 |
 |
1 Sushil Jajodia
Professor of Information Technology and the director of Center for Secure Information Systems at the George Mason University, USA
RULE-BASED TOPOLOGICAL VULNERABILITY ANALYSIS (abstract)
2 David Nicol
Ph.D., Prof. of Electrical and Computer Engineering, University of Illinois at Urbana-Champaign, Coordinated Science Laboratory, USA
MODELS AND ANALYSIS OF ACTIVE WORM DEFENSE (abstract)
3 Ming-Yuh Huang
The Boeing Company, USA
CRITICAL INFORMATION ASSURANCE ISSUES AND DIRECTIONS FOR MODERN LARGE-SCALE INFRASTRUCTURES (abstract)
4 Douglas Summerville
Ph.D., Associate Professor, State University of New York at Binghamton, USA
PREVENTION OF INFORMATION ATTACKS BY RUN-TIME DETECTION OF SELF-REPLICATION IN COMPUTER CODES (abstract)
5 Naranker Dulay
Ph.D., Department of Computing, Imperial College London, UK
SELF-MANAGED CELLS FOR UBIQUITOUS SYSTEMS (abstract)
Sushil Jajodia
Professor of Information Technology and the director of Center for Secure Information Systems at the George Mason University, USA
RULE-BASED TOPOLOGICAL VULNERABILITY ANALYSIS
Abstract. Attack graphs represent known attack sequences that attackers can use to penetrate computer networks. Recently, many researchers have proposed techniques for automatically generating attack graphs for a given computer network. These techniques either use model checkers to generate attack graphs and suffer from scalability problems, or they are based on an assumption of monotonicity and are unable to represent real-world situations. In this paper, we present a vulnerability analysis technique that is more scalable than model-checker-based solutions and more expressive than monotonicity-based solutions. We represent individual attacks as the transition rules of a rule-based system. We define noninterfering rulesets and present efficient, scalable algorithms for those sets. We then consider arbitrary nonmonotonic rulesets and present a series of optimizations which permit us to perform vulnerability assessment efficiently in most practical cases. We motivate the issues and illustrate our techniques using a substantial example.
 |
Sushil Jajodia is BDM International Professor of Information Technology and the director of Center for Secure Information Systems at the George Mason University, Fairfax, Virginia. He served as the chair of the Department of Information and Software Engineering during 1998-2002. He joined GMU after serving as the director of the Database and Expert Systems Program within the Division of Information, Robotics, and Intelligent Systems at the National Science Foundation. Before that he was the head of the Database and Distributed Systems Section in the Computer Science and Systems Branch at the Naval Research Laboratory, Washington and Associate Professor of Computer Science and Director of Graduate Studies at the University of Missouri, Columbia. He has also been a visiting professor at the University of Milan and University of Rome "La Sapienza", Italy and at the Isaac Newton Institute for Mathematical Sciences, Cambridge University, England. |
David Nicol
Ph.D., Prof. of Electrical and Computer Engineering, University of Illinois at Urbana-Champaign, Coordinated Science Laboratory, USA
MODELS AND ANALYSIS OF ACTIVE WORM DEFENSE
Abstract. The recent proliferation of Internet worms has raised questions about defensive measures. To date most techniques proposed are passive, in-so-far as they attempt to block or slow a worm, or detect and filter it. Active defenses take the battle to the worm---trying to eliminate or isolate infected hosts, and/or automatically and actively patch susceptible but as-yet-uninfected hosts, without the knowledge of the host's owner. In this paper we model the behavior and effectiveness of different active worm defenses. Using a discrete stochastic model we prove that these approaches can be strongly ordered in terms of their worm-fighting capability. Using a continuous model we consider effectiveness in terms of the number of hosts that are protected from infection, the total network bandwidth consumed by the worms and the defenses, and the peak scanning rate the network endures while the worms and defenses battle. We develop optimality results, and quantitative bounds on defense performance. Our work lays a mathematical foundation for further work in analysis of active worm defense.
 |
David M. Nicol is Professor of Electrical and Computer Engineering at the University of Illinois, Urbana-Champaign, and member of the Coordinated Sciences Laboratory. He is co-author of the textbook "Discrete-Event Systems Simulation", and served as Editor-in-Chief at ACM TOMACS from 1997-2003. He is the General Chair of the 2004 Conference on Principles of Advanced and Distributed Simulation, and the General Chair of the 2006 Winter Simulation Conference. From 1996-2003 he was Professor of Computer Science at Dartmouth College, where he served as department chair, and at the Institute for Security Technology Studies served as Associate Director for Research and Development, and finally as Acting Director. From 1987-1996 he was on the faculty of the Computer Science department at the College of William and Mary; 1985-1987 he was a staff scientist at the Institute for Computer Applications in Science and Engineering. He has a B.A. in mathematics from Carleton College (1979), an M.S. (1983) and Ph.D. (1985) in computer science from the University of Virginia. His research interests are in high performance computing, performance analysis, simulation and modeling, and network security. He is a Fellow of the IEEE. |
Ming-Yuh Huang
The Boeing Company, USA
CRITICAL INFORMATION ASSURANCE ISSUES AND DIRECTIONS FOR MODERN LARGE-SCALE INFRASTRUCTURES
Abstract. Today's information assurance (IA) is no longer about keeping people out. It's about letting people in - the right people, securely, to the right place. In modern military and commercial systems, partners, suppliers, and customers are all constantly accessing the infrastructure through the network. Once there, each needs to be taken directly to the appropriate data and resources. Secure and efficient access control in this context lays the foundation of next-generation business paradigm shift. Such new paradigms create new revenues and increase operation efficiency. Those who fail to make the transition are bound to face daunting challenges in competition. IA is an enabler. It is vital piece that allows the paradigm shift to take place. This is a new but realistic way to look at security.
 |
Mr. Ming-Yuh Huang is a Boeing Associate Technical Fellow responsible for leading Boeing's corporate Information Assurance R&D program that supports many large-scale commercial/military programs as well Boeing's own, one of world's largest, corporate infrastructures. Before joining Boeing in 1990, Mr. Huang worked at DEC Artificial Intelligence Technology R&D Center in Boston as a Principal Researcher leading DEC's intrusion detection expert-system research effort ESSENSE (Expert System for Service Network Security). ESSENSE resulted in one of world's first commercial intrusion detection product. Mr. Huang is recognized internationally as a pioneer of IDS (intrusion detection system) technology and a leader in the IT security. While with Boeing, Mr. Huang led DARPA intrusion detection research project, co-chaired premier international IDS conference RAID-1999 (International Symposium on Recent Advances in Intrusion Detection) at Purdue University, and was twice invited by EC (European Commission) to participate in defining EU/USA IT security R&D collaboration framework. Beside numerous conference/workshop publications and journal editorship, he also co-authored IETF (Internet Engineering Task Force) IDS communication protocol standard in collaboration with IBM R&D Lab and AFIWC (US Air Force Information Warfare Center). Mr. Huang has served as the keynote speaker for many European and Middle East IT security conferences. He was the Program Chair of 2004 NATO ARW (Advanced Research Workshop) "Cyberspace Security and Defense: Research Issues" in Gdansk, Poland - http://kio.eti.pg.gda.pl/arw2004/. He is also the General Chair of RAID-2005 in Seattle, Washington - http://www.conjungi.com/RAID/ and Program Chair of SADFE international digital forensic workshop in Taipei, Taiwan - http://conf.ncku.edu.tw/sadfe/index.htm. Mr. Huang has a B.S. in Physics, a M.S. in Computer Science, and (incomplete) study at University of Oregon Computer Science Ph.D. program. |
Douglas Summerville
Ph.D., Associate Professor, State University of New York at Binghamton, USA
PREVENTION OF INFORMATION ATTACKS BY RUN-TIME DETECTION OF SELF-REPLICATION IN COMPUTER CODES
Abstract. This paper describes a novel approach for preventative protection from both known and previously unknown malicious executable codes. It does not rely on screening the code for signatures of known viruses, but instead it detects attempts of the executable code in question to self-replicate during run time. Self-replication is the common feather of most malicious codes, allowing them to maximize their impact. This approach is an extension of the earlier developed method for detecting previously unknown viruses in script based computer codes. The paper presents a software tool implementing this technique for behavior-based run-time detection and suspension of self-replicating functionality in executable codes for Microsoft Windows operating systems.
 |
|
Naranker Dulay
Ph.D., Department of Computing, Imperial College London, UK
SELF-MANAGED CELLS FOR UBIQUITOUS SYSTEMS
Abstract. Amongst the challenges of ubiquitous computing is the need to provide management support for personal wireless devices and sensors. We introduce a policy-based architecture that supports management at varying levels based on the concept of a self-managed cell. Cells include policy-driven agents that support context-based and trust-based access control and system adaptation. Cells can also organize themselves through federation and nesting.
 |
Naranker Dulay is a senior lecturer in the Department of Computing, Imperial College London where he researches languages and architectures for policy, security, trust, privacy, and context-awareness in distributed, mobile and ubiquitous systems. Dr. Dulay is a co-investigator of research projects on Autonomic management of ubiquitous systems for e-Health (Amuse), Policy analysis for quality of service management (Paqman), Trust and contract management framework (Trustcom), Distributed adaptive security by programmable firewalls (Diadem), Urban design and pervasive systems (Cityware), Autonomous trust domains for healthcare applications (Caregrid), and Self-managed cells for autonomous vehicles. Dr Dulay has over 40 publications in international conferences and journals and has served on the program committees for many conferences. |
Copyright ©2004 Intelligent Systems Laboratory, SPIIRAS, All rights reserved.