3839837
Creating Vulnerability Signatures Using Weakest Preconditions
Signature-based tools such as network intrusion detection systems are widely used to protect critical systems. Automatic signature generation techniques are needed to enable these tools due to the speed at which new vulnerabilities are discovered. In particular, we need automatic techniques which generate sound signatures - signatures which will not mistakenly block legitimate traffic or raise false alarms. In addition, we need signatures to have few false negatives and will catch many different exploit variants. We investigate new techniques for automatically generating sound vulnerability signatures with fewer false negatives than previous research using program binary analysis. The key problem to reducing false negatives is to consider as many as possible different program paths an exploit may take. Previous work considered each possible program path an exploit may take separately, thus generating signatures that are exponential in the size of the number of branches considered. In the exact same scenario, we show how to reduce the overall signature size and the generation time from exponential to polynomial. We do this without requiring any additional assumptions, or relaxing any properties. This efficiency gain allows us to consider many more program paths, which results in reducing the false negatives of generated signatures. We achieve these results by creating algorithms for generating vulnerability signatures that are based on computing weakest preconditions (WP). The weakest precondition for a program path to a vulnerability is a function which matches all exploits that may exploit the vulnerability along that path. We have implemented our techniques and generated signatures for several binary programs. Our results demonstrate that our WP-based algorithm generates more succinct signatures than previous approaches which were based on forward symbolic execution.
5961776
NetSpy: Automatic Generation of Spyware Signatures for NIDS
We present NetSpy, a tool to automatically generate network-level signatures for spyware. NetSpy determines whether an untrusted program is spyware by correlating user input with network traffic generated by the untrusted program. If classified as spyware, NetSpy also generates a signature characterizing the malicious substrate of the spyware's network behavior. Such a signature can be used by network intrusion detection systems to detect spyware installations in large networks. In our experiments, NetSpy precisely identified each of the 7 spyware programs that we considered and generated network-level signatures for them. Of the 9 supposedly-benign programs that we considered, NetSpy correctly characterized 6 of them as benign. The remaining 3 programs showed network behavior that was highly suggestive of spying activity
10702245
A wireless LAN-based indoor positioning technology
Context-aware computing is an emerging computing paradigm that can provide new or improved services by exploiting user context information. In this paper, we present a wireless-local-area-network-based (WLAN-based) indoor positioning technology. The wireless device deploys a position-determination model to gather location information from collected WLAN signals. A model-based signal distribution training scheme is proposed to trade off the accuracy of signal distribution and training workload. A tracking-assistant positioning algorithm is presented to employ knowledge of the area topology to assist the procedure of position determination. We have set up a positioning system at the IBM China Research Laboratory. Our experimental results indicate an accuracy of 2 m with a 90% probability for static devices and, for moving (walking) devices, an accuracy of 5 m with a 90% probability. Moreover, the complexity of the training procedure is greatly reduced compared with other positioning algorithms.
10887794
Packet doppler: network monitoring using packet shift detection
Due to recent large-scale deployments of delay and loss-sensitive applications, there are increasingly stringent demands on the monitoring of service level agreement metrics. Although many end-to-end monitoring methods have been proposed, they are mainly based on active probing and thus inject measurement traffic into the network. In this paper, we propose a new scheme for monitoring service level agreement metrics, in particular, delay distribution. Our scheme is passive and therefore will not cause perturbation to real traffic. Using realistic delay and traffic demands, we show that our scheme achieves high accuracy and can detect burst events that will be missed by probing based methods.
12042823
bSpace: A Data Cleaning Approach for RFID Data Streams Based on Virtual Spatial Granularity
RFID holds the promise of real-time identifying, locating, tracking and monitoring physical objects without line of sight, and can be used for a wide range of pervasive computing applications. To achieve these goals, RFID data have to be collected, filtered, and transformed into semantic application data. RFID data, however, contain false readings and duplicates. Such data cannot be used directly by applications unless they are filtered and cleaned. To compensate for the inherent unreliability of RFID data streams, most RFID middleware systems employ a “smoothing filtering”. In this paper, a new “smoothing filtering” approach named bSpace is proposed, which is based on the concept of virtual spatial granularity. For providing accurate RFID data to applications, bSpace uses a Bayesian estimation algorithm to fill up false negatives, and uses the rules which we define to solve false positives.
9869945
The Logic of Automata—Part II
The transition part of a net controls the passage of the net from state to state and is therefore the heart of the net. In this subsection we introduce "the transition matr ix," a table which describes a net by showing the various ways in which it may pass from one delay state to another. We use a characterizing table with M input (state) words I, N internalstate words S, and M X N rows, each of the form <<I, S > , S ' > , to define N 2 direct-transition expressions I~j as follows. I ~ is a disjunction of all those I~ such tha t <<Ik, S~>, S i > is a row of the characterizing table; if there are no such Ik , then I~s is ¢ ("the false"). Tha t is, I~i is a disjunction of all those input words (if any) which can cause the net to pass from state S~ at time t to state Sj at t ime t + 1; it is allowed that i equals j . I t is clear that each I~i is a disjunctive normal form expression of the input function variables. Note tha t the direct-transition expression "~b" is distinct from the directtransition expressions "0", "00", "000", etc.; the former means that no direct transition between the two states is possible, while the latter mean that such a transition is brought about by making all the inputs zero. A direct transition from S~ to S~ in a net is a passage from state S~ at t to state S~ at t + 1. Such a transition is possible only in the case where I~i ~ ¢. We say that < I k , S~> (or Ik S~) at time t directly produces Si at time t -~ 1 only in the case where the net makes a direct transition from S~ to Sy under the influence of input Ik at t. A transition from S~ to Si in a net is a passage from state S~ at t to state S~ at t ~ w (w > 0). Such a transition is possible only where there exists a sequence of direct-transition expressions, none of which are ¢, of the form I~o, , I,~o~, . . . , I ~ j . We say that I~S~(t) , I~,~(t -q1), . . . , I~s(t -k w 1) produces S j at t "-k w if and only if there is a transition from S~(t) to Si(t -k w) under the direction of the hsted inputs; this is a transition of w steps (or, alternatively, a transition of length w). I t is convenient to arrange the information in an M N characterizing table in a direct-transition matrix of order N by arranging the N * direct-transi-
29040872
A Variant to Turing's Theory of Computing Machines
The principal purpose of this paper is to offer a theory which is closely related to Turing's [1] but is more economical in the basic operations. I t will be proved that a theoretically simple basic machine can be imagined and specified such tha t all partial recursive functions (and hence all solvable computation problems) can be computed by it and tha t only four basic types of instruction are employed for the programs: shift left one space, shift right one space, mark a blank space, conditional transfer. In particular, erasing is dispensable, one symbol for marking is sufficient, and one kind of transfer is enough. The reduction is somewhat similar to the realization of, for instance, the definability of conjunction and implication in terms of negation and disjunction, or of the definability of all these in terms of Sheffer's stroke function. As a result, i t becomes less direct to prove that certain things can be done by the machines, but a little easier to prove that certain things cannot be done. This serf-contained theory will b e presented, as far as possible, in a language which is familiar to those who are engaged in the use and construction of largescale computers. Turing's theory of computable functions antedated but has not much influenced the extensive actual construction of digital computers. These two aspects of theory and practice have been developed almost entirely independently of each other. The main reason is undoubtedly that logicians are interested in questions radically different from those with which the applied mathematicians and electrical engineers are primarily concerned. I t cannot, however, fail to strike one as rather strange that often the same concepts are expressed by very different terms in the two developments. One is even inclined to ask whether a rapprochement might not produce some good effect. This paper wiU, it is believed, be of use to those who wish to compare and connect the two approaches. Extensive use of Turing [1] and Kleene [2] (Chapter XI I I ) will be made, although the exposition is sufficient in itself.