@article {19028,
	title = {Cloud Data Protection for the Masses},
	journal = {Computer},
	volume = {45},
	year = {2012},
	month = {2012},
	pages = {39 - 45},
	abstract = {Offering strong data protection to cloud users while enabling rich applications is a challenging task. Researchers explore a new cloud platform architecture called Data Protection as a Service, which dramatically reduces the per-application development effort required to offer data protection, while still allowing rapid development and maintenance.},
	keywords = {Cloud computing, cloud data protection, cloud platform architecture, cloud users, Maintenance, rapid development, security of data, strong data protection},
	isbn = {0018-9162},
	author = {Song,D. and Elaine Shi and Fischer, I. and Shankar,U.}
}
@conference {19505,
	title = {The Provenance of WINE},
	booktitle = {Dependable Computing Conference (EDCC), 2012 Ninth European},
	year = {2012},
	month = {2012///},
	pages = {126 - 131},
	abstract = {The results of cyber security experiments are often impossible to reproduce, owing to the lack of adequate descriptions of the data collection and experimental processes. Such provenance information is difficult to record consistently when collecting data from distributed sensors and when sharing raw data among research groups with variable standards for documenting the steps that produce the final experimental result. In the WINE benchmark, which provides field data for cyber security experiments, we aim to make the experimental process self-documenting. The data collected includes provenance information {\textendash} such as when, where and how an attack was first observed or detected {\textendash} and allows researchers to gauge information quality. Experiments are conducted on a common test bed, which provides tools for recording each procedural step. The ability to understand the provenance of research results enables rigorous cyber security experiments, conducted at scale.},
	keywords = {Benchmark testing, CYBER SECURITY, cyber security experiments, data attacks, data collection, dependability benchmarking, distributed databases, distributed sensors, experimental research, field data, information quality, MALWARE, Pipelines, provenance, provenance information, raw data sharing, research groups, security of data, self-documenting experimental process, sensor fusion, software, variable standards, WINE, WINE benchmark},
	author = {Tudor Dumitras and Efstathopoulos, P.}
}
@conference {18667,
	title = {Characterizing Attackers and Attacks: An Empirical Study},
	year = {2011},
	month = {2011/12//},
	pages = {174 - 183},
	abstract = {This paper describes an empirical research study to characterize attackers and attacks against targets of opportunity. A honey net infrastructure was built and deployed over 167 days that leveraged three different honey pot configurations and a SSH-based authentication proxy to attract and follow attackers over several weeks. A total of 211 attack sessions were recorded and evidence was collected at each stage of the attack sequence: from discovery to intrusion and exploitation of rogue software. This study makes two important contributions: 1) we introduce a new approach to measure attacker skills, and 2) we leverage keystroke profile analysis to differentiate attackers beyond their IP address of origin.},
	keywords = {attack sessions, attacker characterization, attacker skill measurement, honey net infrastructure, honey pot configurations, IP address, keystroke profile analysis, opportunity target, rogue software exploitation, security of data, SSH-based authentication proxy},
	doi = {10.1109/PRDC.2011.29},
	author = {Salles-Loustau,G. and Berthier,R. and Collange,E. and Sobesto,B. and Michel Cukier}
}
@conference {14679,
	title = {Dynamic Enforcement of Knowledge-Based Security Policies},
	booktitle = {Computer Security Foundations Symposium (CSF), 2011 IEEE 24th},
	year = {2011},
	month = {2011/06/27/29},
	pages = {114 - 128},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper explores the idea of knowledge-based security policies, which are used to decide whether to answer queries over secret data based on an estimation of the querier{\textquoteright}s (possibly increased) knowledge given the results. Limiting knowledge is the goal of existing information release policies that employ mechanisms such as noising, anonymization, and redaction. Knowledge-based policies are more general: they increase flexibility by not fixing the means to restrict information flow. We enforce a knowledge-based policy by explicitly tracking a model of a querier{\textquoteright}s belief about secret data, represented as a probability distribution, and denying any query that could increase knowledge above a given threshold. We implement query analysis and belief tracking via abstract interpretation using a novel probabilistic polyhedral domain, whose design permits trading off precision with performance while ensuring estimates of a querier{\textquoteright}s knowledge are sound. Experiments with our implementation show that several useful queries can be handled efficiently, and performance scales far better than would more standard implementations of probabilistic computation based on sampling.},
	keywords = {abstract interpretation, belief networks, belief tracking, Data models, dynamic enforcement, Facebook, information flow, knowledge based systems, knowledge-based security, knowledge-based security policy, privacy, probabilistic computation, probabilistic logic, probabilistic polyhedral domain, probabilistic polyhedron, probability, query analysis, Security, security of data, semantics, Waste materials},
	isbn = {978-1-61284-644-6},
	doi = {10.1109/CSF.2011.15},
	author = {Mardziel,P. and Magill,S. and Hicks, Michael W. and Srivatsa,M.}
}
@conference {17643,
	title = {Predicting Trust and Distrust in Social Networks},
	booktitle = {Privacy, Security, Risk and Trust (PASSAT), 2011 IEEE Third International Conference on and 2011 IEEE Third International Confernece on Social Computing (SocialCom)},
	year = {2011},
	month = {2011/10/09/11},
	pages = {418 - 424},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {As user-generated content and interactions have overtaken the web as the default mode of use, questions of whom and what to trust have become increasingly important. Fortunately, online social networks and social media have made it easy for users to indicate whom they trust and whom they do not. However, this does not solve the problem since each user is only likely to know a tiny fraction of other users, we must have methods for inferring trust - and distrust - between users who do not know one another. In this paper, we present a new method for computing both trust and distrust (i.e., positive and negative trust). We do this by combining an inference algorithm that relies on a probabilistic interpretation of trust based on random graphs with a modified spring-embedding algorithm. Our algorithm correctly classifies hidden trust edges as positive or negative with high accuracy. These results are useful in a wide range of social web applications where trust is important to user behavior and satisfaction.},
	keywords = {distrust prediction, Electronic publishing, Encyclopedias, graph theory, inference algorithm, Inference algorithms, inference mechanisms, Internet, negative trust, online social networks, positive trust, Prediction algorithms, probability, random graphs, security of data, social media, social networking (online), spring-embedding algorithm, Training, trust inference, trust probabilistic interpretation, user behavior, user satisfaction, user-generated content, user-generated interactions},
	isbn = {978-1-4577-1931-8},
	doi = {10.1109/PASSAT/SocialCom.2011.56},
	author = {DuBois,T. and Golbeck,J. and Srinivasan, Aravind}
}
@conference {15918,
	title = {Sectored Random Projections for Cancelable Iris Biometrics},
	booktitle = {2010 IEEE International Conference on Acoustics Speech and Signal Processing (ICASSP)},
	year = {2010},
	month = {2010/03//},
	pages = {1838 - 1841},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Privacy and security are essential requirements in practical biometric systems. In order to prevent the theft of biometric patterns, it is desired to modify them through revocable and non invertible transformations called Cancelable Biometrics. In this paper, we propose an efficient algorithm for generating a Cancelable Iris Biometric based on Sectored Random Projections. Our algorithm can generate a new pattern if the existing one is stolen, retain the original recognition performance and prevent extraction of useful information from the transformed patterns. Our method also addresses some of the drawbacks of existing techniques and is robust to degradations due to eyelids and eyelashes.},
	keywords = {biometric pattern, Biometrics, Cancelable Biometrics, cancelable iris biometrics, data mining, data privacy, Degradation, Eyelashes, Eyelids, Iris, iris recognition, pattern recognition, privacy, random processes, Random Projections, Robustness, sectored random projection, Secure Biometrics, Security, security of data},
	isbn = {978-1-4244-4295-9},
	doi = {10.1109/ICASSP.2010.5495383},
	author = {Pillai,J.K. and Patel, Vishal M. and Chellapa, Rama and Ratha,N. K}
}
@conference {18659,
	title = {Analyzing the process of installing rogue software},
	year = {2009},
	month = {2009/07/29/2},
	pages = {560 - 565},
	abstract = {This practical experience report presents the results of an experiment aimed at understanding the sequence of malicious actions following a remote compromise. The type of rogue software installed during attacks was used to classify and understand sequences of malicious actions. For this experiment, we used four Linux target computers running SSH with simple passwords. During the eight-month data collection period, we recorded a total of 1,171 attack sessions. In these sessions, attackers typed a total of 20,335 commands that we categorized into 24 specific actions. These actions were analyzed based on the type of rogue software installed by attackers.},
	keywords = {Linux, Linux target computers, malicious actions, rogue software installation, security of data},
	doi = {10.1109/DSN.2009.5270293},
	author = {Berthier,R. and Arjona,J. and Michel Cukier}
}
@article {18686,
	title = {Prioritizing Vulnerability Remediation by Determining Attacker-Targeted Vulnerabilities},
	journal = {Security Privacy, IEEE},
	volume = {7},
	year = {2009},
	month = {2009/02//jan},
	pages = {42 - 48},
	abstract = {This article attempts to empirically analyze which vulnerabilities attackers tend to target in order to prioritize vulnerability remediation. This analysis focuses on the link between malicious connections and vulnerabilities, where each connection is considered malicious. Attacks requiring multiple connections are counted as multiple attacks. As the number of connections increases, so does the cost of recovering from the intrusion. The authors deployed four honey pots for four months, each running a different Windows service pack with its associated set of vulnerabilities. They then performed three empirical analyses to determine the relationship between the number of malicious connections and the total number of vulnerabilities, the number of malicious connections and the number of the vulnerabilities for different services, and the number of known successful attacks and the number of vulnerabilities for different services.},
	keywords = {attacker-targeted vulnerabilities, intrusion detection, malicious connections, security of data, vulnerability remediation, Windows service pack},
	isbn = {1540-7993},
	doi = {10.1109/MSP.2009.13},
	author = {Michel Cukier and Panjwani,S.}
}
@conference {18658,
	title = {Analysis of Computer Security Incident Data Using Time Series Models},
	year = {2008},
	month = {2008/11//},
	pages = {77 - 86},
	abstract = {Organizations face increasing challenges in addressing and preventing computer and network security incidents. There are financial consequences from security incidents. These include lost time and resources used during recovery, possible theft of personal and/or proprietary information, and reputational damage that may negatively impact stock prices or reduce consumer confidence in a company. Being able to understand and predict trends in computer and network security incidents can aid an organization with resource allocation for prevention of such incidents, as well as evaluation of mitigation strategies. We look at using time series models with a large set of security incident data. We examine appropriateness of the data for modeling and consider needed transformations. Parameter search and model selection criteria are discussed. Then, forecasts from time series models are compared to forecasts from Non-Homogeneous Poisson Process (NHPP) software reliability growth (SRG) models.},
	keywords = {Computer networks, computer security incident data, NETWORK SECURITY, resource allocation, security of data, telecommunication security, time series, time series model},
	doi = {10.1109/ISSRE.2008.39},
	author = {Condon,E. and He,A. and Michel Cukier}
}
@conference {18681,
	title = {On the Comparison of Network Attack Datasets: An Empirical Analysis},
	year = {2008},
	month = {2008/12//},
	pages = {39 - 48},
	abstract = {Network malicious activity can be collected and reported by various sources using different attack detection solutions. The granularity of these solutions provides either very detailed information (intrusion detection systems, honeypots) or high-level trends (CAIDA, SANS). The problem for network security operators is often to select the sources of information to better protect their network. How much information from these sources is redundant and how much is unique? The goal of this paper is to show empirically that while some global attack events can be correlated across various sensors, the majority of incoming malicious activity has local specificities. This study presents a comparative analysis of four different attack datasets offering three different levels of granularity: 1) two high interaction honeynets deployed at two different locations (i.e., a corporate and an academic environment); 2) ATLAS which is a distributed network telescope from Arbor; and 3) Internet Protecttrade which is a global alerting service from AT amp;T.},
	keywords = {ATLAS, distributed network telescope, Internet, intrusion detection systems, network attack datasets, network malicious activity, network security operators, security of data},
	doi = {10.1109/HASE.2008.50},
	author = {Berthier,R. and Korman,D. and Michel Cukier and Hiltunen,M. and Vesonder,G. and Sheleheda,D.}
}
@conference {14696,
	title = {Fable: A Language for Enforcing User-defined Security Policies},
	booktitle = {IEEE Symposium on Security and Privacy, 2008. SP 2008},
	year = {2008},
	month = {2008/05/18/22},
	pages = {369 - 383},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper presents FABLE, a core formalism for a programming language in which programmers may specify security policies and reason that these policies are properly enforced. In FABLE, security policies can be expressed by associating security labels with the data or actions they protect. Programmers define the semantics of labels in a separate part of the program called the enforcement policy. FABLE prevents a policy from being circumvented by allowing labeled terms to be manipulated only within the enforcement policy; application code must treat labeled values abstractly. Together, these features facilitate straightforward proofs that programs implementing a particular policy achieve their high-level security goals. FABLE is flexible enough to implement a wide variety of security policies, including access control, information flow, provenance, and security automata. We have implemented FABLE as part of the LINKS web programming language; we call the resulting language SELlNKS. We report on our experience using SELlNKS to build two substantial applications, a wiki and an on-line store, equipped with a combination of access control and provenance policies. To our knowledge, no existing framework enables the enforcement of such a wide variety of security policies with an equally high level of assurance.},
	keywords = {Access control, Automata, Collaborative work, Communication system security, Computer languages, computer security, Data security, enforcement policy, FABLE, Government, high-level security goals, information flow, Information security, Language-based security, programming languages, Programming profession, provenance, security automata, security labels, security of data, user-defined security policies, verified enforcement, Web programming language},
	isbn = {978-0-7695-3168-7},
	doi = {10.1109/SP.2008.29},
	author = {Swamy,N. and Corcoran,B.J. and Hicks, Michael W.}
}
@conference {18682,
	title = {On the Use of Security Metrics Based on Intrusion Prevention System Event Data: An Empirical Analysis},
	year = {2008},
	month = {2008/12//},
	pages = {49 - 58},
	abstract = {With the increasing number of attacks on the Internet, a primary concern for organizations is the protection of their network. To do so, organizations install security devices such as intrusion prevention systems to monitor network traffic. However, data that are collected by these devices are often imperfect. The contribution of this paper is to try to define some practical metrics based on imperfect data collected by an intrusion prevention system. Since attacks greatly differ, we propose to group the attacks into several attack type groups. We then define a set of metrics for each attack type group. We introduce an approach that consists in analyzing the evolution of these metrics per attack type group by focusing on outliers in order to give an insight into an organizationpsilas security. The method is assessed for an organization of about 40,000 computers. The results were encouraging: outliers could be related to security issues that, in some cases, had not been previously flagged.},
	keywords = {empirical analysis, Internet, Internet attack group, intrusion prevention system event data, network traffic monitoring, organization security metrics, security of data},
	doi = {10.1109/HASE.2008.52},
	author = {Chrun,D. and Michel Cukier and Sneeringer,G.}
}
@conference {18660,
	title = {Applying Software Reliability Models on Security Incidents},
	year = {2007},
	month = {2007/11//},
	pages = {159 - 168},
	abstract = {Computer and network security incidents have increasing financial consequences as demand for network accessibility and connectivity to resources continues to rise. These security incidents can lead to direct financial losses either through data theft of personal and/or proprietary information as well as a reputational damage which may negatively impact stock prices or consumer confidence in a company. This paper examines a large set of security incident data using tools from the software reliability community. We look at applying Non-Homogenous Poisson Process (NHPP) models as a method for describing the reliability growth process. We examine the full set of incidents as well as subsets of the data based on incident types. We look at using the Laplace test to guide selection of the appropriate models. Then, based on the trend results, we apply various NHPP models (i.e., Goel-Okumutu, S-Shaped, Duane, and K-Stage Curve) to illustrate the relevance of using these models to fit the incident data and to predict future incidents.},
	keywords = {computer security incidents, consumer confidence, data theft, network security incidents, nonhomogenous Poisson process, reliability growth process, reputational damage, security of data, software reliability, stock prices},
	doi = {10.1109/ISSRE.2007.29},
	author = {Condon,E. and Michel Cukier and He,Tao}
}
@conference {18646,
	title = {A Comparison between Internal and External Malicious Traffic},
	year = {2007},
	month = {2007///},
	pages = {109 - 114},
	abstract = {This paper empirically compares malicious traffic originating inside an organization (i.e., internal traffic) with malicious traffic originating outside an organization (i.e., external traffic). Two honeypot target computers were deployed to collect malicious traffic data over a period of fifteen weeks. In the first study we showed that there was a weak correlation between internal and external traffic based on the number of malicious connections. Since the type of malicious activity is linked to the port that was targeted, we focused on the most frequently targeted ports. We observed that internal malicious traffic often contained different malicious content compared to that of external traffic. In the third study, we discovered that the volume of malicious traffic was linked to the day of the week. We showed that internal and external malicious activities differ: where the external malicious activity is quite stable over the week, the internal traffic varied as a function of the users{\textquoteright} activity profile.},
	keywords = {Computer networks, Data analysis, external traffic, honeypot target computers, internal traffic, malicious traffic data, security of data, user activity profile},
	doi = {10.1109/ISSRE.2007.32},
	author = {Michel Cukier and Panjwani,S.}
}
@conference {18654,
	title = {An empirical study of filesystem activity following a SSH compromise},
	year = {2007},
	month = {2007/12//},
	pages = {1 - 5},
	abstract = {Monitoring filesystem data is a common method used to detect attacks. Once a computer is compromised, attackers will likely alter files, add new files or delete existing files. The changes that attackers make may target any part of the filesystem, including metadata along with files (e.g., permissions, ownerships and inodes). In this paper, we describe an empirical study that focused on SSH compromised attacks. First statistical data on the number of files targeted and the associated activity (e.g., read, write, delete, ownership and rights) is reported. Then, we refine the analysis to identify and understand patterns in the attack activity.},
	keywords = {attack activity, filesystem activity, filesystem data monitoring, intrusion detection systems evaluation, meta data, metadata, security of data, SSH compromised attacks},
	doi = {10.1109/ICICS.2007.4449675},
	author = {Molina,J. and Gordon,J. and Chorin,X. and Michel Cukier}
}
@conference {18688,
	title = {Profiling Attacker Behavior Following SSH Compromises},
	year = {2007},
	month = {2007/06//},
	pages = {119 - 124},
	abstract = {This practical experience report presents the results of an experiment aimed at building a profile of attacker behavior following a remote compromise. For this experiment, we utilized four Linux honeypot computers running SSH with easily guessable passwords. During the course of our research, we also determined the most commonly attempted usernames and passwords, the average number of attempted logins per day, and the ratio of failed to successful attempts. To build a profile of attacker behavior, we looked for specific actions taken by the attacker and the order in which they occurred. These actions were: checking the configuration, changing the password, downloading a file, installing/running rogue code, and changing the system configuration.},
	keywords = {Linux, Linux honeypot computers, profiling attacker behavior, remote compromise, rogue code, security of data, SSH compromises, system configuration},
	doi = {10.1109/DSN.2007.76},
	author = {Ramsbrock,D. and Berthier,R. and Michel Cukier}
}
@conference {14706,
	title = {Managing policy updates in security-typed languages},
	booktitle = {19th IEEE Computer Security Foundations Workshop, 2006},
	year = {2006},
	month = {2006///},
	pages = {13 pp.-216 - 13 pp.-216},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper presents Rx, a new security-typed programming language with features intended to make the management of information-flow policies more practical. Security labels in Rx, in contrast to prior approaches, are defined in terms of owned roles, as found in the RT role-based trust-management framework. Role-based security policies allow flexible delegation, and our language Rx provides constructs through which programs can robustly update policies and react to policy updates dynamically. Our dynamic semantics use statically verified transactions to eliminate illegal information flows across updates, which we call transitive flows. Because policy updates can be observed through dynamic queries, policy updates can potentially reveal sensitive information. As such, Rx considers policy statements themselves to be potentially confidential information and subject to information-flow metapolicies},
	keywords = {Access control, Computer languages, Data security, Database systems, dynamic queries, dynamic semantics, Educational institutions, high level languages, Information security, information-flow policy management, Lattices, Network servers, Operating systems, policy update management, Robustness, role-based security policies, RT role-based trust-management framework, Rx security-typed programming language, security of data, statically verified transactions, transitive flows},
	isbn = {0-7695-2615-2},
	doi = {10.1109/CSFW.2006.17},
	author = {Swamy,N. and Hicks, Michael W. and Tse,S. and Zdancewic,S.}
}
@conference {18679,
	title = {Modeling the Symptomatic Fixes Archetype in Enterprise Computer Security},
	volume = {1},
	year = {2006},
	month = {2006/09//},
	pages = {178 - 188},
	abstract = {To support decision-making for security-risk mitigation and the appropriate selection of security countermeasures, we propose a system dynamics model of the security aspects of an enterprise system. We developed such an executable model, incorporating the concept of archetypes. We present here one archetype for computer security, namely symptomatic fixes (or shifting the burden). Using simulation, we show one instance of how this archetype can be used for recognizing and diagnosing typical situations, as well as for fixing problems. The global effects of changes and behavioral trends are examined, and other instances of symptomatic fixes in security are described as well},
	keywords = {business data processing, decision making, decision-making, enterprise computer security, human factors, security of data, security-risk mitigation, symptomatic fixes archetype modeling, system dynamics model, system modeling},
	doi = {10.1109/COMPSAC.2006.62},
	author = {Rosenfeld,S. N. and Rus,I. and Michel Cukier}
}
@conference {12830,
	title = {A Software Architectural Approach to Security by Design},
	booktitle = {Computer Software and Applications Conference, 2006. COMPSAC {\textquoteright}06. 30th Annual International},
	volume = {2},
	year = {2006},
	month = {2006/09/17/21},
	pages = {83 - 86},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {This paper shows how an architecture description notation that has support for timed events can be used to provide a meta-language for specifying exact communication semantics. The advantages of such an approach is that a designer is made fully aware of the ramifications of her design choices so that an attacker can no longer take advantage of hidden assumptions},
	keywords = {architecture description notation, Clocks, communication semantics, Computer architecture, computer crime, computer security, Connectors, Costs, Degradation, Delay, Educational institutions, security design, security of data, Software architecture, software engineering},
	isbn = {0-7695-2655-1},
	doi = {10.1109/COMPSAC.2006.102},
	author = {Ray,A. and Cleaveland, Rance}
}
@article {12094,
	title = {Wireless Network Security and Interworking},
	journal = {Proceedings of the IEEE},
	volume = {94},
	year = {2006},
	month = {2006/02//},
	pages = {455 - 466},
	abstract = {A variety of wireless technologies have been standardized and commercialized, but no single technology is considered the best because of different coverage and bandwidth limitations. Thus, interworking between heterogeneous wireless networks is extremely important for ubiquitous and high-performance wireless communications. Security in interworking is a major challenge due to the vastly different security architectures used within each network. The goal of this paper is twofold. First, we provide a comprehensive discussion of security problems and current technologies in 3G and WLAN systems. Second, we provide introductory discussions about the security problems in interworking, the state-of-the-art solutions, and open problems.},
	keywords = {3G mobile communication, 3G systems, Authentication, Bandwidth, Communication system security, computer network security, computer security, Data security, internetworking, Land mobile radio cellular systems, Paper technology, security architectures, security of data, telecommunication security, wireless communication, wireless communications, Wireless LAN, wireless network security, Wireless networks, wireless technologies, WLAN systems},
	isbn = {0018-9219},
	doi = {10.1109/JPROC.2005.862322},
	author = {Shin,M. and Ma,J. and Mishra,A. and Arbaugh, William A.}
}
@conference {18665,
	title = {Automated checking for Windows host vulnerabilities},
	year = {2005},
	month = {2005/11//},
	pages = {10 pp. -148 - 10 pp. -148},
	abstract = {Evaluation of computing system security requires knowledge of the vulnerabilities present in the system and of potential attacks against the system. Vulnerabilities can be classified based on their location as application vulnerabilities, network vulnerabilities, or host vulnerabilities. This paper describes Ferret-Windows, a new software tool for checking host vulnerabilities on the Windows platforms. This tool helps system administrators by quickly finding vulnerabilities that are present on a host. It is designed and implemented in a modular way: a plug-in module is used for each vulnerability checked, and each possible output format is specified by a plug-in module. Moreover, several vulnerability fixing plug-in modules exist to help users remove specific vulnerabilities. As a result, Ferret-Windows is extensible, and can easily be kept up-to-date through the addition of checks for new vulnerabilities as they are identified. Finally, Ferret-Windows is a freely available open-source software},
	keywords = {application vulnerabilities, computing system security, Ferret-Windows software tool, host vulnerabilities, network vulnerabilities, open-source software, operating systems (computers), plug-in module, program diagnostics, security of data, software reliability, software tools, system attacks, Windows host vulnerability checking, Windows platforms},
	doi = {10.1109/ISSRE.2005.11},
	author = {Tamizi,M. and Weinstein,M. and Michel Cukier}
}
@conference {18673,
	title = {Ferret: a host vulnerability checking tool},
	year = {2004},
	month = {2004/03//},
	pages = {389 - 394},
	abstract = {Evaluation of computing system security requires knowledge of the vulnerabilities present in the system and of potential attacks against the system. Vulnerabilities can be classified based on their location as application vulnerabilities, network vulnerabilities, or host vulnerabilities. We describe Ferret, a new software tool for checking host vulnerabilities. Ferret helps system administrators by quickly finding vulnerabilities that are present on a host. It is designed and implemented in a modular way: a different plug-in module is used for each vulnerability checked, and each possible output format is specified by a plug-in module. As a result, Ferret is extensible, and can easily be kept up-to-date through addition of checks for new vulnerabilities as they are discovered; the modular approach also makes it easy to provide specific configurations of Ferret tailored to specific operating systems or use environments. Ferret is a freely available open-source software implemented in Perl.},
	keywords = {Ferret software tool, host vulnerability checking tool, open-source software, Perl, plug-in module, program verification, security auditing tool, security evaluation, security of data, software tools},
	doi = {10.1109/PRDC.2004.1276595},
	author = {Sharma,Anil and Martin,J.R. and Anand,N. and Michel Cukier and Sanders,W. H.}
}
@article {12088,
	title = {The dangers of mitigating security design flaws: a wireless case study},
	journal = {IEEE Security \& Privacy},
	volume = {1},
	year = {2003},
	month = {2003/02//Jan},
	pages = {28 - 36},
	abstract = {Mitigating design flaws often provides the only means to protect legacy equipment, particularly in wireless local area networks. A synchronous active attack against the wired equivalent privacy protocol demonstrates how mitigating one flaw or attack can facilitate another.},
	keywords = {Communication system security, computer security, cryptography, design flaw mitigation, Dictionaries, legacy equipment, privacy, Protection, Protocols, security design flaws, security of data, synchronous active attack, telecommunication security, Telecommunication traffic, wired equivalent privacy protocol, Wireless LAN, wireless local area networks, Wireless networks},
	isbn = {1540-7993},
	doi = {10.1109/MSECP.2003.1176993},
	author = {Petroni,N. L. and Arbaugh, William A.}
}
@article {14653,
	title = {A secure PLAN},
	journal = {IEEE Transactions on Systems, Man, and Cybernetics, Part C: Applications and Reviews},
	volume = {33},
	year = {2003},
	month = {2003/08//},
	pages = {413 - 426},
	abstract = {Active networks, being programmable, promise greater flexibility than current networks. Programmability, however, may introduce safety and security risks. This correspondence describes the design and implementation of a security architecture for the active network PLANet. Security is obtained with a two-level architecture that combines a functionally restricted packet language, PLAN, with an environment of general-purpose service routines governed by trust management. In particular, a technique is used which expands or contracts a packet{\textquoteright}s service environment based on its level of privilege, termed namespace-based security. The design and implementation of an active-network firewall and virtual private network is used as an application of the security architecture. Measurements of the system show that the addition of the firewall imposes an approximately 34\% latency overhead and as little as a 6.7\% space overhead to incoming packets.},
	keywords = {active networks, active-network firewall, Authentication, Authorization, Contracts, cryptography, Environmental management, Extraterrestrial measurements, functionally restricted packet language, general-purpose service routines, Internet, latency overhead, namespace-based security, packet switching, PLANet, Planets, privilege level, programmable networks, Safety, safety risks, secure PLAN, security of data, security risks, trust management, two-level architecture, virtual private network, Virtual private networks, Web and internet services},
	isbn = {1094-6977},
	doi = {10.1109/TSMCC.2003.817347},
	author = {Hicks, Michael W. and Keromytis,A. D and Smith,J. M}
}
@conference {17642,
	title = {P5 : a protocol for scalable anonymous communication},
	booktitle = {2002 IEEE Symposium on Security and Privacy, 2002. Proceedings},
	year = {2002},
	month = {2002///},
	pages = {58 - 70},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present a protocol for anonymous communication over the Internet. Our protocol, called P5 (peer-to-peer personal privacy protocol) provides sender-, receiver-, and sender-receiver anonymity. P5 is designed to be implemented over current Internet protocols, and does not require any special infrastructure support. A novel feature of P5 is that it allows individual participants to trade-off degree of anonymity for communication efficiency, and hence can be used to scalably implement large anonymous groups. We present a description of P5, an analysis of its anonymity and communication efficiency, and evaluate its performance using detailed packet-level simulations.},
	keywords = {Broadcasting, communication efficiency, Computer science, cryptography, data privacy, Educational institutions, Internet, large anonymous groups, P5 protocol, packet-level simulations, Particle measurements, Peer to peer computing, peer-to-peer personal privacy protocol, privacy, Protocols, receiver anonymity, scalable anonymous communication, security of data, sender anonymity, sender-receiver anonymity, Size measurement, telecommunication security},
	isbn = {0-7695-1543-6},
	doi = {10.1109/SECPRI.2002.1004362},
	author = {Sherwood,R. and Bhattacharjee, Bobby and Srinivasan, Aravind}
}
@conference {18690,
	title = {Quantifying the cost of providing intrusion tolerance in group communication systems},
	year = {2002},
	month = {2002///},
	pages = {229 - 238},
	abstract = {Group communication systems that provide consistent group membership and reliable, ordered multicast properties in the presence of faults resulting from malicious intrusions have not been analyzed extensively to quantify the cost of tolerating these intrusions. This paper attempts to quantify this cost by presenting results from an experimental evaluation of three new intrusion-tolerant microprotocols that have been added to an existing crash-fault-tolerant group communication system. The results are analyzed to identify the parts that contribute the most overhead during provision of intrusion tolerance at the group communication system level.},
	keywords = {consistent group membership, crash-fault-tolerant group communication system, cryptography, finite state machines, groupware, intrusion-tolerant microprotocols, malicious intrusions, multicast communication, reliable ordered multicast properties, security of data, Transport protocols},
	doi = {10.1109/DSN.2002.1028904},
	author = {Ramasamy,H. V. and Pandey,P. and Lyons,J. and Michel Cukier and Sanders,W. H.}
}
@conference {12098,
	title = {A trend analysis of exploitations},
	booktitle = {2001 IEEE Symposium on Security and Privacy, 2001. S\&P 2001. Proceedings},
	year = {2001},
	month = {2001///},
	pages = {214 - 229},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We have conducted an empirical study of a number of computer security exploits and determined that the rates at which incidents involving the exploit are reported to CERT can be modeled using a common mathematical framework. Data associated with three significant exploits involving vulnerabilities in phf, imap, and bind can all be modeled using the formula C=I+S{\texttimes}√M where C is the cumulative count of reported incidents, M is the time since the start of the exploit cycle, and I and S are the regression coefficients determined by analysis of the incident report data. Further analysis of two additional exploits involving vulnerabilities in mountd and statd confirm the model. We believe that the models will aid in predicting the severity of subsequent vulnerability exploitations, based on the rate of early incident reports},
	keywords = {Computer science, computer security exploits, Data analysis, data mining, Educational institutions, exploitations, Performance analysis, Predictive models, Regression analysis, Risk management, security of data, software engineering, system intrusions, System software, trend analysis, vulnerabilities, vulnerability exploitation},
	isbn = {0-7695-1046-9},
	doi = {10.1109/SECPRI.2001.924300},
	author = {Browne,H. K and Arbaugh, William A. and McHugh,J. and Fithen,W. L}
}
@article {12072,
	title = {Safety and security of programmable network infrastructures},
	journal = {IEEE Communications Magazine},
	volume = {36},
	year = {1998},
	month = {1998/10//},
	pages = {84 - 92},
	abstract = {Safety and security are two reliability properties of a system. A {\textquotedblleft}safe{\textquotedblright} system provides protection against errors of trusted users, while a {\textquotedblleft}secure{\textquotedblright} system protects against errors introduced by untrusted users. There is considerable overlap between mechanisms to support each property. Requirements for rapid service creation have stimulated the development of programmable network infrastructures, where end users or service providers can customize the properties of a network infrastructure while it continues to operate. A central concern of potential users of such systems is their reliability and, most specifically, their safety and security. In this article we explain the impact the network service model and architecture have on safety and security, and provide a model with which policies can be translated into restrictions of a general system. We illustrate these ideas with the Secure Active Network Environment (SANE) architecture, which provides a means of controlling access to the functions provided by any programmable infrastructure},
	keywords = {Access control, error protection, IP networks, Multicast protocols, network architecture, network operating systems, network service model, operating system, Power system dynamics, Power system modeling, Power system reliability, programmable languages, programmable network infrastructures, programming languages, Proposals, Protection, reliability properties, Safety, Secure Active Network Environment, Security, security of data, service creation, service providers, Switches, telecommunication computing, telecommunication network reliability, Web and internet services},
	isbn = {0163-6804},
	doi = {10.1109/35.722141},
	author = {Alexander,S. and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
@article {12101,
	title = {A secure active network environment architecture: realization in SwitchWare},
	journal = {IEEE Network},
	volume = {12},
	year = {1998},
	month = {1998/06//May},
	pages = {37 - 45},
	abstract = {An active network is a network infrastructure which is programmable on a per-user or even per-packet basis. Increasing the flexibility of such network infrastructures invites new security risks. Coping with these security risks represents the most fundamental contribution of active network research. The security concerns can be divided into those which affect the network as a whole and those which affect individual elements. It is clear that the element problems must be solved first, since the integrity of network-level solutions will be based on trust in the network elements. In this article we describe the architecture and implementation of a secure active network environment (SANE), which we believe provides a basis for implementing secure network-level solutions. We guarantee that a node begins operation in a trusted state with the AEGIS secure bootstrap architecture. We guarantee that the system remains in a trusted state by applying dynamic integrity checks in the network element{\textquoteright}s runtime system, using a novel naming system, and applying node-to-node authentication when needed. The construction of an extended LAN is discussed},
	keywords = {access protocols, AEGIS secure bootstrap architecture, architecture, Authentication, Collaboration, Communication switching, dynamic integrity checks, extended LAN, Functional programming, implementation, integrity, Intelligent networks, IP networks, Local area networks, network infrastructure, network infrastructures, network operating systems, network-level solutions, node, node-to-node authentication, packet switching, Proposals, ramming system, SANE, secure active network environment architecture, security of data, Switches, SwitchWare, trusted state, Web and internet services},
	isbn = {0890-8044},
	doi = {10.1109/65.690960},
	author = {Alexander,D. S and Arbaugh, William A. and Keromytis,A. D and Smith,J. M}
}
@article {12103,
	title = {Security for virtual private intranets},
	journal = {Computer},
	volume = {31},
	year = {1998},
	month = {1998/09//},
	pages = {48 - 55},
	abstract = {As telecommuting grows, businesses must consider security when extending their network environment to employees{\textquoteright} homes. Researchers at the University of Pennsylvania have addressed the problem with smart cards, operating system modifications, and network authentication. We note the distinction between trust and integrity: trust is determined through the verification of components and the dependencies among them, while integrity demonstrates that components haven{\textquoteright}t been modified. Thus integrity checking in a trustworthy system is about preserving an established trust or trust relationship. Our solution to the challenge of isolating functional roles that may share a single hardware platform is called secure identity based lending (SIBL). SIBL provides multiple personalities by partitioning the hard drive into n+1 partitions, where n is the number of supported personalities. All personalities use the system partition for core operating system components and shared applications. Each of the personalities is also associated with one of the remaining partitions, which are encrypted using a symmetric algorithm},
	keywords = {businesses, Clouds, Companies, core operating system components, cryptography, Data security, employee homes, encryption, functional roles, hard drive, Home computing, home working, integrity checking, Internet, Local area networks, multiple personalities, network authentication, network environment, operating system modifications, Operating systems, Roads, secure identity based lending, security management, security of data, shared applications, SIBL, single hardware platform, smart cards, symmetric algorithm, system partition, telecommuting, Teleworking, trust relationship, trustworthy system, virtual private intranets},
	isbn = {0018-9162},
	doi = {10.1109/2.708450},
	author = {Arbaugh, William A. and Davin,J. R and Farber,D. J and Smith,J. M}
}
@conference {12092,
	title = {A secure and reliable bootstrap architecture},
	booktitle = {, 1997 IEEE Symposium on Security and Privacy, 1997. Proceedings},
	year = {1997},
	month = {1997/05/04/7},
	pages = {65 - 71},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, the integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity {\textquotedblleft}chain{\textquotedblright} inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made, yet these guarantees are increasingly important to diverse applications such as Internet commerce, security systems and {\textquotedblleft}active networks{\textquotedblright}. In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems},
	keywords = {active networks, AEGIS architecture, bootstrap architecture, Computer architecture, computer bootstrapping, data integrity, Distributed computing, Hardware, hardware validity, initialization, integrity chain, integrity check failures, Internet, Internet commerce, IP networks, Laboratories, lower-layer integrity, Microprogramming, Operating systems, recovery process, reliability, robust systems, Robustness, Security, security of data, software reliability, system integrity guarantees, system recovery, transitions, Virtual machining},
	isbn = {0-8186-7828-3},
	doi = {10.1109/SECPRI.1997.601317},
	author = {Arbaugh, William A. and Farber,D. J and Smith,J. M}
}
