5332739
A Practical Formalism for Imprecise Inference Control
APracticalFormalismforImpreciseInferenceControlJohnHaleJo dyThreetSujeetShenoiDepartmentofMathematicalandComputerSciencesKeplingerHall,UniversityofTulsaTulsa,Oklahoma74104-3189,USAAbstractThis pap er describ es a p owerful, yet practical, formalism for mo deling and controlling imprecise FD-basedinferenceinrelationaldatabasesystems.Theformalismprovidesacanonicalrepresentationofwhichuni espreciseinferenceandtheprimitiveimprecisemechanismsofab ductionpartialdeduction.Whereas other imprecise (partial) inference mo dels estimate the probability of making inferences,the formalism supp orts the analysis of the actual imprecise values inferred in a database extension.Impreciseinferenceisanalyzedbytransformingaprecisedatabaseaugmentedwithadditional\catalytic"relations,conveyingp ossiblyimpreciseaprioriknowledge,intoanequivalentdatabase.Theanalysisofimpreciseinferenceand the relatedinference controlmetho dologyare highlyexibleand robust.They canb e directly applied to classical, MLS, and imprecise databases.With minimal mo di cations, they also can b eused in knowledge discovery or database mining.1Intro ductionControlling user access to database data has b een the fo cus of considerable attention in the security community.However, serious security compromises also can arise frominference attacks[2].An inference attack o ccursin amultilevel secure (MLS) database [11] when a low user is able to infer sensitive information from common knowl-edgeand authorizedqueryresp onses.Su andOszoyoglu [19,20] showedthat integrity constraints,particularlyFDs and MVDs, p ose serious securitythreats.They devisedan algorithm for optimally upgrading informationtoeliminate inferencecompromises;theyalsoshowedthatthisproblem isNP-complete.Morerecently,LuntandcolleaguesatSRIInternational[5,15,18] havedevelop edaninteractivto ol,DISSECT,fordetectingeliminating comp ositional inference channels due to foreign key FDs.The DISSECT mo del builds on earlier workoninferencecontrol,includingto olsandtechniquesdevelop edbyBuczkowski[1],Thuraisingham [23,24], andHinke [9]. The current version of DISSECT [18] is limited to analyzing MLS database schemas (intensions) ratherthan actual MLSrelations (extensions).Nevertheless,its successshowsthatit is p ossibleto developpracticalto ols for dealing with the dicult problem of inference control.E ectively controlling imprecise inference in MLS databases remains a relatively unexplored problem of greatimp ortance.An imprecise or partial inference compromise o ccurs when a low user is able to infer an exact valueor asetof p ossiblevaluesan information chunkfor asensitiveattributewith acertainprobability.Thegranularity of the inferred chunk may b e small enough and/or its probability high enough to constitute a securitybreach.Not only is imprecise inference just as damaging as precise inference, it is also far more prevalent.Severalresearchershaverecognizedtheimp ortanceofcontrollingimpreciseorpartialinferenceinMLSdatabases.Suand Oszoyoglu[19,20] notedthatcompromise elimination techniquesinvolving FDsandMVDsTo whom corresp ondence should b e addressed.Research supp orted by NSF Grant IRI-9110709 and OCAST Grant AR2-002.To app ear inDatabase Security VII: Status and Prospects, J. Biskup, M. Morgenstern and C.E. Landwehr (Eds.), Elsevier Science,Amsterdam (The Netherlands), 1994.1
9161104
A Framework for High Assurance Security of Distributed Objects
High assurance security is difficult to achieve in distributed computer systems and databases because of their complexity, non-determinism and inherent heterogeneity. The practical application of formal methods is the key to high assurance security in open, distributed environments. This paper proposes the use of formal methods and a special layered architecture to achieve secure interoperation of heterogeneous distributed objects. The foundation is provided by ROC, a process calculus tailored for concurrent objects. Lying above ROC in the layered architecture is a meta-object model for creating object models with various programming constructs, mega-programming facilities and security mechanisms. Successive layers of the architecture represent more sophisticated toolkits for modeling distributed objects. Since each layer inherits ROC’s formal foundation, it automatically has an unambiguous semantics and supports verification.
753928
Policy mediation for multi-enterprise environments
Existing software infrastructures and middleware provide uniform security services across heterogeneous information networks. However few, if any, tools exist that support access control policy management for and between large enterprise information networks. Insiders often exploit gaps in policies to mount devastating attacks. This paper presents a Policy Machine and Policy Mediation Architecture for coordinating diverse policies in large information networks. The language-based approach adopted by each of these technologies permits local and global access control policy validation with static analysis and other formal techniques. Together the Policy Machine and Policy Mediation Architecture comprise an effective system for closing policy gaps in multi-enterprise environments.
16766690
Security policy coordination for heterogeneous information systems
Coordinating security policies in information enclaves is challenging due to their heterogeneity and autonomy. Administrators must reconcile the semantic diversity of data and security models before negotiating secure interoperation. This paper proposes an architecture that uses mediators and a primitive ticket-based authorization model to manage disparate policies in information enclaves. The formal foundation of the architecture facilitates static and dynamic analysis of global consistency and policy enforcement.
14508115
Redacting Digital Information from Electronic Devices
Redaction is the process of removing privileged information from a document before it is presented to other parties. This paper discusses the major issues associated with the redaction of digital information from electronic devices. A novel technique involving a tokenized representation is presented as a solution to digital redaction in legal proceedings.
15030633
Strata-Gem: risk assessment through mission modeling
Strata-Gem utilizes mission trees to perform risk assessments by linking an organization's objectives to the IT assets that implement them. Critical states are identified which indicate goals that a potential attacker can achieve to prevent each asset from completing its objectives. Those goals are then used as states to drive attack and fault tree analysis to determine the likelihood of an attack. This provides a quantitative risk measurement to be calculated for each asset, objective, and the overall organization.
431369
The Information-Processing Difficulty Of Incremental Parsing
When an incremental parser gets the next word, its expectations about upcoming grammatical structures can change. When a word greatly constrains these grammatical expectations, uncertainty is reduced. This elimination of possibilities constitutes information processing work. Formalizing this notion of information processing work yields a complexity metric that predicts human repetition accuracy scores across a systematic class of linguistic phenomena, the Accessibility Hierarchy of relativizable grammatical relations.
5490143
A Probabilistic Earley Parser as a Psycholinguistic Model
In human sentence processing, cognitive load can be defined many ways. This report considers a definition of cognitive load in terms of the total probability of structural options that have been disconfirmed at some point in a sentence: the surprisal of word wi given its prefix wo...i-1 on a phrase-structural language model. These loads can be efficiently calculated using a probabilistic Earley parser (Stolcke, 1995) which is interpreted as generating predictions about reading time on a word-by-word basis. Under grammatical assumptions supported by corpus-frequency data, the operation of Stolcke's probabilistic Earley parser correctly predicts processing phenomena associated with garden path structural ambiguity and with the subject/object relative asymmetry.
5567072
Surprising Parser Actions and Reading Difficulty
An incremental dependency parser's probability model is entered as a predictor in a linear mixed-effects model of German readers' eye-fixation durations. This dependency-based predictor improves a baseline that takes into account word length, n-gram probability, and Cloze predictability that are typically applied in models of human reading. This improvement obtains even when the dependency parser explores a tiny fraction of its search space, as suggested by narrow-beam accounts of human sentence processing such as Garden Path theory.
7472011
PCFGs with Syntactic and Prosodic Indicators of Speech Repairs
A grammatical method of combining two kinds of speech repair cues is presented. One cue, prosodic disjuncture, is detected by a decision tree-based ensemble classifier that uses acoustic cues to identify where normal prosody seems to be interrupted (Lickley, 1996). The other cue, syntactic parallelism, codifies the expectation that repairs continue a syntactic category that was left unfinished in the reparandum (Levelt, 1983). The two cues are combined in a Treebank PCFG whose states are split using a few simple tree transformations. Parsing performance on the Switchboard and Fisher corpora suggests that these two cues help to locate speech repairs in a synergistic way.