@conference {14679,
	title = {Dynamic Enforcement of Knowledge-Based Security Policies},
	booktitle = {Computer Security Foundations Symposium (CSF), 2011 IEEE 24th},
	year = {2011},
	month = {2011/06/27/29},
	pages = {114 - 128},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper explores the idea of knowledge-based security policies, which are used to decide whether to answer queries over secret data based on an estimation of the querier{\textquoteright}s (possibly increased) knowledge given the results. Limiting knowledge is the goal of existing information release policies that employ mechanisms such as noising, anonymization, and redaction. Knowledge-based policies are more general: they increase flexibility by not fixing the means to restrict information flow. We enforce a knowledge-based policy by explicitly tracking a model of a querier{\textquoteright}s belief about secret data, represented as a probability distribution, and denying any query that could increase knowledge above a given threshold. We implement query analysis and belief tracking via abstract interpretation using a novel probabilistic polyhedral domain, whose design permits trading off precision with performance while ensuring estimates of a querier{\textquoteright}s knowledge are sound. Experiments with our implementation show that several useful queries can be handled efficiently, and performance scales far better than would more standard implementations of probabilistic computation based on sampling.},
	keywords = {abstract interpretation, belief networks, belief tracking, Data models, dynamic enforcement, Facebook, information flow, knowledge based systems, knowledge-based security, knowledge-based security policy, privacy, probabilistic computation, probabilistic logic, probabilistic polyhedral domain, probabilistic polyhedron, probability, query analysis, Security, security of data, semantics, Waste materials},
	isbn = {978-1-61284-644-6},
	doi = {10.1109/CSF.2011.15},
	author = {Mardziel,P. and Magill,S. and Hicks, Michael W. and Srivatsa,M.}
}
@conference {17299,
	title = {Motivation for Participation in Online Neighborhood Watch Communities: An Empirical Study Involving Invitation Letters},
	booktitle = {Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on and 2011 IEEE Third International Confernece on Social Computing (SocialCom)},
	year = {2011},
	month = {2011/10/09/11},
	pages = {760 - 765},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper presents a three-part experiment designed to investigate the motivations of users of a community safety and neighborhood watch social networking website. The experiment centers around an intervention into the invitation system that current users employ to invite nonmembers to join the site, and involves several versions of an invitation email which differ by expressing one of four possible motivations for using such a site. The research presented investigates how potential users{\textquoteright} choice of whether or not to join the site is affected by the use case presented by the invitation. It also includes an investigation of the motivations of current users of the site, as reported in an online survey. The experiment yielded no significant difference in responses to the emails. Overall, invitations that included a specific motivation slightly outperformed those which did not, but not to a statistically significant degree. We conclude that although users have specific motivations for using the site, as reported in the survey, attempting to increase response rates to invitation emails by suggesting use cases of the site is surprisingly unlikely to be successful.},
	keywords = {Art, Communities, community safety, Electronic mail, Interviews, invitation email, invitations, motivation, neighborhood watch, Online communities, online neighborhood watch communities, online survey, participation, Safety, Security, social media, Social network services, social networking (online), social networking Website},
	isbn = {978-1-4577-1931-8},
	doi = {10.1109/PASSAT/SocialCom.2011.108},
	author = {Violi,N. and Shneiderman, Ben and Hanson,A. and Rey,P. J}
}
@conference {12413,
	title = {Simulating Audiences: Automating Analysis of Values, Attitudes, and Sentiment},
	booktitle = {Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on and 2011 IEEE Third International Confernece on Social Computing (SocialCom)},
	year = {2011},
	month = {2011/10/09/11},
	pages = {734 - 737},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Current events such as the Park51 Project in downtown Manhattan create "critical discourse moments," explosions of discourse around a topic that can be exploited for data gathering. Policymakers have a need to understand the dynamics of public discussion in real time. Human values, which are cognitively related to attitudes and serve as reference points in moral argument, are important indicators of what{\textquoteright}s at stake in a public controversy. This work shows that it is possible to link values data with reader behavior to infer values implicit in a topical corpus, and that it is possible to automate this process using machine learning.},
	keywords = {audience simulation, behavioural sciences computing, crowdsourcing, Educational institutions, human values, HUMANS, learning (artificial intelligence), machine learning, moral argument, natural language processing, Park51 project, Presses, public controversy, public discussion, Security, social sciences computing, support vector machines, Weaving},
	isbn = {978-1-4577-1931-8},
	doi = {10.1109/PASSAT/SocialCom.2011.238},
	author = {Templeton,T.C. and Fleischmann,K.R. and Jordan Boyd-Graber}
}
@conference {18614,
	title = {Wide-area routing dynamics of malicious networks},
	booktitle = {Proceedings of the ACM SIGCOMM 2011 conference},
	series = {SIGCOMM {\textquoteright}11},
	year = {2011},
	month = {2011///},
	pages = {432 - 433},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper studies the routing dynamics of malicious networks. We characterize the routing behavior of malicious networks on both short and long timescales. We find that malicious networks more consistently advertise prefixes with short durations and long inter- arrival times; over longer timescales, we find that malicious ASes connect with more upstream providers than legitimate ASes, and they also change upstream providers more frequently.},
	keywords = {BGP, Security, spam},
	isbn = {978-1-4503-0797-0},
	doi = {10.1145/2018436.2018505},
	url = {http://doi.acm.org/10.1145/2018436.2018505},
	author = {Konte,Maria and Feamster, Nick}
}
@conference {14688,
	title = {Dynamically checking ownership policies in concurrent c/c++ programs},
	booktitle = {Proceedings of the 37th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages},
	series = {POPL {\textquoteright}10},
	year = {2010},
	month = {2010///},
	pages = {457 - 470},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Concurrent programming errors arise when threads share data incorrectly. Programmers often avoid these errors by using synchronization to enforce a simple ownership policy: data is either owned exclusively  by a thread that can read or write the data, or it is read owned  by a set of threads that can read but not write the data. Unfortunately, incorrect synchronization often fails to enforce these policies and memory errors in languages like C and C++ can violate these policies even when synchronization is correct. In this paper, we present a dynamic analysis for checking ownership policies in concurrent C and C++ programs despite memory errors. The analysis can be used to find errors in commodity multi-threaded programs and to prevent attacks that exploit these errors. We require programmers to write ownership assertions that describe the sharing policies used by different parts of the program. These policies may change over time, as may the policies{\textquoteright} means of enforcement, whether it be locks, barriers, thread joins, etc. Our compiler inserts checks in the program that signal an error if these policies are violated at runtime. We evaluated our tool on several benchmark programs. The run-time overhead was reasonable: between 0 and 49\% with an average of 26\%. We also found the tool easy to use: the total number of ownership assertions is small, and the asserted specification and implementation can be debugged together by running the instrumented program and addressing the errors that arise. Our approach enjoys a pleasing modular soundness property: if a thread executes a sequence of statements on variables it owns, the statements are serializable within a valid execution, and thus their effects can be reasoned about in isolation from other threads in the program.},
	keywords = {concurrency, Debugging, Dynamic analysis, Security, Testing, tools},
	isbn = {978-1-60558-479-9},
	doi = {10.1145/1706299.1706351},
	url = {http://doi.acm.org/10.1145/1706299.1706351},
	author = {Martin,Jean-Phillipe and Hicks, Michael W. and Costa,Manuel and Akritidis,Periklis and Castro,Miguel}
}
@conference {15918,
	title = {Sectored Random Projections for Cancelable Iris Biometrics},
	booktitle = {2010 IEEE International Conference on Acoustics Speech and Signal Processing (ICASSP)},
	year = {2010},
	month = {2010/03//},
	pages = {1838 - 1841},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Privacy and security are essential requirements in practical biometric systems. In order to prevent the theft of biometric patterns, it is desired to modify them through revocable and non invertible transformations called Cancelable Biometrics. In this paper, we propose an efficient algorithm for generating a Cancelable Iris Biometric based on Sectored Random Projections. Our algorithm can generate a new pattern if the existing one is stolen, retain the original recognition performance and prevent extraction of useful information from the transformed patterns. Our method also addresses some of the drawbacks of existing techniques and is robust to degradations due to eyelids and eyelashes.},
	keywords = {biometric pattern, Biometrics, Cancelable Biometrics, cancelable iris biometrics, data mining, data privacy, Degradation, Eyelashes, Eyelids, Iris, iris recognition, pattern recognition, privacy, random processes, Random Projections, Robustness, sectored random projection, Secure Biometrics, Security, security of data},
	isbn = {978-1-4244-4295-9},
	doi = {10.1109/ICASSP.2010.5495383},
	author = {Pillai,J.K. and Patel, Vishal M. and Chellapa, Rama and Ratha,N. K}
}
@conference {19029,
	title = {Controlling data in the cloud: outsourcing computation without outsourcing control},
	series = {CCSW {\textquoteright}09},
	year = {2009},
	month = {2009},
	pages = {85 - 90},
	publisher = {ACM},
	organization = {ACM},
	abstract = {Cloud computing is clearly one of today{\textquoteright}s most enticing technology areas due, at least in part, to its cost-efficiency and flexibility. However, despite the surge in activity and interest, there are significant, persistent concerns about cloud computing that are impeding momentum and will eventually compromise the vision of cloud computing as a new IT procurement model. In this paper, we characterize the problems and their impact on adoption. In addition, and equally importantly, we describe how the combination of existing research thrusts has the potential to alleviate many of the concerns impeding adoption. In particular, we argue that with continued research advances in trusted computing and computation-supporting encryption, life in the cloud can be advantageous from a business intelligence standpoint over the isolated alternative that is more common today.},
	keywords = {Cloud computing, privacy, Security},
	isbn = {978-1-60558-784-4},
	url = {http://doi.acm.org/10.1145/1655008.1655020},
	author = {Chow, Richard and Golle, Philippe and Jakobsson, Markus and Elaine Shi and Staddon, Jessica and Masuoka, Ryusuke and Molina,Jesus}
}
@conference {17531,
	title = {Fighting Spam with the NeighborhoodWatch DHT},
	booktitle = {IEEE INFOCOM 2009},
	year = {2009},
	month = {2009/04/19/25},
	pages = {1755 - 1763},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In this paper, we present DHTBL, an anti-spam blacklist built upon a novel secure distributed hash table (DHT). We show how DHTBL can be used to replace existing DNS-based blacklists (DNSBLs) of IP addresses of mail relays that forward spam. Implementing a blacklist on a DHT improves resilience to DoS attacks and secures message delivery, when compared to DNSBLs. However, due to the sensitive nature of the blacklist, storing the data in a peer-to-peer DHT would invite attackers to infiltrate the system. Typical DHTs can withstand fail-stop failures, but malicious nodes may provide incorrect routing information, refuse to return published items, or simply ignore certain queries. The neighborhoodwatch DHT is resilient to malicious nodes and maintains the O(logiV) bounds on routing table size and expected lookup time. NeighborhoodWatch depends on two assumptions in order to make these guarantees: (1) the existence of an on-line trusted authority that periodically contacts and issues signed certificates to each node, and (2) for every sequence of k + 1 consecutive nodes in the ID space, at least one is alive and non-malicious. We show how NeighborhoodWatch maintains many of its security properties even when the second assumption is violated. Honest nodes in NeighborhoodWatch can detect malicious behavior and expel the responsible nodes from the DHT.},
	keywords = {Communications Society, computer crime, cryptography, Databases, IP addresses, IP networks, on-line trusted authority, Peer to peer computing, peer-to-peer computing, peer-to-peer distributed hash table, Postal services, Relays, Resilience, Routing, Security, table size routing, Unsolicited electronic mail},
	isbn = {978-1-4244-3512-8},
	doi = {10.1109/INFCOM.2009.5062095},
	author = {Bender,A. and Sherwood,R. and Monner,D. and Goergen,N. and Spring, Neil and Bhattacharjee, Bobby}
}
@article {18544,
	title = {Accountable internet protocol (aip)},
	journal = {SIGCOMM Comput. Commun. Rev.},
	volume = {38},
	year = {2008},
	month = {2008/08//},
	pages = {339 - 350},
	abstract = {This paper presents AIP (Accountable Internet Protocol), a network architecture that provides accountability as a first-order property. AIP uses a hierarchy of self-certifying addresses, in which each component is derived from the public key of the corresponding entity. We discuss how AIP enables simple solutions to source spoofing, denial-of-service, route hijacking, and route forgery. We also discuss how AIP{\textquoteright}s design meets the challenges of scaling, key management, and traffic engineering.},
	keywords = {accountability, address, internet architecture, scalability, Security},
	isbn = {0146-4833},
	doi = {10.1145/1402946.1402997},
	url = {http://doi.acm.org/10.1145/1402946.1402997},
	author = {Andersen,David G. and Balakrishnan,Hari and Feamster, Nick and Koponen,Teemu and Moon,Daekyeong and Shenker,Scott}
}
@conference {18548,
	title = {Authenticated out-of-band communication over social links},
	booktitle = {Proceedings of the first workshop on Online social networks},
	series = {WOSN {\textquoteright}08},
	year = {2008},
	month = {2008///},
	pages = {61 - 66},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Many existing host-based applications rely on their own authentication mechanisms and peer discovery services. Although social networking sites already provide mechanisms for users both to discover other users (e.g., by logging on to the social network Web site) and to communicate securely with each other (e.g., using instant messages within the social networking site), today{\textquoteright}s applications have no way to exploit the relationships and trust that are inherent in these networks. This paper proposes Authenticatr, a framework that allows applications to use the authentication and peer discovery mechanisms inherent in social networking sites to bootstrap their own authenticated communication channels. We describe motivating applications, detail the interface that Authenticatr exposes to applications, and discuss practical considerations and security threats.},
	keywords = {Authentication, Security, social networks},
	isbn = {978-1-60558-182-8},
	doi = {10.1145/1397735.1397749},
	url = {http://doi.acm.org/10.1145/1397735.1397749},
	author = {Ramachandran,Anirudh V. and Feamster, Nick}
}
@conference {19601,
	title = {Efficient Integrity Checking of Untrusted Network Storage},
	booktitle = {StorageSS {\textquoteright}08 Proceedings of the 4th ACM International Workshop on Storage Security and Survivability },
	series = {StorageSS {\textquoteright}08},
	year = {2008},
	month = {2008///},
	pages = {43 - 54},
	publisher = {ACM},
	organization = {ACM},
	abstract = {Outsourced storage has become more and more practical in recent years. Users can now store large amounts of data in multiple servers at a relatively low price. An important issue for outsourced storage systems is to design an efficient scheme to assure users that their data stored at remote servers has not been tampered with. This paper presents a general method and a practical prototype application for verifying the integrity of files in an untrusted network storage service. The verification process is managed by an application running in a trusted environment (typically on the client) that stores just one cryptographic hash value of constant size, corresponding to the "digest" of an authenticated data structure. The proposed integrity verification service can work with any storage service since it is transparent to the storage technology used. Experimental results show that our integrity verification method is efficient and practical for network storage systems.},
	keywords = {authenticated data structures, data integrity, Security, untrusted outsourced storage},
	isbn = {978-1-60558-299-3},
	url = {http://doi.acm.org/10.1145/1456469.1456479},
	author = {Heitzmann, Alexander and Palazzi, Bernardo and Charalampos Papamanthou and Tamassia, Roberto}
}
@conference {18570,
	title = {Filtering spam with behavioral blacklisting},
	booktitle = {Proceedings of the 14th ACM conference on Computer and communications security},
	series = {CCS {\textquoteright}07},
	year = {2007},
	month = {2007///},
	pages = {342 - 351},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Spam filters often use the reputation of an IP address (or IP address range) to classify email senders. This approach worked well when most spam originated from senders with fixed IP addresses, but spam today is also sent from IP addresses for which blacklist maintainers have outdated or inaccurate information (or no information at all). Spam campaigns also involve many senders, reducing the amount of spam any particular IP address sends to a single domain; this method allows spammers to stay "under the radar". The dynamism of any particular IP address begs for blacklisting techniques that automatically adapt as the senders of spam change. This paper presents SpamTracker, a spam filtering system that uses a new technique called behavioral blacklisting to classify email senders based on their sending behavior rather than their identity. Spammers cannot evade SpamTracker merely by using "fresh" IP addresses because blacklisting decisions are based on sending patterns, which tend to remain more invariant. SpamTracker uses fast clustering algorithms that react quickly to changes in sending patterns. We evaluate SpamTracker{\textquoteright}s ability to classify spammers using email logs for over 115 email domains; we find that SpamTracker can correctly classify many spammers missed by current filtering techniques. Although our current datasets prevent us from confirming SpamTracker{\textquoteright}s ability to completely distinguish spammers from legitimate senders, our evaluation shows that SpamTracker can identify a significant fraction of spammers that current IP-based blacklists miss. SpamTracker{\textquoteright}s ability to identify spammers before existing blacklists suggests that it can be used in conjunction with existing techniques (e.g., as an input to greylisting). SpamTracker is inherently distributed and can be easily replicated; incorporating it into existing email filtering infrastructures requires only small modifications to mail server configurations.},
	keywords = {blacklists, botnets, clustering, Security, spam},
	isbn = {978-1-59593-703-2},
	doi = {10.1145/1315245.1315288},
	url = {http://doi.acm.org/10.1145/1315245.1315288},
	author = {Ramachandran,Anirudh and Feamster, Nick and Vempala,Santosh}
}
@article {18233,
	title = {Joint coding and embedding techniques for MultimediaFingerprinting},
	journal = {Information Forensics and Security, IEEE Transactions on},
	volume = {1},
	year = {2006},
	month = {2006/06//},
	pages = {231 - 247},
	abstract = {Digital fingerprinting protects multimedia content from illegal redistribution by uniquely marking every copy of the content distributed to each user. The collusion attack is a powerful attack where several different fingerprinted copies of the same content are combined together to attenuate or even remove the fingerprints. One major category of collusion-resistant fingerprinting employs an explicit step of coding. Most existing works on coded fingerprinting mainly focus on the code-level issues and treat the embedding issues through abstract assumptions without examining the overall performance. In this paper, we jointly consider the coding and embedding issues for coded fingerprinting systems and examine their performance in terms of collusion resistance, detection computational complexity, and distribution efficiency. Our studies show that coded fingerprinting has efficient detection but rather low collusion resistance. Taking advantage of joint coding and embedding, we propose a permuted subsegment embedding technique and a group-based joint coding and embedding technique to improve the collusion resistance of coded fingerprinting while maintaining its efficient detection. Experimental results show that the number of colluders that the proposed methods can resist is more than three times as many as that of the conventional coded fingerprinting approaches.},
	keywords = {coding-embedding, coding;, collusion-resistant, complexity;, computational, data;, DETECTION, embedded, EMBEDDING, fingerprinting;, group-based, image, joint, multimedia, of, Security, subsegment, systems;, technique;, techniques;},
	isbn = {1556-6013},
	doi = {10.1109/TIFS.2006.873597},
	author = {He,Shan and M. Wu}
}
@conference {18610,
	title = {Understanding the network-level behavior of spammers},
	booktitle = {Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications},
	series = {SIGCOMM {\textquoteright}06},
	year = {2006},
	month = {2006///},
	pages = {291 - 302},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {This paper studies the network-level behavior of spammers, including: IP address ranges that send the most spam, common spamming modes (e.g., BGP route hijacking, bots), how persistent across time each spamming host is, and characteristics of spamming botnets. We try to answer these questions by analyzing a 17-month trace of over 10 million spam messages collected at an Internet "spam sinkhole", and by correlating this data with the results of IP-based blacklist lookups, passive TCP fingerprinting information, routing information, and botnet "command and control" traces.We find that most spam is being sent from a few regions of IP address space, and that spammers appear to be using transient "bots" that send only a few pieces of email over very short periods of time. Finally, a small, yet non-negligible, amount of spam is received from IP addresses that correspond to short-lived BGP routes, typically for hijacked prefixes. These trends suggest that developing algorithms to identify botnet membership, filtering email messages based on network-level properties (which are less variable than email content), and improving the security of the Internet routing infrastructure, may prove to be extremely effective for combating spam.},
	keywords = {BGP, botnet, network management, Security, spam},
	isbn = {1-59593-308-5},
	doi = {10.1145/1159913.1159947},
	url = {http://doi.acm.org/10.1145/1159913.1159947},
	author = {Ramachandran,Anirudh and Feamster, Nick}
}
@conference {18227,
	title = {Improving collusion resistance of error correcting code based multimedia fingerprinting},
	booktitle = {Acoustics, Speech, and Signal Processing, 2005. Proceedings. (ICASSP {\textquoteright}05). IEEE International Conference on},
	volume = {2},
	year = {2005},
	month = {2005/03//},
	pages = {ii/1029 - ii/1032 Vol. 2 - ii/1029 - ii/1032 Vol. 2},
	abstract = {Digital fingerprinting protects multimedia content from illegal redistribution by uniquely marking copies of the content distributed to each user. Collusion is a powerful attack whereby several differently fingerprinted copies of the same content are combined together to attenuate or remove the fingerprints. Focusing on the error correction code (ECC) based fingerprinting, we explore in this paper new avenues that can substantially improve its collusion resistance, and in the mean time retain its advantages in detection complexity and fast distribution. Our analysis suggests a great need of jointly considering the coding, embedding, and detection issues, and inspires the proposed technique of permuted subsegment embedding that is able to substantially improve the collusion resistance of ECC based fingerprinting.},
	keywords = {based, code, codes;, coding;, collusion, correcting, correction, data;, detection;, digital, ECC;, embedding;, error, fingerprint, fingerprinting, fingerprinting;, multimedia, of, permuted, resistance;, Security, signatures;, subsegment, systems;},
	doi = {10.1109/ICASSP.2005.1415583},
	author = {He,Shan and M. Wu}
}
@article {15071,
	title = {A pairwise key predistribution scheme for wireless sensor networks},
	journal = {ACM Trans. Inf. Syst. Secur.},
	volume = {8},
	year = {2005},
	month = {2005/05//},
	pages = {228 - 258},
	abstract = {To achieve security in wireless sensor networks, it is important to be able to encrypt and authenticate messages sent between sensor nodes. Before doing so, keys for performing encryption and authentication must be agreed upon by the communicating parties. Due to resource constraints, however, achieving key agreement in wireless sensor networks is nontrivial. Many key agreement schemes used in general networks, such as Diffie-Hellman and other public-key based schemes, are not suitable for wireless sensor networks due to the limited computational abilities of the sensor nodes. Predistribution of secret keys for all pairs of nodes is not viable due to the large amount of memory this requires when the network size is large.In this paper, we provide a framework in which to study the security of key predistribution schemes, propose a new key predistribution scheme which substantially improves the resilience of the network compared to previous schemes, and give an in-depth analysis of our scheme in terms of network resilience and associated overhead. Our scheme exhibits a nice threshold property: when the number of compromised nodes is less than the threshold, the probability that communications between any additional nodes are compromised is close to zero. This desirable property lowers the initial payoff of smaller-scale network breaches to an adversary, and makes it necessary for the adversary to attack a large fraction of the network before it can achieve any significant gain.},
	keywords = {key predistribution, Security, Wireless sensor networks},
	isbn = {1094-9224},
	doi = {10.1145/1065545.1065548},
	url = {http://doi.acm.org/10.1145/1065545.1065548},
	author = {Du,Wenliang and Deng,Jing and Han,Yunghsiang S. and Varshney,Pramod K. and Katz, Jonathan and Khalili,Aram}
}
@conference {18280,
	title = {Security of feature extraction in image hashing},
	booktitle = {Acoustics, Speech, and Signal Processing, 2005. Proceedings. (ICASSP {\textquoteright}05). IEEE International Conference on},
	volume = {2},
	year = {2005},
	month = {2005/03//},
	pages = {ii/1041 - ii/1044 Vol. 2 - ii/1041 - ii/1044 Vol. 2},
	abstract = {Security and robustness are two important requirements for image hash functions. We introduce "differential entropy" as a metric to quantify the amount of randomness in image hash functions and to study their security. We present a mathematical framework and derive expressions for the proposed security metric for various common image hashing schemes. Using the proposed security metric, we discuss the trade-offs between security and robustness in image hashing.},
	keywords = {cryptography;, differential, digital, entropy;, extraction;, feature, functions;, hash, hashing;, image, metric;, processing;, randomness;, robustness;, Security, signature;, signatures;},
	doi = {10.1109/ICASSP.2005.1415586},
	author = {Swaminathan,A. and Mao,Yinian and M. Wu}
}
@article {18180,
	title = {Collusion-resistant fingerprinting for multimedia},
	journal = {Signal Processing Magazine, IEEE},
	volume = {21},
	year = {2004},
	month = {2004/03//},
	pages = {15 - 27},
	abstract = {Digital fingerprinting is a technology for enforcing digital rights policies whereby unique labels, known as digital fingerprints, are inserted into content prior to distribution. For multimedia content, fingerprints can be embedded using conventional watermarking techniques that are typically concerned with robustness against a variety of attacks mounted by an individual. These attacks, known as multiuser collusion attacks, provide a cost-effective method for attenuating each of the colluder{\textquoteright}s fingerprints and poses a real threat to protecting media data and enforcing usage policies. In this article, we review some major design methodologies for collusion-resistant fingerprinting of multimedia and highlight common and unique issues of different fingerprinting techniques. It also provides detailed discussions on the two major classes of fingerprinting strategies, namely, orthogonal fingerprinting and correlated fingerprinting.},
	keywords = {attacks;, colluder, collusion, collusion-resistant, content;, correlated, data;, digital, fingerprinting;, identification;, multimedia, multiuser, of, orthogonal, policies;, rights, Security, systems;, techniques;, tracing;, watermarking, watermarking;},
	isbn = {1053-5888},
	doi = {10.1109/MSP.2004.1276103},
	author = {M. Wu and Trappe,W. and Wang,Z.J. and Liu,K. J.R}
}
@conference {12069,
	title = {Copilot - a coprocessor-based kernel runtime integrity monitor},
	booktitle = {Proceedings of the 13th conference on USENIX Security Symposium - Volume 13},
	series = {SSYM{\textquoteright}04},
	year = {2004},
	month = {2004///},
	pages = {13 - 13},
	publisher = {USENIX Association},
	organization = {USENIX Association},
	address = {San Diego, CA},
	abstract = {Copilot is a coprocessor-based kernel integrity monitor for commodity systems. Copilot is designed to detect malicious modifications to a host{\textquoteright}s kernel and has correctly detected the presence of 12 real-world rootkits, each within 30 seconds of their installation with less than a 1\% penalty to the host{\textquoteright}s performance. Copilot requires no modifications to the protected host{\textquoteright}s software and can be expected to operate correctly even when the host kernel is thoroughly compromised - an advantage over traditional monitors designed to run on the host itself.},
	keywords = {design, management, MONITORS, Security, security and protection},
	url = {http://portal.acm.org/citation.cfm?id=1251375.1251388},
	author = {Petroni,Jr. and Fraser,Timothy and Molina,Jesus and Arbaugh, William A.}
}
@conference {18278,
	title = {Security evaluation for communication-friendly encryption of multimedia},
	booktitle = {Image Processing, 2004. ICIP {\textquoteright}04. 2004 International Conference on},
	volume = {1},
	year = {2004},
	month = {2004/10//},
	pages = {569 - 572 Vol. 1 - 569 - 572 Vol. 1},
	abstract = {This paper addresses the access control issues unique to multimedia, by using a joint signal processing and cryptographic approach to multimedia encryption. Based on three atomic encryption primitives, we present a systematic study on how to strategically integrate different atomic operations to build a video encryption system. We also propose a set of multimedia-specific security metrics to quantify the security against approximation attacks and to complement the existing notion of generic data security. The resulting system can provide superior performance to both generic encryption and its simple adaptation to video in terms of a joint consideration of security, bitrate overhead, and communication friendliness.},
	keywords = {access, approximation, atomic, attacks;, bitrate, coding;, communication-friendly, communication;, control;, cryptography;, data, encryption, encryption;, generic, joint, method;, metrics;, multimedia, multimedia-specific, overhead;, primitives;, processing/cryptographic, Security, security;, signal, system;, Telecommunication, video},
	doi = {10.1109/ICIP.2004.1418818},
	author = {Mao,Yinian and M. Wu}
}
@article {18437,
	title = {Susceptibility matrix: a new aid to software auditing},
	journal = {Security Privacy, IEEE},
	volume = {2},
	year = {2004},
	month = {2004/04//mar},
	pages = {16 - 21},
	abstract = {Testing for security is lengthy, complex, and costly, so focusing test efforts in areas that have the greatest number of security vulnerabilities is essential. This article describes a taxonomy-based approach that gives an insight into the distribution of vulnerabilities in a system.},
	keywords = {approach;, auditing;, data;, matrix;, of, program, Security, software, susceptibility, taxonomy-based, testing;, vulnerabilities;},
	isbn = {1540-7993},
	doi = {10.1109/MSECP.2004.1281240},
	author = {Jiwnani,K. and Zelkowitz, Marvin V}
}
@conference {19046,
	title = {The sybil attack in sensor networks: analysis \& defenses},
	series = {IPSN {\textquoteright}04},
	year = {2004},
	month = {2004},
	pages = {259 - 268},
	publisher = {ACM},
	organization = {ACM},
	abstract = {Security is important for many sensor network applications. A particularly harmful attack against sensor and ad hoc networks is known as the Sybil attack [6], where a node illegitimately claims multiple identities. This paper systematically analyzes the threat posed by the Sybil attack to wireless sensor networks. We demonstrate that the attack can be exceedingly detrimental to many important functions of the sensor network such as routing, resource allocation, misbehavior detection, etc. We establish a classification of different types of the Sybil attack, which enables us to better understand the threats posed by each type, and better design countermeasures against each type. We then propose several novel techniques to defend against the Sybil attack, and analyze their effectiveness quantitatively.},
	keywords = {Security, sensor networks, sybil attack},
	isbn = {1-58113-846-6},
	url = {http://doi.acm.org/10.1145/984622.984660},
	author = {Newsome, James and Elaine Shi and Song, Dawn and Perrig, Adrian}
}
@conference {12289,
	title = {Trust-preserving set operations},
	booktitle = {INFOCOM 2004. Twenty-third AnnualJoint Conference of the IEEE Computer and Communications Societies},
	volume = {4},
	year = {2004},
	month = {2004/03//},
	pages = {2231 - 2241 vol.4 - 2231 - 2241 vol.4},
	abstract = {We describe a method for performing trust-preserving set operations by untrusted parties. Our motivation for this is the problem of securely reusing content-based search results in peer-to-peer networks. We model search results and indexes as data sets. Such sets have value for answering a new query only if they are trusted. In the absence of any system-wide security mechanism, a data set is trusted by a node a only if it was generated by some node which is trusted by a. Our main contributions are a formal definition of the problem as well as an efficient scheme that solves this problem by allowing untrusted peers to perform set operations on trusted data sets while also producing unforgeable proofs of correctness. This is accomplished by requiring trusted nodes to sign appropriately-defined digests of generated sets; each such digest consists of an RSA accumulator and a Bloom filter. The scheme is general, and has other applications as well. We give an analysis demonstrating the low overhead of the scheme, and we include experimental data which confirm the analysis.},
	keywords = {accumulator;, Bloom, computing;, filter;, mechanism;, network;, operation;, peer-to-peer, RSA, Security, security;, set, system-wide, Telecommunication, theory;, trust-preserving},
	doi = {10.1109/INFCOM.2004.1354646},
	author = {Morselli,R. and Bhattacharjee, Bobby and Katz, Jonathan and Keleher,P.}
}
@article {18167,
	title = {Anti-collusion fingerprinting for multimedia},
	journal = {Signal Processing, IEEE Transactions on},
	volume = {51},
	year = {2003},
	month = {2003/04//},
	pages = {1069 - 1087},
	abstract = {Digital fingerprinting is a technique for identifying users who use multimedia content for unintended purposes, such as redistribution. These fingerprints are typically embedded into the content using watermarking techniques that are designed to be robust to a variety of attacks. A cost-effective attack against such digital fingerprints is collusion, where several differently marked copies of the same content are combined to disrupt the underlying fingerprints. We investigate the problem of designing fingerprints that can withstand collusion and allow for the identification of colluders. We begin by introducing the collusion problem for additive embedding. We then study the effect that averaging collusion has on orthogonal modulation. We introduce a tree-structured detection algorithm for identifying the fingerprints associated with K colluders that requires O(Klog(n/K)) correlations for a group of n users. We next develop a fingerprinting scheme based on code modulation that does not require as many basis signals as orthogonal modulation. We propose a new class of codes, called anti-collusion codes (ACCs), which have the property that the composition of any subset of K or fewer codevectors is unique. Using this property, we can therefore identify groups of K or fewer colluders. We present a construction of binary-valued ACC under the logical AND operation that uses the theory of combinatorial designs and is suitable for both the on-off keying and antipodal form of binary code modulation. In order to accommodate n users, our code construction requires only O( radic;n) orthogonal signals for a given number of colluders. We introduce three different detection strategies that can be used with our ACC for identifying a suspect set of colluders. We demonstrate the performance of our ACC for fingerprinting multimedia and identifying colluders through experiments using Gaussian signals and real images.},
	keywords = {(mathematics);, additive, algorithm;, and, anti-collusion, attack;, averaging, binary, code, codes;, codevectors;, coding;, colluders, collusion;, combinatorial, communication;, compression;, correlation;, cost-effective, data, data;, design, DETECTION, detection;, digital, embedding;, fingerprinting;, Gaussian, identification;, image, images;, keying;, logical, mathematics;, Modulation, modulation;, multimedia, multimedia;, of, on-off, operation;, orthogonal, processes;, real, redistribution;, Security, signal, signals;, theory;, tree-structured, TREES, watermarking;},
	isbn = {1053-587X},
	doi = {10.1109/TSP.2003.809378},
	author = {Trappe,W. and M. Wu and Wang,Z.J. and Liu,K. J.R}
}
@conference {12076,
	title = {Bootstrapping security associations for routing in mobile ad-hoc networks},
	booktitle = {IEEE Global Telecommunications Conference, 2003. GLOBECOM {\textquoteright}03},
	volume = {3},
	year = {2003},
	month = {2003/12/01/5},
	pages = {1511- 1515 vol.3 - 1511- 1515 vol.3},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {To date, most solutions proposed for secure routing in mobile ad-hoc networks (MANETs), assume that secure associations between pairs of nodes can be established on-line; e.g., by a trusted third party, by distributed trust establishment. However, establishing such security associations, with or without trusted third parties, requires reliance on routing layer security. In this paper, we eliminate this apparent cyclic dependency between security services and secure routing in MANETs and show how to bootstrap security for the routing layer. We use the notion of statistically unique and cryptographically verifiable (SUCV) identifiers to implement a secure binding between IP addresses and keys that is independent of any trusted security service. We illustrate our solution with the dynamic source routing (DSR) protocol and compare it with other solutions for secure routing.},
	keywords = {ad hoc networks, bootstrapping security association, Cryptographic protocols, dynamic source routing protocol, Fabrics, Intelligent networks, IP address, IP key, IP networks, Message authentication, mobile ad-hoc network, mobile radio, Protection, Public key, public key cryptography, routing layer security reliability, routing protocols, secure routing, Security, security service, statistically unique cryptographically verification, telecommunication security},
	isbn = {0-7803-7974-8},
	doi = {10.1109/GLOCOM.2003.1258490},
	author = {Bobba,R. B and Eschenauer,L. and Gligor,V. and Arbaugh, William A.}
}
@article {12301,
	title = {Deno: a decentralized, peer-to-peer object-replication system for weakly connected environments},
	journal = {Computers, IEEE Transactions on},
	volume = {52},
	year = {2003},
	month = {2003/07//},
	pages = {943 - 959},
	abstract = {This paper presents the design, implementation, and evaluation of the replication framework of Deno, a decentralized, peer-to-peer object-replication system targeted for weakly connected environments. Deno uses weighted voting for availability and pair-wise, epidemic information flow for flexibility. This combination allows the protocols to operate with less than full connectivity, to easily adapt to changes in group membership, and to make few assumptions about the underlying network topology. We present two versions of Deno{\textquoteright}s protocol that differ in the consistency levels they support. We also propose security extensions to handle a class of malicious actions that involve misrepresentation of protocol information. Deno has been implemented and runs on top of Linux and Win32 platforms. We use the Deno prototype to characterize the performance of the Deno protocols and extensions. Our study reveals several interesting results that provide fundamental insight into the benefits of decentralization and the mechanics of epidemic protocols.},
	keywords = {actions;, connected, consistency, data, data;, databases;, decentralized, Deno;, distributed, environments;, epidemic, group, levels;, Linux;, malicious, management;, membership;, network, object, object-replication, of, operating, peer-to-peer, protocols;, replicated, replication;, Security, security;, synchronisation;, system;, systems;, topology;, Unix;, voting;, weakly, weighted, Win32;},
	isbn = {0018-9340},
	doi = {10.1109/TC.2003.1214342},
	author = {Cetintemel,U. and Keleher,P. J and Bhattacharjee, Bobby and Franklin,M.J.}
}
@article {18234,
	title = {Joint security and robustness enhancement for quantization based data embedding},
	journal = {Circuits and Systems for Video Technology, IEEE Transactions on},
	volume = {13},
	year = {2003},
	month = {2003/08//},
	pages = {831 - 841},
	abstract = {The paper studies joint security and robustness enhancement of quantization-based data embedding for multimedia authentication applications. We present an analysis showing that through a nontrivial run lookup table (LUT) that maps quantized multimedia features randomly to binary data, the probability of detection error can be considerably smaller than the traditional quantization embedding. We quantify the security strength of LUT embedding and enhance its robustness through distortion compensation. Introducing a joint security and capacity measure, we show that the proposed distortion-compensated LUT embedding provides joint enhancement of security and robustness over the traditional quantization embedding.},
	keywords = {(signal);, authentication;, binary, compensation;, data, data;, DETECTION, digital, distortion, distortion;, embedding;, encapsulation;, enhancement;, error, features;, hiding;, lookup, lookup;, LUT;, message, multimedia, nontrivial, probability;, quantisation, quantization, quantized, Robustness, run, Security, statistics;, systems;, table, table;, watermarking;},
	isbn = {1051-8215},
	doi = {10.1109/TCSVT.2003.815951},
	author = {Wu,M.}
}
@conference {18266,
	title = {Resistance of orthogonal Gaussian fingerprints to collusion attacks},
	booktitle = {Multimedia and Expo, 2003. ICME {\textquoteright}03. Proceedings. 2003 International Conference on},
	volume = {1},
	year = {2003},
	month = {2003/07//},
	pages = {I - 617-20 vol.1 - I - 617-20 vol.1},
	abstract = {Digital fingerprinting is a means to offer protection to digital data by which fingerprints embedded in the multimedia are capable of identifying unauthorized use of digital content. A powerful attack that can be employed to reduce this tracing capability is collusion. In this paper, we study the collusion resistance of a fingerprinting system employing Gaussian distributed fingerprints and orthogonal modulation. We propose a likelihood-based approach to estimate the number of colluders, and introduce the thresholding detector for colluder identification. We first analyze the collusion resistance of a system to the average attack by considering the probability of a false negative and the probability of a false positive when identifying colluders. Lower and upper bounds for the maximum number of colluders K<sub>max</sub> are derived. We then show that the detectors are robust to different attacks. We further study different sets of performance criteria.},
	keywords = {approach;, attacks;, capability;, collusion, data, data;, digital, distributed, embedded, fingerprinting;, fingerprints;, Gaussian, likelihood-based, modulation;, multimedia, of, orthogonal, probability;, processes;, protection;, Security, systems;, tracing},
	doi = {10.1109/ICME.2003.1220993},
	author = {Wang,Z.J. and M. Wu and Zhao,Hong and Liu,K. J.R and Trappe,W.}
}
@conference {12078,
	title = {A secure service discovery protocol for MANET},
	booktitle = {14th IEEE Proceedings on Personal, Indoor and Mobile Radio Communications, 2003. PIMRC 2003},
	volume = {1},
	year = {2003},
	month = {2003/09/07/10},
	pages = {502- 506 Vol.1 - 502- 506 Vol.1},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Service discovery technologies are exploited to enable services to advertise their existence in a dynamic way, and can be discovered, configured and used by other devices with minimum manual efforts. It plays an essential role in future network scenarios especially with development of mobile ad hoc network (MANET) and emergence of pervasive computing. Because MANET allows these devices to communicate dynamically without fixed infrastructure and centralized administration, it gives rise to the challenges of the service discovery techniques. In this paper, we present a dynamic service discovery infrastructure that uses XML to describe services and match using the semantic content of service descriptions for MANET. We believe that the architecture we have designed is a necessary component of service discovery in non-infrastructure network by further exploring the secure and performance issues of this infrastructure.},
	keywords = {ad hoc networks, centralized administration, Computer architecture, Computer science, dynamic service discovery infrastructure, Educational institutions, MANET, Manuals, mobile ad hoc network, Mobile ad hoc networks, Mobile computing, mobile radio, noninfrastructure network, Pervasive computing, Protocols, routing protocols, secure service discovery protocol, Security, service discovery techniques, service discovery technologies, telecommunication computing, telecommunication services, XML},
	isbn = {0-7803-7822-9},
	doi = {10.1109/PIMRC.2003.1264322},
	author = {Yuan Yuan and Arbaugh, William A.}
}
@conference {14695,
	title = {Experiences with capsule-based active networking},
	booktitle = {DARPA Active NEtworks Conference and Exposition, 2002. Proceedings},
	year = {2002},
	month = {2002///},
	pages = {16 - 24},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Active networking adds programmability to the elements of the network, most aggressively by using programmable packets, or capsules. ANTS [22, 21] and PLANet [10, 8] are the most mature examples of capsule-based systems, both having been publicly available for several years. This paper presents our experience with these systems and the lessons they hold for the future of capsule-based active networking. The paper focuses on four key issues: flexibility, performance, security, and usability. We consider how ANTS and PLANet address these issues, noting that despite substantial surface differences, both systems identify similar key problems and use closely related solutions. Based on our experience with these systems we conclude that capsule-based systems can achieve useful levels of flexibility, performance, and usability. Many aspects of security can also be adequately addressed, but some important problems related to denial of service remain as open problems},
	keywords = {active networking, ANTS, application-specific routing, capsule architecture, capsule-based systems, computer crime, Computer network management, Computer networks, Computer science, Contracts, Electronic switching systems, INFORMATION SCIENCE, Internet, internetworking, network management, PLANet, Planets, programmability, programmable packets, Programming, Security, Standards development, telecommunication network routing, usability},
	isbn = {0-7695-1564-9},
	doi = {10.1109/DANCE.2002.1003481},
	author = {Hicks, Michael W. and Moore,J. T and Wetherall,D. and Nettles,S.}
}
@conference {17243,
	title = {Interacting with identification technology: can it make us more secure?},
	booktitle = {CHI {\textquoteright}02 extended abstracts on Human factors in computing systems},
	series = {CHI EA {\textquoteright}02},
	year = {2002},
	month = {2002///},
	pages = {564 - 565},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	keywords = {Biometrics, civil liberties, face recognition, national id card, privacy, Security},
	isbn = {1-58113-454-1},
	doi = {10.1145/506443.506484},
	url = {http://doi.acm.org/10.1145/506443.506484},
	author = {Scholtz,Jean and Johnson,Jeff and Shneiderman, Ben and Hope-Tindall,Peter and Gosling,Marcus and Phillips,Jonathon and Wexelblat,Alan}
}
@conference {18400,
	title = {Maintaining software with a security perspective},
	booktitle = {Software Maintenance, 2002. Proceedings. International Conference on},
	year = {2002},
	month = {2002///},
	pages = {194 - 203},
	abstract = {Testing for software security is a lengthy, complex and costly process. Currently, security testing is done using penetration analysis and formal verification of security kernels. These methods are not complete and are difficult to use. Hence it is essential to focus testing effort in areas that have a greater number of security vulnerabilities to develop secure software as well as meet budget and time constraints. We propose a testing strategy based on a classification of vulnerabilities to develop secure and stable systems. This taxonomy will enable a system testing and maintenance group to understand the distribution of security vulnerabilities and prioritize their testing effort according to the impact the vulnerabilities have on the system. This is based on Landwehr{\textquoteright}s (1994) classification scheme for security flaws and we evaluated it using a database of 1360 operating system vulnerabilities. This analysis indicates vulnerabilities tend to be focused in relatively few areas and associated with a small number of software engineering issues.},
	keywords = {(computers);, budget, classification, classification;, constraints;, data;, engineering;, flaw, maintenance;, of, operating, program, scheme;, Security, software, stable, system, systems, systems;, testing;, TIME, vulnerabilities;, vulnerability},
	doi = {10.1109/ICSM.2002.1167766},
	author = {Jiwnani,K. and Zelkowitz, Marvin V}
}
@conference {14725,
	title = {Practical programmable packets},
	booktitle = {IEEE INFOCOM 2001. Twentieth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {1},
	year = {2001},
	month = {2001///},
	pages = {41-50 vol.1 - 41-50 vol.1},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present SNAP (safe and nimble active packets), a new scheme for programmable (or active) packets centered around a new low-level packet language. Unlike previous active packet approaches, SNAP is practical: namely, adding significant flexibility over IP without compromising safety and security or efficiency. In this paper we show how to compile from the well-known active picket language PLAN to SNAP, showing that SNAP retains PLAN{\textquoteright}s flexibility; give proof sketches of its novel approach to resource control; and present experimental data showing SNAP attains performance very close to that of a software IP router},
	keywords = {active picket language, Application software, complier, Contracts, Data security, efficiency, Explosives, INFORMATION SCIENCE, Internet, IP, IP networks, low-level packet language, packet switching, performance, PLAN, practical programmable packets, program compilers, Protection, resource control, Resource management, safe and nimble active packets, Safety, Security, SNAP, software IP router, Software performance, telecommunication security, Transport protocols},
	isbn = {0-7803-7016-3},
	doi = {10.1109/INFCOM.2001.916685},
	author = {Moore,J. T and Hicks, Michael W. and Nettles,S.}
}
@article {12072,
	title = {Safety and security of programmable network infrastructures},
	journal = {IEEE Communications Magazine},
	volume = {36},
	year = {1998},
	month = {1998/10//},
	pages = {84 - 92},
	abstract = {Safety and security are two reliability properties of a system. A {\textquotedblleft}safe{\textquotedblright} system provides protection against errors of trusted users, while a {\textquotedblleft}secure{\textquotedblright} system protects against errors introduced by untrusted users. There is considerable overlap between mechanisms to support each property. Requirements for rapid service creation have stimulated the development of programmable network infrastructures, where end users or service providers can customize the properties of a network infrastructure while it continues to operate. A central concern of potential users of such systems is their reliability and, most specifically, their safety and security. In this article we explain the impact the network service model and architecture have on safety and security, and provide a model with which policies can be translated into restrictions of a general system. We illustrate these ideas with the Secure Active Network Environment (SANE) architecture, which provides a means of controlling access to the functions provided by any programmable infrastructure},
	keywords = {Access control, error protection, IP networks, Multicast protocols, network architecture, network operating systems, network service model, operating system, Power system dynamics, Power system modeling, Power system reliability, programmable languages, programmable network infrastructures, programming languages, Proposals, Protection, reliability properties, Safety, Secure Active Network Environment, Security, security of data, service creation, service providers, Switches, telecommunication computing, telecommunication network reliability, Web and internet services},
	isbn = {0163-6804},
	doi = {10.1109/35.722141},
	author = {Alexander,S. and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
@article {12079,
	title = {The SwitchWare active network architecture},
	journal = {IEEE Network},
	volume = {12},
	year = {1998},
	month = {1998/06//May},
	pages = {29 - 36},
	abstract = {Active networks must balance the flexibility of a programmable network infrastructure against the safety and security requirements inherent in sharing that infrastructure. Furthermore, this balance must be achieved while maintaining the usability of the network. The SwitchWare active network architecture is a novel approach to achieving this balance using three layers: active packets, which contain mobile programs that replace traditional packets; active extensions, which provide services on the network elements and can be dynamically loaded; and a secure active router infrastructure, which forms a high-integrity base on which the security of the other layers depends. In addition to integrity checking and cryptography-based authentication, security in our architecture depends heavily on verification techniques from programming languages, such as strong type checking},
	keywords = {active extensions, active packets, Authentication, Computer languages, Computer networks, cryptography, cryptography-based authentication, high-integrity base, integrity checking, IP networks, LAN interconnection, mobile programs, network operating systems, packet switching, programmable network infrastructure, programming languages, Protocols, Safety, safety requirements, scalability, secure active router infrastructure, Security, security requirements, services, strong type checking, Switches, SwitchWare active network architecture, telecommunication network routing, Tin, usability, verification techniques},
	isbn = {0890-8044},
	doi = {10.1109/65.690959},
	author = {Alexander,D. S and Arbaugh, William A. and Hicks, Michael W. and Kakkar,P. and Keromytis,A. D and Moore,J. T and Gunter,C. A and Nettles,S. M and Smith,J. M}
}
@conference {12092,
	title = {A secure and reliable bootstrap architecture},
	booktitle = {, 1997 IEEE Symposium on Security and Privacy, 1997. Proceedings},
	year = {1997},
	month = {1997/05/04/7},
	pages = {65 - 71},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, the integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity {\textquotedblleft}chain{\textquotedblright} inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made, yet these guarantees are increasingly important to diverse applications such as Internet commerce, security systems and {\textquotedblleft}active networks{\textquotedblright}. In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems},
	keywords = {active networks, AEGIS architecture, bootstrap architecture, Computer architecture, computer bootstrapping, data integrity, Distributed computing, Hardware, hardware validity, initialization, integrity chain, integrity check failures, Internet, Internet commerce, IP networks, Laboratories, lower-layer integrity, Microprogramming, Operating systems, recovery process, reliability, robust systems, Robustness, Security, security of data, software reliability, system integrity guarantees, system recovery, transitions, Virtual machining},
	isbn = {0-8186-7828-3},
	doi = {10.1109/SECPRI.1997.601317},
	author = {Arbaugh, William A. and Farber,D. J and Smith,J. M}
}
