@conference {17531,
	title = {Fighting Spam with the NeighborhoodWatch DHT},
	booktitle = {IEEE INFOCOM 2009},
	year = {2009},
	month = {2009/04/19/25},
	pages = {1755 - 1763},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In this paper, we present DHTBL, an anti-spam blacklist built upon a novel secure distributed hash table (DHT). We show how DHTBL can be used to replace existing DNS-based blacklists (DNSBLs) of IP addresses of mail relays that forward spam. Implementing a blacklist on a DHT improves resilience to DoS attacks and secures message delivery, when compared to DNSBLs. However, due to the sensitive nature of the blacklist, storing the data in a peer-to-peer DHT would invite attackers to infiltrate the system. Typical DHTs can withstand fail-stop failures, but malicious nodes may provide incorrect routing information, refuse to return published items, or simply ignore certain queries. The neighborhoodwatch DHT is resilient to malicious nodes and maintains the O(logiV) bounds on routing table size and expected lookup time. NeighborhoodWatch depends on two assumptions in order to make these guarantees: (1) the existence of an on-line trusted authority that periodically contacts and issues signed certificates to each node, and (2) for every sequence of k + 1 consecutive nodes in the ID space, at least one is alive and non-malicious. We show how NeighborhoodWatch maintains many of its security properties even when the second assumption is violated. Honest nodes in NeighborhoodWatch can detect malicious behavior and expel the responsible nodes from the DHT.},
	keywords = {Communications Society, computer crime, cryptography, Databases, IP addresses, IP networks, on-line trusted authority, Peer to peer computing, peer-to-peer computing, peer-to-peer distributed hash table, Postal services, Relays, Resilience, Routing, Security, table size routing, Unsolicited electronic mail},
	isbn = {978-1-4244-3512-8},
	doi = {10.1109/INFCOM.2009.5062095},
	author = {Bender,A. and Sherwood,R. and Monner,D. and Goergen,N. and Spring, Neil and Bhattacharjee, Bobby}
}
@conference {18586,
	title = {MobCast: Overlay Architecture for Seamless IP Mobility using Scalable Anycast Proxies},
	booktitle = {Wireless Communications and Networking Conference, 2007.WCNC 2007. IEEE},
	year = {2007},
	month = {2007/03//},
	pages = {3872 - 3876},
	abstract = {We propose a routing overlay system, MobCast, for simple and efficient routing to mobile hosts. Mobcast nodes advertise the same address space at each proxy location, and each mobile host is assigned a "universal" IP address from this address space, so packets sent to a mobile host{\textquoteright}s universal IP address automatically go to the nearest proxy on the overlay. The overlay then delivers the packets to the mobile host. Our architecture enables seamless mobility for both micro and macro mobility. While our initial design is not as mature as Mobile IP, it shows great promise to solve the traditional problems of ingress routing, firewalls, NATs, and rapid mobility with much lower complexity. We present our design as a scalable and deployable alternative to mobile IP. In this paper, we focus on describing the MobCast system architecture. We form our arguments for scalability, handoff-speed, and simplicity, and give our initial results for scalability. We postpone a detailed discussion of MobCast{\textquoteright}s security model for future work.},
	keywords = {address space, handoff-speed, IP networks, MobCast, mobile hosts, mobile radio, overlay architecture, proxy location, routing overlay system, scalable anycast proxies, seamless IP mobility, telecommunication network routing, universal IP address},
	doi = {10.1109/WCNC.2007.708},
	author = {Lee,C.P. and Attrey,K. and Caballero,C. and Feamster, Nick and Mihail,M. and Copeland,J.A.}
}
@article {17650,
	title = {Resilient multicast using overlays},
	journal = {IEEE/ACM Transactions on Networking},
	volume = {14},
	year = {2006},
	month = {2006/04//},
	pages = {237 - 248},
	abstract = {We introduce Probabilistic Resilient Multicast (PRM): a multicast data recovery scheme that improves data delivery ratios while maintaining low end-to-end latencies. PRM has both a proactive and a reactive components; in this paper we describe how PRM can be used to improve the performance of application-layer multicast protocols especially when there are high packet losses and host failures. Through detailed analysis in this paper, we show that this loss recovery technique has efficient scaling properties-the overheads at each overlay node asymptotically decrease to zero with increasing group sizes. As a detailed case study, we show how PRM can be applied to the NICE application-layer multicast protocol. We present detailed simulations of the PRM-enhanced NICE protocol for 10 000 node Internet-like topologies. Simulations show that PRM achieves a high delivery ratio (>97\%) with a low latency bound (600 ms) for environments with high end-to-end network losses (1\%-5\%) and high topology change rates (5 changes per second) while incurring very low overheads (<5\%).},
	keywords = {application-layer multicast protocols, Computer science, Data communication, Delay, Internet, Internet-like topologies, IP networks, loss recovery technique, Multicast, multicast data recovery scheme, Multicast protocols, Network topology, NETWORKS, overlays, Performance loss, probabilistic forwarding, probabilistic resilient multicast, Protocols, Resilience, Streaming media, telecommunication network topology, Terminology},
	isbn = {1063-6692},
	doi = {10.1109/TNET.2006.872579},
	author = {Banerjee,S. and Lee,Seungjoon and Bhattacharjee, Bobby and Srinivasan, Aravind}
}
@conference {18657,
	title = {An experimental evaluation to determine if port scans are precursors to an attack},
	year = {2005},
	month = {2005/07/01/june},
	pages = {602 - 611},
	abstract = {This paper describes an experimental approach to determine the correlation between port scans and attacks. Discussions in the security community often state that port scans should be considered as precursors to an attack. However, very few studies have been conducted to quantify the validity of this hypothesis. In this paper, attack data were collected using a test-bed dedicated to monitoring attackers. The data collected consist of port scans, ICMP scans, vulnerability scans, successful attacks and management traffic. Two experiments were performed to validate the hypothesis of linking port scans and vulnerability scans to the number of packets observed per connection. Customized scripts were then developed to filter the collected data and group them on the basis of scans and attacks between a source and destination IP address pair. The correlation of the filtered data groups was assessed. The analyzed data consists of forty-eight days of data collection for two target computers on a heavily utilized subnet.},
	keywords = {attack data collection, computer crime, filtered data groups, ICMP scans, IP address, IP networks, management traffic, port scans, telecommunication security, Telecommunication traffic, vulnerability scans},
	doi = {10.1109/DSN.2005.18},
	author = {Panjwani,S. and Tan,S. and Jarrin,K.M. and Michel Cukier}
}
@conference {12076,
	title = {Bootstrapping security associations for routing in mobile ad-hoc networks},
	booktitle = {IEEE Global Telecommunications Conference, 2003. GLOBECOM {\textquoteright}03},
	volume = {3},
	year = {2003},
	month = {2003/12/01/5},
	pages = {1511- 1515 vol.3 - 1511- 1515 vol.3},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {To date, most solutions proposed for secure routing in mobile ad-hoc networks (MANETs), assume that secure associations between pairs of nodes can be established on-line; e.g., by a trusted third party, by distributed trust establishment. However, establishing such security associations, with or without trusted third parties, requires reliance on routing layer security. In this paper, we eliminate this apparent cyclic dependency between security services and secure routing in MANETs and show how to bootstrap security for the routing layer. We use the notion of statistically unique and cryptographically verifiable (SUCV) identifiers to implement a secure binding between IP addresses and keys that is independent of any trusted security service. We illustrate our solution with the dynamic source routing (DSR) protocol and compare it with other solutions for secure routing.},
	keywords = {ad hoc networks, bootstrapping security association, Cryptographic protocols, dynamic source routing protocol, Fabrics, Intelligent networks, IP address, IP key, IP networks, Message authentication, mobile ad-hoc network, mobile radio, Protection, Public key, public key cryptography, routing layer security reliability, routing protocols, secure routing, Security, security service, statistically unique cryptographically verification, telecommunication security},
	isbn = {0-7803-7974-8},
	doi = {10.1109/GLOCOM.2003.1258490},
	author = {Bobba,R. B and Eschenauer,L. and Gligor,V. and Arbaugh, William A.}
}
@conference {14654,
	title = {A secure PLAN (extended version)},
	booktitle = {DARPA Active NEtworks Conference and Exposition, 2002. Proceedings},
	year = {2002},
	month = {2002///},
	pages = {224 - 237},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Active networks promise greater flexibility than current networks, but threaten safety and security by virtue of their programmability. We describe the design and implementation of a security architecture for the active network PLANet (Hicks et al., 1999). Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN (Hicks et al., 1998), with an environment of general-purpose service routines governed by trust management (Blaze et al., 1996). In particular, we employ a technique which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. As an application of our security architecture, we present the design and implementation of an active-network firewall. We find that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets},
	keywords = {active internetwork, active networks, active-network firewall, Authentication, authorisation, Authorization, Cities and towns, Computer networks, Computer science, cryptography, functionally restricted packet language, general-purpose service routines, Information security, internetworking, IP networks, latency overhead, namespace-based security, PLAN, PLANet, Planets, programmability, Safety, security architecture, telecommunication security, trust management, two-level architecture, Web and internet services},
	isbn = {0-7695-1564-9},
	doi = {10.1109/DANCE.2002.1003496},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
@conference {16779,
	title = {Integrating distributed scientific data sources with MOCHA and XRoaster},
	booktitle = {Thirteenth International Conference on Scientific and Statistical Database Management, 2001. SSDBM 2001. Proceedings},
	year = {2001},
	month = {2001///},
	pages = {263 - 266},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {MOCHA is a novel middleware system for integrating distributed data sources that we have developed at the University of Maryland. MOCHA is based on the idea that the code that implements user-defined types and functions should be automatically deployed to remote sites by the middleware system itself. To this end, we have developed an XML-based framework to specify metadata about data sites, data sets, and user-defined types and functions. XRoaster is a graphical tool that we have developed to help the user create all the XML metadata elements to be used in MOCHA},
	keywords = {client-server systems, data sets, data sites, Databases, Distributed computing, distributed databases, distributed scientific data source integration, Educational institutions, graphical tool, hypermedia markup languages, IP networks, java, Large-scale systems, Maintenance engineering, meta data, metadata, Middleware, middleware system, MOCHA, Query processing, remote sites, scientific information systems, user-defined types, visual programming, XML, XML metadata elements, XML-based framework, XRoaster},
	isbn = {0-7695-1218-6},
	doi = {10.1109/SSDM.2001.938560},
	author = {Rodriguez-Martinez,M. and Roussopoulos, Nick and McGann,J. M and Kelley,S. and Mokwa,J. and White,B. and Jala,J.}
}
@conference {14725,
	title = {Practical programmable packets},
	booktitle = {IEEE INFOCOM 2001. Twentieth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {1},
	year = {2001},
	month = {2001///},
	pages = {41-50 vol.1 - 41-50 vol.1},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present SNAP (safe and nimble active packets), a new scheme for programmable (or active) packets centered around a new low-level packet language. Unlike previous active packet approaches, SNAP is practical: namely, adding significant flexibility over IP without compromising safety and security or efficiency. In this paper we show how to compile from the well-known active picket language PLAN to SNAP, showing that SNAP retains PLAN{\textquoteright}s flexibility; give proof sketches of its novel approach to resource control; and present experimental data showing SNAP attains performance very close to that of a software IP router},
	keywords = {active picket language, Application software, complier, Contracts, Data security, efficiency, Explosives, INFORMATION SCIENCE, Internet, IP, IP networks, low-level packet language, packet switching, performance, PLAN, practical programmable packets, program compilers, Protection, resource control, Resource management, safe and nimble active packets, Safety, Security, SNAP, software IP router, Software performance, telecommunication security, Transport protocols},
	isbn = {0-7803-7016-3},
	doi = {10.1109/INFCOM.2001.916685},
	author = {Moore,J. T and Hicks, Michael W. and Nettles,S.}
}
@conference {14723,
	title = {PLANet: an active internetwork},
	booktitle = {IEEE INFOCOM {\textquoteright}99. Eighteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {3},
	year = {1999},
	month = {1999/03/21/25},
	pages = {1124-1133 vol.3 - 1124-1133 vol.3},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present PLANet: an active network architecture and implementation. In addition to a standard suite of Internet-like services, PLANet has two key programmability features: (1) all packets contain programs; and (2) router functionality may be extended dynamically. Packet programs are written in our special purpose programming language PLAN, the Packet Language for Active Networks, while dynamic router extensions are written in OCaml, a dialect of ML. Currently, PLANet routers run as byte-code-interpreted Linux user-space applications, and support Ethernet and IP as link layers. PLANet achieves respectable performance on standard networking operations: on 300 MHz Pentium-II{\textquoteright}s attached to 100 Mbps Ethernet, PLANet can route 48 Mbps and switch over 5000 packets per second. We demonstrate the utility of PLANet{\textquoteright}s activeness by showing experimentally how it can nontrivially improve application and aggregate network performance in congested conditions},
	keywords = {100 Mbit/s, 300 MHz, 48 Mbit/s, active internetwork, active network architecture, active network implementation, byte-code-interpreted applications, Computer architecture, Computer languages, Computer networks, congested conditions, dynamic programming, dynamic router extensions, Ethernet, Ethernet networks, INFORMATION SCIENCE, Internet, Internet-like services, internetworking, IP, IP networks, link layers, Linux user-space applications, Local area networks, ML dialect, Network performance, networking operations, OCaml, Packet Language for Active Networks, packet programs, packet switching, Pentium-II, performance, performance evaluation, PLAN, PLANet, Planets, programmability features, programming languages, router functionality, special purpose programming language, Switches, telecommunication network routing, Transport protocols, Web and internet services},
	isbn = {0-7803-5417-6},
	doi = {10.1109/INFCOM.1999.751668},
	author = {Hicks, Michael W. and Moore,J. T and Alexander,D. S and Gunter,C. A and Nettles,S. M}
}
@article {12072,
	title = {Safety and security of programmable network infrastructures},
	journal = {IEEE Communications Magazine},
	volume = {36},
	year = {1998},
	month = {1998/10//},
	pages = {84 - 92},
	abstract = {Safety and security are two reliability properties of a system. A {\textquotedblleft}safe{\textquotedblright} system provides protection against errors of trusted users, while a {\textquotedblleft}secure{\textquotedblright} system protects against errors introduced by untrusted users. There is considerable overlap between mechanisms to support each property. Requirements for rapid service creation have stimulated the development of programmable network infrastructures, where end users or service providers can customize the properties of a network infrastructure while it continues to operate. A central concern of potential users of such systems is their reliability and, most specifically, their safety and security. In this article we explain the impact the network service model and architecture have on safety and security, and provide a model with which policies can be translated into restrictions of a general system. We illustrate these ideas with the Secure Active Network Environment (SANE) architecture, which provides a means of controlling access to the functions provided by any programmable infrastructure},
	keywords = {Access control, error protection, IP networks, Multicast protocols, network architecture, network operating systems, network service model, operating system, Power system dynamics, Power system modeling, Power system reliability, programmable languages, programmable network infrastructures, programming languages, Proposals, Protection, reliability properties, Safety, Secure Active Network Environment, Security, security of data, service creation, service providers, Switches, telecommunication computing, telecommunication network reliability, Web and internet services},
	isbn = {0163-6804},
	doi = {10.1109/35.722141},
	author = {Alexander,S. and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
@article {12101,
	title = {A secure active network environment architecture: realization in SwitchWare},
	journal = {IEEE Network},
	volume = {12},
	year = {1998},
	month = {1998/06//May},
	pages = {37 - 45},
	abstract = {An active network is a network infrastructure which is programmable on a per-user or even per-packet basis. Increasing the flexibility of such network infrastructures invites new security risks. Coping with these security risks represents the most fundamental contribution of active network research. The security concerns can be divided into those which affect the network as a whole and those which affect individual elements. It is clear that the element problems must be solved first, since the integrity of network-level solutions will be based on trust in the network elements. In this article we describe the architecture and implementation of a secure active network environment (SANE), which we believe provides a basis for implementing secure network-level solutions. We guarantee that a node begins operation in a trusted state with the AEGIS secure bootstrap architecture. We guarantee that the system remains in a trusted state by applying dynamic integrity checks in the network element{\textquoteright}s runtime system, using a novel naming system, and applying node-to-node authentication when needed. The construction of an extended LAN is discussed},
	keywords = {access protocols, AEGIS secure bootstrap architecture, architecture, Authentication, Collaboration, Communication switching, dynamic integrity checks, extended LAN, Functional programming, implementation, integrity, Intelligent networks, IP networks, Local area networks, network infrastructure, network infrastructures, network operating systems, network-level solutions, node, node-to-node authentication, packet switching, Proposals, ramming system, SANE, secure active network environment architecture, security of data, Switches, SwitchWare, trusted state, Web and internet services},
	isbn = {0890-8044},
	doi = {10.1109/65.690960},
	author = {Alexander,D. S and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
@article {12079,
	title = {The SwitchWare active network architecture},
	journal = {IEEE Network},
	volume = {12},
	year = {1998},
	month = {1998/06//May},
	pages = {29 - 36},
	abstract = {Active networks must balance the flexibility of a programmable network infrastructure against the safety and security requirements inherent in sharing that infrastructure. Furthermore, this balance must be achieved while maintaining the usability of the network. The SwitchWare active network architecture is a novel approach to achieving this balance using three layers: active packets, which contain mobile programs that replace traditional packets; active extensions, which provide services on the network elements and can be dynamically loaded; and a secure active router infrastructure, which forms a high-integrity base on which the security of the other layers depends. In addition to integrity checking and cryptography-based authentication, security in our architecture depends heavily on verification techniques from programming languages, such as strong type checking},
	keywords = {active extensions, active packets, Authentication, Computer languages, Computer networks, cryptography, cryptography-based authentication, high-integrity base, integrity checking, IP networks, LAN interconnection, mobile programs, network operating systems, packet switching, programmable network infrastructure, programming languages, Protocols, Safety, safety requirements, scalability, secure active router infrastructure, Security, security requirements, services, strong type checking, Switches, SwitchWare active network architecture, telecommunication network routing, Tin, usability, verification techniques},
	isbn = {0890-8044},
	doi = {10.1109/65.690959},
	author = {Alexander,D. S and Arbaugh, William A. and Hicks, Michael W. and Kakkar,P. and Keromytis,A. D and Moore,J. T and Gunter,C. A and Nettles,S. M and Smith,J. M}
}
@conference {12092,
	title = {A secure and reliable bootstrap architecture},
	booktitle = {, 1997 IEEE Symposium on Security and Privacy, 1997. Proceedings},
	year = {1997},
	month = {1997/05/04/7},
	pages = {65 - 71},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, the integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity {\textquotedblleft}chain{\textquotedblright} inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made, yet these guarantees are increasingly important to diverse applications such as Internet commerce, security systems and {\textquotedblleft}active networks{\textquotedblright}. In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems},
	keywords = {active networks, AEGIS architecture, bootstrap architecture, Computer architecture, computer bootstrapping, data integrity, Distributed computing, Hardware, hardware validity, initialization, integrity chain, integrity check failures, Internet, Internet commerce, IP networks, Laboratories, lower-layer integrity, Microprogramming, Operating systems, recovery process, reliability, robust systems, Robustness, Security, security of data, software reliability, system integrity guarantees, system recovery, transitions, Virtual machining},
	isbn = {0-8186-7828-3},
	doi = {10.1109/SECPRI.1997.601317},
	author = {Arbaugh, William A. and Farber,D. J and Smith,J. M}
}
