6342666
SOWAC: a service-oriented workflow access control model
Workflow access control is the fundamental issue in workflow security. With the development of enterprise globalization and the constant re-engineering and optimizing of enterprise business, the organization becomes more dynamic and its business process is frequently changing. As a result, workflow access control turns more complicated and entails a comparatively operational mechanism. To solve the problem, in view of decoupling workflow access control model from workflow model, we propose a service-oriented workflow access control (SOWAC) model in this paper. In the SOWAC model, service is the abstraction of a task and the unit for applying access control. We present the elements of the SOWAC model and illustrate the enforcement of SOWAC with an example workflow. Then the dynamic separation of duty for the SOWAC model is proposed based on the authorization history of services. By applying SOWAC in a real workflow management system, we show that the SOWAC model is practical and effective.
2247575
Towards dynamic process with variable structure by reflection
Advancing information technologies are increasing the evolution and variation of software resources. Applications that cannot adapt to dynamic environments will decrease their usefulness, particularly to business process systems that face requirements changed frequently. After surveying related work, we propose a new formalism for modeling dynamic process in which the state space and transition function are enriched so that one model can transit to another model at runtime by the computational reflection that aims to represent and modify its own design. Such goal necessitates an appropriate runtime environment. We introduce the service cooperation middleware (SCM) because it is service-oriented, into which the reflection mechanism is easily attached to support structural and behavioural changes on processes at runtime.
17384175
Extending OBDD Graphs for Composite Event Matching in Content-based Pub/Sub Systems
Content-based publish/subscribe offers a convenient abstraction for the information producers and consumers, supporting a large-scale system design and evolution by integrating several distributed independent application systems. Unlike in the traditional address-based unicast or multicast, its core problem is how to match events by predicates on the content of events. In existing matching approaches, matching predicates are composed by the conjunction and disjunction of non-semantic constraints. But, in context of enterprise application integration, although they can match events by their contents, this traditional matching predicates are not enough expressive in manipulating the complex event matching, such as the "one-to-many" and "many-to-one" matching. Therefore, traditional matching approaches should be extended to solve the complex matching problems. After analyzing information matching patterns in enterprise application integration, we propose three matching models, extend the simple matching to the multi-semantic matching and introduce the temporal constraint variable. The multi-semantic matching allows using different operations in accordance with different semantics; the temporal constraint variable supports processing the discrete events in the temporal sequence. Then, we extend OBDD graphs into hierarchy coloured OBDD graphs and prove the equivalence of the transformation. Based on the extended OBDD graphs, the composite matching algorithm is presented and analysed. By experiments, we show the proposed algorithm is efficient
15326279
GCS-MA: A group communication system for mobile agents
Reliable messaging is a key component necessary for mobile agent systems. Current researches focus on reliable one-to-one message delivery to mobile agents. But how to implement a group communication system for mobile agents remains an open issue, which is a powerful block that facilitates the development of fault-tolerant mobile agent systems. In this paper, we propose a group communication system for mobile agents (GCS-MA), which includes totally ordered multicast and membership management functions. We divide a group of mobile agents into several agent clusters, and each agent cluster consists of all mobile agents residing in the same sub-network and is managed by a special module, named coordinator. Then, all coordinators form a ring-based overlay for interchanging messages between clusters. We present a token-based algorithm, an intra-cluster messaging algorithm and an inter-cluster migration algorithm to achieve atomicity and total ordering properties of multicast messages, by building a membership protocol on top of the clustering and failure detection mechanisms. Performance issues of the proposed system have been analysed through simulations. We also describe the application of the proposed system in the context of the service cooperation middleware (SCM) project.
7297586
Diversifying and improving business process management systems by service cooperation middleware
Emerging service oriented business process management (BPM) systems require efficient middleware infrastructure. However, current techniques for middleware are not optimal for that because they all do not have service-oriented natures themselves. This paper introduces a novel service cooperation middleware (SCM), which is designed to meet such requirements. It improves the development and integration of loosely coupled service oriented BPM system by applying several concepts such as control flow semantic and projection operation, etc. Furthermore, based on the SCM architecture, the related process integration suit viz. ISProcessIntegration (PI) can be widely applied into all kinds of scenes, for example EAI, B2B, B2C, P2P, cluster, with different topologies.
17469824
Extending OBDD graphs for composite event matching in content-based pub/sub systems
Content-based publish/subscribe offers a convenient abstraction for the information producers and consumers, supporting a large-scale system design and evolution by integrating several distributed independent application systems. Its core problem is how to match events by predicates on the content of events. In this paper, we propose three matching models, extend the simple matching to the multi-semantic matching and introduce the temporal constraint variable. The multi-semantic matching allows using different operations in accordance with different semantics; the temporal constraint variable supports processing the discrete events in the temporal sequence. Then, we extend OBDD graphs into hierarchy coloured OBDD graphs and prove the equivalence of the transformation. At last, based on OBDD graphs the composite matching algorithm is presented and analysed. By experiments, we show the proposed algorithm is efficient.
7346557
Predictive Control for Dynamic Resource Allocation in Enterprise Data Centers
It is challenging to reduce resource over-provisioning for enterprise applications while maintaining service level objectives (SLOs) due to their time-varying and stochastic workloads. In this paper, we study the effect of prediction on dynamic resource allocation to virtualized servers running enterprise applications. We present predictive controllers using three different prediction algorithms based on a standard auto-regressive (AR) model, a combined ANOVA-AR model, as well as a multi-pulse (MP) model. We compare the properties of the predictive controllers with an adaptive integral (I) controller designed in our earlier work on controlling relative utilization of resource containers. The controllers are evaluated in a hypothetical virtual server environment where we use the CPU utilization traces collected on 36 servers in an enterprise data center. Since these traces were collected in an open-loop environment, we use a simple queuing algorithm to simulate the closed-loop CPU usage under dynamic control of CPU allocation. We also study the controllers by emulating the utilization traces on a test bed where a Web server was hosted inside a Xen virtual machine. We compare the results of these controllers from all the servers and find that the MP-based predictive controller performed slightly better statistically than the other two predictive controllers. The ANOVA-AR-based approach is highly sensitive to the existence of periodic patterns in the trace, while the other three methods are not. In addition, all the three predictive schemes performed significantly better when the prediction error was accounted for using a feedback mechanism. The MP-based method also demonstrated an interesting self-learning behavior
38063423
A series of explicit and exact travelling wave solutions of the B(m, n) equations
Abstract In this paper, explicit and exact travelling wave solutions of B ( m ,  n ) equations are investigated by using a generalized algebraic method. A series of explicit exact solutions, such as solitary wave, triangular periodic, rational, Jacobi and Weierstrass elliptic function periodic solutions are obtained. Many new results are presented.
205398210
Chaos controlling of extended nonlinear Liénard system based on the Melnikov theory
Abstract Chaos control may have a dual function, to generate chaos or to suppress it. By the Melnikov theory, two criterions of controlling chaos for a class of nonlinear Lienard system are established. According to the criterions, we implement chaos control using non-feedback method. Two illustrative examples, a Duffing–Rayleigh oscillator imposed with a weak bounded noise control, and a Duffing–van der Pol oscillator subject to a harmonic parametric control are presented here to illustrate the validity of the criterions. To better support the results obtained above, some indicators are used, namely the Lyapunov exponent, phase portrait, Poincare cross-section and time evolution. Both two methods lead to fully consistent results.
394877
Exploration and Exploitation in Adaptive Filtering Based on Bayesian Active Learning
In the task of adaptive information filtering, a system receives a stream of documents but delivers only those that match a person's information need. As the system filters it also refines its knowledge about the user's information needs based on relevance feedback from the user. Delivering a document thus has two effects: i) it satisfies the user's information need immediately, and ii) it helps the system better satisfy the user in the future by improving its model of the user's information need. The traditional approach to adaptive information filtering fails to recognize and model this second effect. 
 
This paper proposes utility divergence as the measure of model quality. Unlike the model quality measures used in most active learning methods, utility divergence is represented on the same scale as the filtering system's target utility function. Thus it is meaningful to combine the expected immediate utility with the model quality, and to quantitatively manage the trade-off between exploitation and exploration. The proposed algorithm is implemented for setting the filtering system's dissemination threshold, a major problem for adaptive filtering systems. Experiments with TREC-9 and TREC-10 filtering data demonstrate that the proposed method is effective.
740678
Taint-Enhanced Policy Enforcement: A Practical Approach to Defeat a Wide Range of Attacks
Policy-based confinement, employed in SELinux and specification-based intrusion detection systems, is a popular approach for defending against exploitation of vulnerabilities in benign software. Conventional access control policies employed in these approaches are effective in detecting privilege escalation attacks. However, they are unable to detect attacks that "hijack" legitimate access privileges granted to a program, e.g., an attack that subverts an FTP server to download the password file. (Note that an FTP server would normally need to access the password file for performing user authentication.) Some of the common attack types reported today, such as SQL injection and cross-site scripting, involve such subversion of legitimate access privileges. In this paper, we present a new approach to strengthen policy enforcement by augmenting security policies with information about the trustworthiness of data used in securitysensitive operations. We evaluated this technique using 9 available exploits involving several popular software packages containing the above types of vulnerabilities. Our technique sucessfully defeated these exploits.