application functionality, allowing application components to be moved across platforms with different fault-tolerance strategies. A software framework based on this architecture has been implemented and demonstrated using an FMS-like application. Core application functionality was implemented as components and packaged as shared libraries. Multiple I/O and redundancy schemes were then constructed using these application modules by changing only the configuration. This demonstrated the feasibility of developing application components in a platform independent manner and configuring them for different platforms.

FT-Java: A Java-Based Framework for Fault-Tolerant Distributed Software

FT-Java: is a Java language based framework for building fault-tolerant distributed software. It is designed to bring to the system programmer much of the flexibility provided by reflective languages and systems without the attendant difficulties of reasoning about correct system structure. FT-Java: achieves this by providing the programmer an extremely flexible programming model with sufficient structure to enable reasoning about the system. The FT-Java: framework in turn uses the power of reflection to implement the programming model.

Language Support for Fault-Tolerant Parallel and Distributed Programming

Most high-level programming languages contain little support for programming multicomputer programs that must continue to execute despite failures in the underlying computing platform. This paper describes two projects that address this problem by providing features specifically designed for fault-tolerance. The first is FT-Linda, a version of the Linda coordination language for writing fault-tolerant parallel programs. Major enhancements include stable tuple spaces whose contents survive failure and atomic execution of collections of tuple space operations. The second is FT-SR, a language based on the existing SR distributed programming language. Major features include support for transparent module replication, ordered group communication, automatic recovery and failure notification. Prototype versions of both languages have been implemented.

Failure notifications: a useful extension to the object programming model

Object oriented system design and development methods have proven useful in building large and complex systems. Since real time, dependable systems tend to be large and complex systems it is natural to use object oriented methods for building such systems. Unfortunately, the object oriented programming paradigm and the languages that support it were not designed with real time or fault tolerant system in mind. It is therefore important to look at ways in which the object model can be extended to simplify the construction of real time, fault tolerant systems. The paper proposes extending the object model to include failure notifications. A case is made for the need for such failure notifications and the advantages of having such notifications.

Ten practical techniques for high assurance systems engineering

This paper presents ten practical techniques that help engineer complex systems that have stringent dependability and real-time requirements. The techniques described are software centric but in most cases they apply to systems as a whole.