@conference {18660,
	title = {Applying Software Reliability Models on Security Incidents},
	year = {2007},
	month = {2007/11//},
	pages = {159 - 168},
	abstract = {Computer and network security incidents have increasing financial consequences as demand for network accessibility and connectivity to resources continues to rise. These security incidents can lead to direct financial losses either through data theft of personal and/or proprietary information as well as a reputational damage which may negatively impact stock prices or consumer confidence in a company. This paper examines a large set of security incident data using tools from the software reliability community. We look at applying Non-Homogenous Poisson Process (NHPP) models as a method for describing the reliability growth process. We examine the full set of incidents as well as subsets of the data based on incident types. We look at using the Laplace test to guide selection of the appropriate models. Then, based on the trend results, we apply various NHPP models (i.e., Goel-Okumutu, S-Shaped, Duane, and K-Stage Curve) to illustrate the relevance of using these models to fit the incident data and to predict future incidents.},
	keywords = {computer security incidents, consumer confidence, data theft, network security incidents, nonhomogenous Poisson process, reliability growth process, reputational damage, security of data, software reliability, stock prices},
	doi = {10.1109/ISSRE.2007.29},
	author = {Condon,E. and Michel Cukier and He,Tao}
}
@conference {15484,
	title = {Fault Detection Probability Analysis for Coverage-Based Test Suite Reduction},
	booktitle = {Software Maintenance, 2007. ICSM 2007. IEEE International Conference on},
	year = {2007},
	month = {2007/10//},
	pages = {335 - 344},
	abstract = {Test suite reduction seeks to reduce the number of test cases in a test suite while retaining a high percentage of the original suite{\textquoteright}s fault detection effectiveness. Most approaches to this problem are based on eliminating test cases that are redundant relative to some coverage criterion. The effectiveness of applying various coverage criteria in test suite reduction is traditionally based on empirical comparison of two metrics derived from the full and reduced test suites and information about a set of known faults: (1) percentage size reduction and (2) percentage fault detection reduction, neither of which quantitatively takes test coverage data into account. Consequently, no existing measure expresses the likelihood of various coverage criteria to force coverage-based reduction to retain test cases that expose specific faults. In this paper, we develop and empirically evaluate, using a number of different coverage criteria, a new metric based on the "average expected probability of finding a fault" in a reduced test suite. Our results indicate that the average probability of detecting each fault shows promise for identifying coverage criteria that work well for test suite reduction.},
	keywords = {coverage-based test suite reduction, fault detection probability analysis, Fault diagnosis, force coverage-based reduction, percentage fault detection reduction, percentage size reduction, program testing, software reliability, statistical analysis},
	doi = {10.1109/ICSM.2007.4362646},
	author = {McMaster,S. and Memon, Atif M.}
}
@article {15476,
	title = {Reliable Effects Screening: A Distributed Continuous Quality Assurance Process for Monitoring Performance Degradation in Evolving Software Systems},
	journal = {Software Engineering, IEEE Transactions on},
	volume = {33},
	year = {2007},
	month = {2007/02//},
	pages = {124 - 141},
	abstract = {Developers of highly configurable performance-intensive software systems often use in-house performance-oriented "regression testing" to ensure that their modifications do not adversely affect their software{\textquoteright}s performance across its large configuration space. Unfortunately, time and resource constraints can limit in-house testing to a relatively small number of possible configurations, followed by unreliable extrapolation from these results to the entire configuration space. As a result, many performance bottlenecks escape detection until systems are fielded. In our earlier work, we improved the situation outlined above by developing an initial quality assurance process called "main effects screening". This process 1) executes formally designed experiments to identify an appropriate subset of configurations on which to base the performance-oriented regression testing, 2) executes benchmarks on this subset whenever the software changes, and 3) provides tool support for executing these actions on in-the-field and in-house computing resources. Our initial process had several limitations, however, since it was manually configured (which was tedious and error-prone) and relied on strong and untested assumptions for its accuracy (which made its use unacceptably risky in practice). This paper presents a new quality assurance process called "reliable effects screening" that provides three significant improvements to our earlier work. First, it allows developers to economically verify key assumptions during process execution. Second, it integrates several model-driven engineering tools to make process configuration and execution much easier and less error prone. Third, we evaluate this process via several feasibility studies of three large, widely used performance-intensive software frameworks. Our results indicate that reliable effects screening can detect performance degradation in large-scale systems more reliably and with significantly less resources than conventional t- echniques},
	keywords = {configuration subset, distributed continuous quality assurance process, evolving software systems, in house testing, main effects screening, performance bottlenecks, performance degradation monitoring, performance intensive software systems, process configuration, process execution, program testing, regression testing, reliable effects screening, software benchmarks, Software performance, software performance evaluation, Software quality, software reliability, tool support},
	isbn = {0098-5589},
	doi = {10.1109/TSE.2007.20},
	author = {Yilmaz,C. and Porter, Adam and Krishna,A. S and Memon, Atif M. and Schmidt,D. C and Gokhale,A.S. and Natarajan,B.}
}
@conference {18665,
	title = {Automated checking for Windows host vulnerabilities},
	year = {2005},
	month = {2005/11//},
	pages = {10 pp. -148 - 10 pp. -148},
	abstract = {Evaluation of computing system security requires knowledge of the vulnerabilities present in the system and of potential attacks against the system. Vulnerabilities can be classified based on their location as application vulnerabilities, network vulnerabilities, or host vulnerabilities. This paper describes Ferret-Windows, a new software tool for checking host vulnerabilities on the Windows platforms. This tool helps system administrators by quickly finding vulnerabilities that are present on a host. It is designed and implemented in a modular way: a plug-in module is used for each vulnerability checked, and each possible output format is specified by a plug-in module. Moreover, several vulnerability fixing plug-in modules exist to help users remove specific vulnerabilities. As a result, Ferret-Windows is extensible, and can easily be kept up-to-date through the addition of checks for new vulnerabilities as they are identified. Finally, Ferret-Windows is a freely available open-source software},
	keywords = {application vulnerabilities, computing system security, Ferret-Windows software tool, host vulnerabilities, network vulnerabilities, open-source software, operating systems (computers), plug-in module, program diagnostics, security of data, software reliability, software tools, system attacks, Windows host vulnerability checking, Windows platforms},
	doi = {10.1109/ISSRE.2005.11},
	author = {Tamizi,M. and Weinstein,M. and Michel Cukier}
}
@conference {18672,
	title = {Fault injection based on a partial view of the global state of a distributed system},
	year = {1999},
	month = {1999///},
	pages = {168 - 177},
	abstract = {This paper describes the basis for and preliminary implementation of a new fault injector, called Loki, developed specifically for distributed systems. Loki addresses issues related to injecting correlated faults in distributed systems. In Loki, fault injection is performed based on a partial view of the global state of an application. In particular, facilities are provided to pass user-specified state information between nodes to provide a partial view of the global state in order to try to inject complex faults successfully. A post-runtime analysis, using an off-line clock synchronization and a bounding technique, is used to place events and injections on a single global time-line and determine whether the intended faults were properly injected. Finally, observations containing successful fault injections are used to estimate specified dependability measures. In addition to describing the details of our new approach, we present experimental results obtained from a preliminary implementation in order to illustrate Loki{\textquoteright}s ability to inject complex faults predictably},
	keywords = {bounding technique, clock synchronization, distributed programming, distributed software systems, fault injection, Loki, post-runtime analysis, program testing, program verification, software reliability, Synchronisation},
	doi = {10.1109/RELDIS.1999.805093},
	author = {Michel Cukier and Chandra,R. and Henke,D. and Pistole,J. and Sanders,W. H.}
}
@conference {18687,
	title = {Probabilistic verification of a synchronous round-based consensus protocol},
	year = {1997},
	month = {1997/10//},
	pages = {165 - 174},
	abstract = {Consensus protocols are used in a variety of reliable distributed systems, including both safety-critical and business-critical applications. The correctness of a consensus protocol is usually shown, by making assumptions about the environment in which it executes, and then proving properties about the protocol. But proofs about a protocol{\textquoteright}s behavior are only as good as the assumptions which were made to obtain them, and violation of these assumptions can lead to unpredicted and serious consequences. We present a new approach for the probabilistic verification of synchronous round based consensus protocols. In doing so, we make stochastic assumptions about the environment in which a protocol operates, and derive probabilities of proper and non proper behavior. We thus can account for the violation of assumptions made in traditional proof techniques. To obtain the desired probabilities, the approach enumerates possible states that can be reached during an execution of the protocol, and computes the probability of achieving the desired properties for a given fault and network environment. We illustrate the use of this approach via the evaluation of a simple consensus protocol operating under a realistic environment which includes performance, omission, and crash failures},
	keywords = {business-critical applications, consensus protocol correctness, crash failures, formal verification, network environment, probabilistic verification, probabilities, probability, program verification, proper behavior, protocol behavior, Protocols, realistic environment, reliable distributed systems, safety-critical applications, simple consensus protocol, software reliability, stochastic assumptions, synchronous round based consensus protocol, synchronous round based consensus protocols, traditional proof techniques},
	doi = {10.1109/RELDIS.1997.632812},
	author = {Duggal,H.S. and Michel Cukier and Sanders,W. H.}
}
@conference {12092,
	title = {A secure and reliable bootstrap architecture},
	booktitle = {, 1997 IEEE Symposium on Security and Privacy, 1997. Proceedings},
	year = {1997},
	month = {1997/05/04/7},
	pages = {65 - 71},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In a computer system, the integrity of lower layers is typically treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, the integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity {\textquotedblleft}chain{\textquotedblright} inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made, yet these guarantees are increasingly important to diverse applications such as Internet commerce, security systems and {\textquotedblleft}active networks{\textquotedblright}. In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems},
	keywords = {active networks, AEGIS architecture, bootstrap architecture, Computer architecture, computer bootstrapping, data integrity, Distributed computing, Hardware, hardware validity, initialization, integrity chain, integrity check failures, Internet, Internet commerce, IP networks, Laboratories, lower-layer integrity, Microprogramming, Operating systems, recovery process, reliability, robust systems, Robustness, Security, security of data, software reliability, system integrity guarantees, system recovery, transitions, Virtual machining},
	isbn = {0-8186-7828-3},
	doi = {10.1109/SECPRI.1997.601317},
	author = {Arbaugh, William A. and Farber,D. J and Smith,J. M}
}
