46189778
Knowledge-Based Modeling and Simulation of Network Access Control Mechanisms Representing Security Policies
It is quite necessary that an organization's information network should be equipped with a proper security system based on its scale and importance. One of the effective methods is to use the simulation model for deciding which security policy and mechanism is appropriate for the complex network. Our goal is to build a foundation of knowledge-based modeling and simulation environment for the network security. Within this environment, users can construct the simulation model of security mechanisms, apply various security policies, and quantitatively analyze their security performance against possible attacks. In this study, we considered security domain and implemented the models based on a systematic modeling approach. We enabled the model to include knowledge in modular fashion and provided well-defined guidelines for transforming security policy to concrete rule set.
30809053
Vulnerability Assessment Simulation for Information Infrastructure Protection
The main contribution of this research is to present the method that make it possible to assess the vulnerability in the information infrastructure using simulation technology. To construct the vulnerability assessment simulation system, we make use of the knowledge-based simulation modeling methodology and we designed expressions to estimate the degree of vulnerability of host. Also, we show newly defined vulnerability analysis method that is applicable to vulnerability assessment simulation system. As research results, the vulnerability assessment simulation system and VDBFS(Vulnerability DataBase For Simulator) are constructed.
14176330
System Specification Based Network Modeling for Survivability Testing Simulation
As the structure and behavior of computer network becomes complicated and unpredictable, it becomes difficult to test the survivability of network. The modeling and simulation is a widely used approach to predict the behavior of system or set of system. In this research, we apply a modeling methodology to construct the valid model of computer network focusing on its vulnerability for survivability testing. To accomplish our aim, the appropriate modeling method should be defined. Especially, we take advantage of the system specification based modeling approach to construct valid network model.
47477578
DMKB : A Defense Mechanism Knowledge Base
The major cause of the internet incidents is the vulnerability, which is usually exploited by human attackers or worm virus. Thus the implementation of database on vulnerability is most valuable. If vulnerability is found newly, its information can be included in this database. The contemporary vulnerability databases, however, show weakness in describing countermeasures, although they are practically useful in removing or avoiding vulnerability. This comes from the lack of the analysis process on both semantics and patterns for countermeasures. In this paper, we defined the countermeasures in view of defense mechanism and suggested their representation schemes. In semantics, defense mechanisms can be classified into prevention, detection, recovery and tolerance. And they can be expressed in patterns as the composition of aim, condition, and action. Considering these features, we implemented a knowledge base on defense mechanism – DMKB. By using DMKB, users can get almost whole knowledge with keyword searching under GUI. Our DMKB can be utilized in automatic security testing and management for a given system.
26568006
Defense Mechanism for Information and Communication Infrastructure
701944
Simulation-Based Security Testing for Continuity of Essential Service
One of the most important characteristic of essential service in the computer network is its continuity. If the continuity of essential service is not guaranteed, it causes a big problem in normal operation of computer network. In our research, we suggest the simulation-based security testing for the continuity of essential service. Especially, the security testing sequence and Experimental Frame is designed to get indexes related to the continuity of essential service. We choose three testing indexes that represent the degree of service continuity and testing methods to get those indexes. Also, to explain the indexes and the testing methods, two testing examples are presented.
41825214
XKMS-Based Key Management for Open LBS in Web Services Environment
As the killer application of the wireless internet, the LBS (Location-based Services) has reconsidered technology about location determination technology, LBS middleware server for various application, and diverse contents processing technology. For this kind of LBS, the role of security service is very important in the LBS that store and manage the location information of mobile devices and support various application services using those location information. And in all phases of these functions that include acquisition of location information, storage and management of location information, user management including authentication and information security, and management of the large-capacity location information database, safe security service must be provided. This paper describes a key management architecture based on XML standards for securing access to location based information and services. The main characteristic of the approach is that it build on a number of XML-based standards.
13287397
An analysis of the performance impact of wrong-path memory references on out-of-order and runahead execution processors
High-performance, out-of-order execution processors spend a significant portion of their execution time on the incorrect program path even though they employ aggressive branch prediction algorithms. Although memory references generated on the wrong path do not change the architectural state of the processor, they affect the arrangement of data in the memory hierarchy. This paper examines the effects of wrong-path memory references on processor performance. It is shown that these references significantly affect the IPC (instructions per cycle) performance of a processor. Not modeling them leads to errors of up to 10 percent (4 percent on average) in IPC estimates for the SPEC CPU2000 integer benchmarks on an out-of-order processor and errors of up to 63 percent on a runahead-execution processor. In general, the error in the IPC increases with increasing memory latency and instruction window size. We find that wrong-path references are usually beneficial for performance because they prefetch data that is used by later correct-path references. L2 cache pollution is found to be the most significant negative effect of wrong-path references. Code examples are shown to provide insights into how wrong-path references affect performance. We also show that it is crucial to model wrong-path references to accurately estimate the performance improvement provided by runahead execution.
15684093
Efficient Authentication and Authorization of Mobile Users Based on Peer-to-Peer Network Mechanisms
This paper presents a peer-to-peer based authentication and authorization infrastructure to minimize authentication delays when mobile users roam across different wireless networks. The basic idea is to avoid exchanging security information between networks visited by a roaming user and the user's home authentication, authorization, and accounting (AAA) server that is typically located in the home network possibly far away from the visited network. Instead, authentication and authorization of a roaming user shall be supported by an AAA server in the visited network. We propose that the AAA server that is responsible for authentication and authorization in a newly visited network locates the AAA server in the previously visited network and retrieves the required security information from that AAA server. The AAA servers can be organized in a peer-to-peer manner and peer-to-peer mechanisms can be applied for searching and transferring security information between them. We propose several mechanisms for quickly locating the previously responsible AAA server in order to decrease authentication delays. The performance of these mechanisms is evaluated by simulations. Real performance measurements show the rather low performance overhead of application level forwarding used in peer-to-peer networks.
17995343
Automatic design of nonlinear filters by nearest neighbor learning
Nonlinear filters have been used not only in noise elimination but in a wide variety of image processing applications. Traditionally the design of a digital filter is a manual task and the user accomplishes it based on previous experiences. Unfortunately often this is not a trivial task. Thus some works try to overcome this difficulty constructing the filters automatically by computational learning neural networks, genetic algorithms and statistical estimation. These works use typical input-output images of the application as the training samples. Many different kinds of filters can be easily constructed using this approach. This paper proposes the use of nearest neighbor (NN) learning to automatic filter construction. The kd-tree (k-dimensional binary tree) is used to accelerate the NN searching. A texture recognition application example is depicted.
32223299
Security Techniques Based on EPC Gen2 Tag for Secure Mobile RFID Network Services
RFID (Radio Frequency Identification) technology will be a ubiquitous reality in daily life in the near future. The R&D groups in global now have paid attention to integrate RFID with mobile phone devices as well as to associate with the existing mobile telecommunication network. Such a converged technology and services would lead to make new markets and research challenges. However, privacy threats on RFID tags embedded into products has become stumbling block. Therefore, this paper propose a new security technique for mobile RFID service, which can be support to secure RFID service and uses the privacy protection in mobile RFID network services.