@conference {19027,
	title = {BIND: a fine-grained attestation service for secure distributed systems},
	year = {2005},
	month = {2005},
	pages = {154 - 168},
	abstract = {In this paper we propose BIND (binding instructions and data), a fine-grained attestation service for securing distributed systems. Code attestation has recently received considerable attention in trusted computing. However, current code attestation technology is relatively immature. First, due to the great variability in software versions and configurations, verification of the hash is difficult. Second, the time-of-use and time-of-attestation discrepancy remains to be addressed, since the code may be correct at the time of the attestation, but it may be compromised by the time of use. The goal of BIND is to address these issues and make code attestation more usable in securing distributed systems. BIND offers the following properties: (1) BIND performs fine-grained attestation. Instead of attesting to the entire memory content, BIND attests only to the piece of code we are concerned about. This greatly simplifies verification. (2) BIND narrows the gap between time-of-attestation and time-of-use. BIND measures a piece of code immediately before it is executed and uses a sandboxing mechanism to protect the execution of the attested code. (3) BIND ties the code attestation with the data that the code produces, such that we can pinpoint what code has been run to generate that data. In addition, by incorporating the verification of input data integrity into the attestation, BIND offers transitive integrity verification, i.e., through one signature, we can vouch for the entire chain of processes that have performed transformations over a piece of data. BIND offers a general solution toward establishing a trusted environment for distributed system designers.},
	keywords = {BIND, binding instructions and data, code attestation, data integrity, digital signatures, distributed processing, fine-grained attestation service, input data integrity, program verification, sandboxing mechanism, secure distributed systems, signature, time-of-attestation, time-of-use, transitive integrity verification, trusted computing},
	author = {Elaine Shi and Perrig, A. and Van Doorn, L.}
}
@conference {18673,
	title = {Ferret: a host vulnerability checking tool},
	year = {2004},
	month = {2004/03//},
	pages = {389 - 394},
	abstract = {Evaluation of computing system security requires knowledge of the vulnerabilities present in the system and of potential attacks against the system. Vulnerabilities can be classified based on their location as application vulnerabilities, network vulnerabilities, or host vulnerabilities. We describe Ferret, a new software tool for checking host vulnerabilities. Ferret helps system administrators by quickly finding vulnerabilities that are present on a host. It is designed and implemented in a modular way: a different plug-in module is used for each vulnerability checked, and each possible output format is specified by a plug-in module. As a result, Ferret is extensible, and can easily be kept up-to-date through addition of checks for new vulnerabilities as they are discovered; the modular approach also makes it easy to provide specific configurations of Ferret tailored to specific operating systems or use environments. Ferret is a freely available open-source software implemented in Perl.},
	keywords = {Ferret software tool, host vulnerability checking tool, open-source software, Perl, plug-in module, program verification, security auditing tool, security evaluation, security of data, software tools},
	doi = {10.1109/PRDC.2004.1276595},
	author = {Sharma,Anil and Martin,J.R. and Anand,N. and Michel Cukier and Sanders,W. H.}
}
@conference {15468,
	title = {Skoll: distributed continuous quality assurance},
	booktitle = {Software Engineering, 2004. ICSE 2004. Proceedings. 26th International Conference on},
	year = {2004},
	month = {2004/05//},
	pages = {459 - 468},
	abstract = {Quality assurance (QA) tasks, such as testing, profiling, and performance evaluation, have historically been done in-house on developer-generated workloads and regression suites. Since this approach is inadequate for many systems, tools and processes are being developed to improve software quality by increasing user participation in the QA process. A limitation of these approaches is that they focus on isolated mechanisms, not on the coordination and control policies and tools needed to make the global QA process efficient, effective, and scalable. To address these issues, we have initiated the Skoll project, which is developing and validating novel software QA processes and tools that leverage the extensive computing resources of worldwide user communities in a distributed, continuous manner to significantly and rapidly improve software quality. This paper provides several contributions to the study of distributed continuous QA. First, it illustrates the structure and functionality of a generic around-the-world, around-the-clock QA process and describes several sophisticated tools that support this process. Second, it describes several QA scenarios built using these tools and process. Finally, it presents a feasibility study applying these scenarios to a 1MLOC+ software package called ACE+TAO. While much work remains to be done, the study suggests that the Skoll process and tools effectively manage and control distributed, continuous QA processes. Using Skoll we rapidly identified problems that had taken the ACE+TAO developers substantially longer to find and several of which had previously not been found. Moreover, automatic analysis of QA task results often provided developers information that quickly led them to the root cause of the problems.},
	keywords = {1MLOC+ software package, ACE+TAO, around-the-clock QA process, around-the-world QA process, distributed continuous QA, distributed continuous quality assurance, distributed programming, program verification, Quality assurance, Skoll, software performance evaluation, software profiling, Software quality, Software testing},
	doi = {10.1109/ICSE.2004.1317468},
	author = {Memon, Atif M. and Porter, Adam and Yilmaz,C. and Nagarajan,A. and Schmidt,D. and Natarajan,B.}
}
@conference {18672,
	title = {Fault injection based on a partial view of the global state of a distributed system},
	year = {1999},
	month = {1999///},
	pages = {168 - 177},
	abstract = {This paper describes the basis for and preliminary implementation of a new fault injector, called Loki, developed specifically for distributed systems. Loki addresses issues related to injecting correlated faults in distributed systems. In Loki, fault injection is performed based on a partial view of the global state of an application. In particular, facilities are provided to pass user-specified state information between nodes to provide a partial view of the global state in order to try to inject complex faults successfully. A post-runtime analysis, using an off-line clock synchronization and a bounding technique, is used to place events and injections on a single global time-line and determine whether the intended faults were properly injected. Finally, observations containing successful fault injections are used to estimate specified dependability measures. In addition to describing the details of our new approach, we present experimental results obtained from a preliminary implementation in order to illustrate Loki{\textquoteright}s ability to inject complex faults predictably},
	keywords = {bounding technique, clock synchronization, distributed programming, distributed software systems, fault injection, Loki, post-runtime analysis, program testing, program verification, software reliability, Synchronisation},
	doi = {10.1109/RELDIS.1999.805093},
	author = {Michel Cukier and Chandra,R. and Henke,D. and Pistole,J. and Sanders,W. H.}
}
@conference {18687,
	title = {Probabilistic verification of a synchronous round-based consensus protocol},
	year = {1997},
	month = {1997/10//},
	pages = {165 - 174},
	abstract = {Consensus protocols are used in a variety of reliable distributed systems, including both safety-critical and business-critical applications. The correctness of a consensus protocol is usually shown, by making assumptions about the environment in which it executes, and then proving properties about the protocol. But proofs about a protocol{\textquoteright}s behavior are only as good as the assumptions which were made to obtain them, and violation of these assumptions can lead to unpredicted and serious consequences. We present a new approach for the probabilistic verification of synchronous round based consensus protocols. In doing so, we make stochastic assumptions about the environment in which a protocol operates, and derive probabilities of proper and non proper behavior. We thus can account for the violation of assumptions made in traditional proof techniques. To obtain the desired probabilities, the approach enumerates possible states that can be reached during an execution of the protocol, and computes the probability of achieving the desired properties for a given fault and network environment. We illustrate the use of this approach via the evaluation of a simple consensus protocol operating under a realistic environment which includes performance, omission, and crash failures},
	keywords = {business-critical applications, consensus protocol correctness, crash failures, formal verification, network environment, probabilistic verification, probabilities, probability, program verification, proper behavior, protocol behavior, Protocols, realistic environment, reliable distributed systems, safety-critical applications, simple consensus protocol, software reliability, stochastic assumptions, synchronous round based consensus protocol, synchronous round based consensus protocols, traditional proof techniques},
	doi = {10.1109/RELDIS.1997.632812},
	author = {Duggal,H.S. and Michel Cukier and Sanders,W. H.}
}
