@article {14690,
	title = {Evaluating Dynamic Software Update Safety Using Systematic Testing},
	journal = {IEEE Transactions on Software Engineering},
	volume = {PP},
	year = {2011},
	pages = {1 - 1},
	abstract = {Dynamic software updating (DSU) systems patch programs on the fly without incurring downtime. To avoid failures due to the updating process itself, many DSU systems employ timing restrictions. However, timing restrictions are theoretically imperfect, and their practical effectiveness is an open question. This paper presents the first significant empirical evaluation of three popular timing restrictions: activeness safety (AS), which prevents updates to active functions; con-freeness safety (CFS), which only allows modifications to active functions when doing so is provably type-safe; and manual identification of the event-handling loops during which an update may occur. We evaluated these timing restrictions using a series of DSU patches to three programs: OpenSSH, vsftpd, and ngIRCd. We systematically applied updates at each distinct update point reached during execution of a suite of system tests for these programs to determine which updates pass and which fail. We found that all three timing restrictions prevented most failures, but only manual identification allowed none. Further, although CFS and AS allowed many more update points, manual identification still supported updates with minimal delay. Finally, we found that manual identification required the least developer effort. Overall, we conclude that manual identification is most effective.},
	keywords = {and serviceability, Availability, Computer Systems Organization, Delay, Manuals, Performance of Systems, reliability, Safety, servers, software, software engineering, Test execution, Testing and Debugging},
	isbn = {0098-5589},
	doi = {10.1109/TSE.2011.101},
	author = {Hayden,C. and Smith,E. and Hardisty,E. and Hicks, Michael W. and Foster, Jeffrey S.}
}
@conference {17299,
	title = {Motivation for Participation in Online Neighborhood Watch Communities: An Empirical Study Involving Invitation Letters},
	booktitle = {Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on and 2011 IEEE Third International Confernece on Social Computing (SocialCom)},
	year = {2011},
	month = {2011/10/09/11},
	pages = {760 - 765},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper presents a three-part experiment designed to investigate the motivations of users of a community safety and neighborhood watch social networking website. The experiment centers around an intervention into the invitation system that current users employ to invite nonmembers to join the site, and involves several versions of an invitation email which differ by expressing one of four possible motivations for using such a site. The research presented investigates how potential users{\textquoteright} choice of whether or not to join the site is affected by the use case presented by the invitation. It also includes an investigation of the motivations of current users of the site, as reported in an online survey. The experiment yielded no significant difference in responses to the emails. Overall, invitations that included a specific motivation slightly outperformed those which did not, but not to a statistically significant degree. We conclude that although users have specific motivations for using the site, as reported in the survey, attempting to increase response rates to invitation emails by suggesting use cases of the site is surprisingly unlikely to be successful.},
	keywords = {Art, Communities, community safety, Electronic mail, Interviews, invitation email, invitations, motivation, neighborhood watch, Online communities, online neighborhood watch communities, online survey, participation, Safety, Security, social media, Social network services, social networking (online), social networking Website},
	isbn = {978-1-4577-1931-8},
	doi = {10.1109/PASSAT/SocialCom.2011.108},
	author = {Violi,N. and Shneiderman, Ben and Hanson,A. and Rey,P. J}
}
@article {17203,
	title = {Human Responsibility for Autonomous Agents},
	journal = {IEEE Intelligent Systems},
	volume = {22},
	year = {2007},
	month = {2007/04//March},
	pages = {60 - 61},
	abstract = {Automated or autonomous systems can sometimes fail harmlessly, but they can also destroy data, compromise privacy, and consume resources, such as bandwidth or server capacity. What{\textquoteright}s more troubling is that automated systems embedded in vital systems can cause financial losses, destruction of property, and loss of life. Controlling these dangers will increase trust while enabling broader use of these systems with higher degrees of safety. Obvious threats stem from design errors and software bugs, but we can{\textquoteright}t overlook mistaken assumptions by designers, unanticipated actions by humans, and interference from other computerized systems. This article is part of a special issue on Interacting with Autonomy.},
	keywords = {Automatic control, Autonomous agents, autonomous systems, Bandwidth, Computer bugs, Computer errors, Control systems, data privacy, Human-computer interaction, HUMANS, Robots, Safety, Software design},
	isbn = {1541-1672},
	doi = {10.1109/MIS.2007.32},
	author = {Shneiderman, Ben}
}
@conference {18575,
	title = {Implications of autonomy for the expressiveness of policy routing},
	booktitle = {Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications},
	series = {SIGCOMM {\textquoteright}05},
	year = {2005},
	month = {2005///},
	pages = {25 - 36},
	publisher = {ACM},
	organization = {ACM},
	address = {New York, NY, USA},
	abstract = {Thousands of competing autonomous systems must cooperate with each other to provide global Internet connectivity. Each autonomous system (AS) encodes various economic, business, and performance decisions in its routing policy. The current interdomain routing system enables each AS to express policy using rankings that determine how each router inthe AS chooses among different routes to a destination, and filters that determine which routes are hidden from each neighboring AS. Because the Internet is composed of many independent, competing networks, the interdomain routing system should provide autonomy, allowing network operators to set their rankings independently, and to have no constraints on allowed filters. This paper studies routing protocol stability under these conditions. We first demonstrate that certain rankings that are commonly used in practice may not ensure routing stability. We then prove that, when providers can set rankings and filters autonomously, guaranteeing that the routing system will converge to a stable path assignment essentially requires ASes to rank routes based on AS-path lengths. We discuss the implications of these results for the future of interdomain routing.},
	keywords = {autonomy, BGP, Internet, policy, protocol, Routing, Safety, stability},
	isbn = {1-59593-009-4},
	doi = {10.1145/1080091.1080096},
	url = {http://doi.acm.org/10.1145/1080091.1080096},
	author = {Feamster, Nick and Johari,Ramesh and Balakrishnan,Hari}
}
@article {14653,
	title = {A secure PLAN},
	journal = {IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews},
	volume = {33},
	year = {2003},
	month = {2003/08//},
	pages = {413 - 426},
	abstract = {Active networks, being programmable, promise greater flexibility than current networks. Programmability, however, may introduce safety and security risks. This correspondence describes the design and implementation of a security architecture for the active network PLANet. Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN, with an environment of general-purpose service routines governed by trust management. In particular, a technique is used which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. The design and implementation of an active-network firewall and virtual private network is used as an application of the security architecture. Measurements of the system show that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets.},
	keywords = {active networks, active-network firewall, Authentication, Authorization, Contracts, cryptography, Environmental management, Extraterrestrial measurements, functionally restricted packet language, general-purpose service routines, Internet, latency overhead, namespace-based security, packet switching, PLANet, Planets, privilege level, programmable networks, Safety, safety risks, secure PLAN, security of data, security risks, trust management, two-level architecture, virtual private network, Virtual private networks, Web and internet services},
	isbn = {1094-6977},
	doi = {10.1109/TSMCC.2003.817347},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
@conference {14654,
	title = {A secure PLAN (extended version)},
	booktitle = {DARPA Active NEtworks Conference and Exposition, 2002. Proceedings},
	year = {2002},
	month = {2002///},
	pages = {224 - 237},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Active networks promise greater flexibility than current networks, but threaten safety and security by virtue of their programmability. We describe the design and implementation of a security architecture for the active network PLANet (Hicks et al., 1999). Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN (Hicks et al., 1998), with an environment of general-purpose service routines governed by trust management (Blaze et al., 1996). In particular, we employ a technique which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. As an application of our security architecture, we present the design and implementation of an active-network firewall. We find that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets},
	keywords = {active internetwork, active networks, active-network firewall, Authentication, authorisation, Authorization, Cities and towns, Computer networks, Computer science, cryptography, functionally restricted packet language, general-purpose service routines, Information security, internetworking, IP networks, latency overhead, namespace-based security, PLAN, PLANet, Planets, programmability, Safety, security architecture, telecommunication security, trust management, two-level architecture, Web and internet services},
	isbn = {0-7695-1564-9},
	doi = {10.1109/DANCE.2002.1003496},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
@conference {14725,
	title = {Practical programmable packets},
	booktitle = {IEEE INFOCOM 2001. Twentieth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {1},
	year = {2001},
	month = {2001///},
	pages = {41-50 vol.1 - 41-50 vol.1},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present SNAP (safe and nimble active packets), a new scheme for programmable (or active) packets centered around a new low-level packet language. Unlike previous active packet approaches, SNAP is practical: namely, adding significant flexibility over IP without compromising safety and security or efficiency. In this paper we show how to compile from the well-known active picket language PLAN to SNAP, showing that SNAP retains PLAN{\textquoteright}s flexibility; give proof sketches of its novel approach to resource control; and present experimental data showing SNAP attains performance very close to that of a software IP router},
	keywords = {active picket language, Application software, complier, Contracts, Data security, efficiency, Explosives, INFORMATION SCIENCE, Internet, IP, IP networks, low-level packet language, packet switching, performance, PLAN, practical programmable packets, program compilers, Protection, resource control, Resource management, safe and nimble active packets, Safety, Security, SNAP, software IP router, Software performance, telecommunication security, Transport protocols},
	isbn = {0-7803-7016-3},
	doi = {10.1109/INFCOM.2001.916685},
	author = {Moore,J. T and Hicks, Michael W. and Nettles,S.}
}
@article {12072,
	title = {Safety and security of programmable network infrastructures},
	journal = {IEEE Communications Magazine},
	volume = {36},
	year = {1998},
	month = {1998/10//},
	pages = {84 - 92},
	abstract = {Safety and security are two reliability properties of a system. A {\textquotedblleft}safe{\textquotedblright} system provides protection against errors of trusted users, while a {\textquotedblleft}secure{\textquotedblright} system protects against errors introduced by untrusted users. There is considerable overlap between mechanisms to support each property. Requirements for rapid service creation have stimulated the development of programmable network infrastructures, where end users or service providers can customize the properties of a network infrastructure while it continues to operate. A central concern of potential users of such systems is their reliability and, most specifically, their safety and security. In this article we explain the impact the network service model and architecture have on safety and security, and provide a model with which policies can be translated into restrictions of a general system. We illustrate these ideas with the Secure Active Network Environment (SANE) architecture, which provides a means of controlling access to the functions provided by any programmable infrastructure},
	keywords = {Access control, error protection, IP networks, Multicast protocols, network architecture, network operating systems, network service model, operating system, Power system dynamics, Power system modeling, Power system reliability, programmable languages, programmable network infrastructures, programming languages, Proposals, Protection, reliability properties, Safety, Secure Active Network Environment, Security, security of data, service creation, service providers, Switches, telecommunication computing, telecommunication network reliability, Web and internet services},
	isbn = {0163-6804},
	doi = {10.1109/35.722141},
	author = {Alexander,S. and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
@article {12079,
	title = {The SwitchWare active network architecture},
	journal = {IEEE Network},
	volume = {12},
	year = {1998},
	month = {1998/06//May},
	pages = {29 - 36},
	abstract = {Active networks must balance the flexibility of a programmable network infrastructure against the safety and security requirements inherent in sharing that infrastructure. Furthermore, this balance must be achieved while maintaining the usability of the network. The SwitchWare active network architecture is a novel approach to achieving this balance using three layers: active packets, which contain mobile programs that replace traditional packets; active extensions, which provide services on the network elements and can be dynamically loaded; and a secure active router infrastructure, which forms a high-integrity base on which the security of the other layers depends. In addition to integrity checking and cryptography-based authentication, security in our architecture depends heavily on verification techniques from programming languages, such as strong type checking},
	keywords = {active extensions, active packets, Authentication, Computer languages, Computer networks, cryptography, cryptography-based authentication, high-integrity base, integrity checking, IP networks, LAN interconnection, mobile programs, network operating systems, packet switching, programmable network infrastructure, programming languages, Protocols, Safety, safety requirements, scalability, secure active router infrastructure, Security, security requirements, services, strong type checking, Switches, SwitchWare active network architecture, telecommunication network routing, Tin, usability, verification techniques},
	isbn = {0890-8044},
	doi = {10.1109/65.690959},
	author = {Alexander,D. S and Arbaugh, William A. and Hicks, Michael W. and Kakkar,P. and Keromytis,A. D and Moore,J. T and Gunter,C. A and Nettles,S. M and Smith,J. M}
}
@conference {12787,
	title = {Efficient on-the-fly model checking for CTL},
	booktitle = {, Tenth Annual IEEE Symposium on Logic in Computer Science, 1995. LICS {\textquoteright}95. Proceedings},
	year = {1995},
	month = {1995/06/26/29},
	pages = {388 - 397},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper gives an on-the-fly algorithm for determining whether a finite-state system satisfies a formula in the temporal logic CTL. The time complexity of our algorithm matches that of the best existing {\textquotedblleft}global algorithm{\textquotedblright} for model checking in this logic, and it performs as well as the best known global algorithms for the sublogics CTL and LTL. In contrast with these approaches, however, our routine constructs the state space of the system under consideration in a need-driven fashion and will therefore perform better in practice},
	keywords = {Algorithm design and analysis, Automata, computational complexity, Computer science, CTL, Encoding, finite automata, finite-state system, global algorithm, Logic, LTL, on-the-fly model checking, Performance analysis, Safety, State-space methods, sublogic, temporal logic, time complexity},
	isbn = {0-8186-7050-9},
	doi = {10.1109/LICS.1995.523273},
	author = {Bhat,G. and Cleaveland, Rance and Grumberg,O.}
}
