A referred paper in Proceedings of the Cybersecurity Applications & Technology Conference for Homeland Security (CATCH 2009). Abstract: "From its inception in 2004, the DETER testbed facility has provided effective, dedicated experimental resources and expertise to a broad range of academic, industrial and government researchers. Now, building on knowledge gained, the DETER developers and community are moving beyond the classic “testbed” model and towards the creation and deployment of fundamentally transformational cybersecurity research methodologies. This paper discusses underlying rationale, together with initial design and implementation, of key technical concepts that drive these transformations." Authors: Terry Benzel, Bob Braden, Ted Faber, Jelena Mirkovic, Steve Schwab, Karen Sollins, and John Wroclawski.
The Science of Cyber Security Experimentation: The DETER ProjectDETER-Project
Terry Benzel provided the keynote address at the 11th Annual Computer Security Applications Conference (ACSAC). This document is the invited paper that she addressed in her keynote.
Abstract: Since 2004, the DETER Cyber-security Project has worked to create an evolving infrastructure – facilities, tools, and processes – to provide a national resource for experimentation in cyber security. Building on our insights into requirements for cyber science and on lessons learned through 8 years of operation, we have made several transformative advances towards creating the next generation of DeterLab. These advances in experiment design and research methodology are yielding progressive improvements not only in experiment scale, complexity, diversity, and repeatability, but also in the ability of researchers to leverage prior experimental efforts of other researchers in the DeterLab user community. This paper describes the advances resulting in a new experimentation science and a transformed facility for cyber-security research development and evaluation.
Further described: http://www.deter-project.org/blog/deter_-_keynote_address_acsac_key_new_web_site
For additional information, visit:
- http://www.deter-project.org
- http://info.deterlab.net
The DETER Project: Towards Structural Advances in Experimental Cybersecurity ...DETER-Project
Abstract: It is widely argued that today's largely reactive, "respond and patch" approach to securing cyber systems must yield to a new, more rigorous, more proactive methodology. Achieving this transformation is a difficult challenge. Building on insights into requirements for cyber science and on experience gained through 8 years of operation, the DETER project is addressing one facet of this problem: the development of transformative advances in methodology and facilities for experimental cybersecurity research and system evaluation. These advances in experiment design and research methodology are yielding progressive improvements not only in experiment scale, complexity, diversity, and repeatability, but also in the ability of researchers to leverage prior experimental efforts of others within the community. We describe in this paper the trajectory of the DETER project towards a new experimental science and a transformed facility for cyber-security research development and evaluation.
For more information, visit: http://www.deter-project.org
The DETER Project: Advancing the Science of Cyber Security Experimentation an...DETER-Project
Abstract: Since 2004, the DETER Cybersecurity Testbed Project has worked to create the necessary infrastructure – facilities, tools, and processes – to provide a national resource for experimentation in cyber security. The next generation of DETER envisions several conceptual advances in testbed design and experimental research methodology, targeting improved experimental validity, enhanced usability, and increased size, complexity, and diversity of experiments. This paper outlines the DETER project's status and R&D directions.
For more information, visit: http://www.deter-project.org
This document summarizes research into security risks associated with DNA sequencing and analysis. The researchers demonstrated the first example of compromising a computer system using synthesized DNA by encoding an exploit into DNA strands that generated a file giving remote code execution when processed. They also observed unintended information leakage between samples during sequencing due to sample multiplexing techniques. Additionally, they found that DNA analysis software lacks modern security practices and contains buffer overflow vulnerabilities. Based on these findings, the researchers presented a threat model and recommendations to help safeguard security and privacy in the DNA processing pipeline.
This document introduces TinySec, a link layer security architecture designed for wireless sensor networks. TinySec aims to provide security such as message authentication and encryption with minimal overhead of bandwidth, latency, and energy consumption. The document discusses the design goals and challenges of sensor network security given constraints of memory, processing power, bandwidth and energy of sensor nodes. It argues that link layer security is better suited than end-to-end security for sensor networks where data aggregation is common. TinySec implements message authentication codes and encryption entirely in software to add security with less than 10% overhead.
The researchers are developing a handheld sensor that can identify bacteria and other substances at the molecular level. They have created a sensor that uses electrical pulses to determine if a cell is alive or dead by analyzing the returning signal from the cell's membrane. Their goals are to obtain more information about the interior of cells, optimize and miniaturize the device, and potentially perform abbreviated DNA sequencing to unambiguously identify cells. They aim to incorporate all the components onto a single microchip.
The document discusses several testbeds and frameworks for evaluating intrusion detection systems (IDS), including the Air Force Evaluation Environment, LARIAT, and TIDeS testbeds. The TIDeS framework allows for customized testing scenarios, automated evaluations, and uses fuzzy logic to evaluate IDS performance based on metrics like detection depth, breadth, and false alarms. It generates realistic network profiles and traffic and can test IDSs under different environments.
In this deck from the 2014 HPC User Forum in Seattle, Jack Collins from the National Cancer Institute presents: Genomes to Structures to Function: The Role of HPC.
Watch the video presentation: http://wp.me/p3RLHQ-d28
The Science of Cyber Security Experimentation: The DETER ProjectDETER-Project
Terry Benzel provided the keynote address at the 11th Annual Computer Security Applications Conference (ACSAC). This document is the invited paper that she addressed in her keynote.
Abstract: Since 2004, the DETER Cyber-security Project has worked to create an evolving infrastructure – facilities, tools, and processes – to provide a national resource for experimentation in cyber security. Building on our insights into requirements for cyber science and on lessons learned through 8 years of operation, we have made several transformative advances towards creating the next generation of DeterLab. These advances in experiment design and research methodology are yielding progressive improvements not only in experiment scale, complexity, diversity, and repeatability, but also in the ability of researchers to leverage prior experimental efforts of other researchers in the DeterLab user community. This paper describes the advances resulting in a new experimentation science and a transformed facility for cyber-security research development and evaluation.
Further described: http://www.deter-project.org/blog/deter_-_keynote_address_acsac_key_new_web_site
For additional information, visit:
- http://www.deter-project.org
- http://info.deterlab.net
The DETER Project: Towards Structural Advances in Experimental Cybersecurity ...DETER-Project
Abstract: It is widely argued that today's largely reactive, "respond and patch" approach to securing cyber systems must yield to a new, more rigorous, more proactive methodology. Achieving this transformation is a difficult challenge. Building on insights into requirements for cyber science and on experience gained through 8 years of operation, the DETER project is addressing one facet of this problem: the development of transformative advances in methodology and facilities for experimental cybersecurity research and system evaluation. These advances in experiment design and research methodology are yielding progressive improvements not only in experiment scale, complexity, diversity, and repeatability, but also in the ability of researchers to leverage prior experimental efforts of others within the community. We describe in this paper the trajectory of the DETER project towards a new experimental science and a transformed facility for cyber-security research development and evaluation.
For more information, visit: http://www.deter-project.org
The DETER Project: Advancing the Science of Cyber Security Experimentation an...DETER-Project
Abstract: Since 2004, the DETER Cybersecurity Testbed Project has worked to create the necessary infrastructure – facilities, tools, and processes – to provide a national resource for experimentation in cyber security. The next generation of DETER envisions several conceptual advances in testbed design and experimental research methodology, targeting improved experimental validity, enhanced usability, and increased size, complexity, and diversity of experiments. This paper outlines the DETER project's status and R&D directions.
For more information, visit: http://www.deter-project.org
This document summarizes research into security risks associated with DNA sequencing and analysis. The researchers demonstrated the first example of compromising a computer system using synthesized DNA by encoding an exploit into DNA strands that generated a file giving remote code execution when processed. They also observed unintended information leakage between samples during sequencing due to sample multiplexing techniques. Additionally, they found that DNA analysis software lacks modern security practices and contains buffer overflow vulnerabilities. Based on these findings, the researchers presented a threat model and recommendations to help safeguard security and privacy in the DNA processing pipeline.
This document introduces TinySec, a link layer security architecture designed for wireless sensor networks. TinySec aims to provide security such as message authentication and encryption with minimal overhead of bandwidth, latency, and energy consumption. The document discusses the design goals and challenges of sensor network security given constraints of memory, processing power, bandwidth and energy of sensor nodes. It argues that link layer security is better suited than end-to-end security for sensor networks where data aggregation is common. TinySec implements message authentication codes and encryption entirely in software to add security with less than 10% overhead.
The researchers are developing a handheld sensor that can identify bacteria and other substances at the molecular level. They have created a sensor that uses electrical pulses to determine if a cell is alive or dead by analyzing the returning signal from the cell's membrane. Their goals are to obtain more information about the interior of cells, optimize and miniaturize the device, and potentially perform abbreviated DNA sequencing to unambiguously identify cells. They aim to incorporate all the components onto a single microchip.
The document discusses several testbeds and frameworks for evaluating intrusion detection systems (IDS), including the Air Force Evaluation Environment, LARIAT, and TIDeS testbeds. The TIDeS framework allows for customized testing scenarios, automated evaluations, and uses fuzzy logic to evaluate IDS performance based on metrics like detection depth, breadth, and false alarms. It generates realistic network profiles and traffic and can test IDSs under different environments.
In this deck from the 2014 HPC User Forum in Seattle, Jack Collins from the National Cancer Institute presents: Genomes to Structures to Function: The Role of HPC.
Watch the video presentation: http://wp.me/p3RLHQ-d28
This document discusses using wireless sensor networks for habitat monitoring. It presents requirements for a system to monitor seabird nesting environments and behaviors. The currently deployed network consists of 32 sensor nodes on an island off the coast of Maine that stream live data online. The application-driven design helps identify important areas for further work like data sampling, communications, network tasks, and health monitoring.
Testimony of Terry V. Benzel, University of Southern California Information S...DETER-Project
1. The witness discusses the importance of expanding the scope of cybersecurity research to address evolving threats. Narrowly focused research is not enough to keep up with adversaries who plan attacks across systems.
2. Infrastructure is needed to enable experimental cybersecurity research and testing at scale. This allows innovations to be proven in realistic settings and better prepared for technology transfer.
3. New models are needed to successfully transfer university research into commercial products. Not all innovations work as expected outside controlled labs.
An organized and Secured Local Area Network in Naval Post Graduate SchoolJude Rainer
This document presents a case study on establishing an organized and secure local area network for the laboratories at the Naval Postgraduate School. It discusses the current unsecured state of the network and identifies problems like unorganized user accounts, unsafe external device connections, and indirect instructor-student communication. The study aims to implement solutions like active directory for user organization, a proxy server to block unnecessary websites, disabling external ports, a local mail server for communication, and a firewall for security screening. The overall goal is to develop a fully secured network that protects hardware, software and information resources.
This document proposes a multi-agent system architecture for reacting to security alerts in heterogeneous distributed networks. The architecture has three layers - a low level that interfaces with the target infrastructure, an intermediate level that correlates alerts from different domains and deploys reaction actions, and a high level global view. It uses an ontology and Bayesian network based decision support system to help agents make decisions according to preferences and influence diagrams. The approach is illustrated using a case study of a medical application distributed across buildings, campuses and metropolitan areas.
A security decision reaction architecture for heterogeneous distributed networkchristophefeltus
This document proposes a multi-agent system architecture for reacting to security alerts in heterogeneous distributed networks. The architecture has three layers - low, intermediate, and high - and consists of agents that perform alert correlation, reaction decision making, and policy deployment. The agents communicate by exchanging messages. The architecture is intended to allow for quick and efficient reaction to security attacks while ensuring coordinated configuration changes across network components. It was developed and illustrated using a case study of a medical application distributed across buildings, campuses, and metropolitan areas.
BUILDING RELIABLE CLOUD SYSTEMS THROUGH CHAOS ENGINEERINGIJMIT JOURNAL
Cloud computing systems need to be reliable so that they can be accessed and used for computing at any
given point in time. The complex nature of cloud systems is the motivation to conduct research in novel
ways of ensuring that cloud systems are built with reliability in mind. In building cloud systems, it is
expected that the cloud system will be able to deal with high demands and unexpected events that affect the
reliability and performance of the system.
In this paper, chaos engineering is considered a heuristic method that can be used to build reliable cloud
systems. Chaos engineering is aimed at exposing weaknesses in systems that are in production. Chaos
engineering will help identify system weaknesses and strengths when a system is exposed to unexpected
knocks and shocks while it is in production.
Chaos engineering allows system developers and administrators to get insights into how the cloud system
will behave when it is exposed to unexpected occurrences.
BUILDING RELIABLE CLOUD SYSTEMS THROUGH CHAOS ENGINEERINGIJMIT JOURNAL
Cloud computing systems need to be reliable so that they can be accessed and used for computing at any
given point in time. The complex nature of cloud systems is the motivation to conduct research in novel
ways of ensuring that cloud systems are built with reliability in mind. In building cloud systems, it is
expected that the cloud system will be able to deal with high demands and unexpected events that affect the
reliability and performance of the system.
In this paper, chaos engineering is considered a heuristic method that can be used to build reliable cloud
systems. Chaos engineering is aimed at exposing weaknesses in systems that are in production. Chaos
engineering will help identify system weaknesses and strengths when a system is exposed to unexpected
knocks and shocks while it is in production.
Chaos engineering allows system developers and administrators to get insights into how the cloud system
will behave when it is exposed to unexpected occurrences.
This document proposes an architectural model for ensuring reliability, availability, safety and security in large scale distributed systems. The model includes components for failure detection, security decision making, and dynamic adaptation. It aims to provide fault prevention, removal, tolerance and forecasting. The core allows modularity and integration with grid technologies. It uses both replication and survivability mechanisms to ensure functions continue in the face of faults or attacks. The goal is a unified approach to dependability that can scale to large, complex distributed systems.
The document proposes developing software to enable secure and authorized dynamic group resource management. It aims to implement attribute-based access control and dynamic delegation of access rights to address limitations in existing group-centric applications. The research plan involves three phases: literature review and requirements analysis; core implementation of access control and delegation features; and testing, performance analysis, and real-world deployment. The proposed software would facilitate secure collaboration and resource sharing for educational institutions and organizations.
The document discusses Cisco's approach to endpoint security which goes beyond traditional prevention and point-in-time detection. It involves continuous monitoring, detection and response across the full attack continuum before, during and after an attack. This continuous approach provides visibility into compromise and persistence unlike traditional methods. It allows security teams to quickly contain and remediate infections without disrupting users. The approach weaves together file, process and communication streams over time to capture relationships and detect behavioral indicators of compromise in real-time.
This document discusses using virtual laboratories for security education. It begins with an introduction on using virtual environments for practical coursework. It then discusses the strengths, weaknesses, opportunities and threats (SWOT analysis) of using virtual security laboratories. The key strengths are that virtual environments allow students administrator privileges safely, have simple saving and roll-back of states, and are scalable and versatile for security networking scenarios. Weaknesses include potential loss of computing power compared to physical machines. Opportunities include more efficient use of hardware and potential cost savings. Threats include software licensing issues and ensuring virtual machines are securely contained.
The Art of Penetration Testing in Cybersecurity.Expeed Software
It is important to detect vulnerabilities in a system to safeguard it from cyber attacks. This is where penetration testing comes into the picture. In this presentation, explore everything there is to know about penetration testing, why it is important and how it helps you to detect vulnerabilities through various techniques. At Expeed software, we prioritize security, being a web development company at the forefront. Connect to Expeed Software for secure and robust solutions with privacy being an assurance. https://expeed.com/
ANALYSIS OF SOFTWARE SECURITY TESTING TECHNIQUES IN CLOUD COMPUTINGEditor IJMTER
Cloud Security Testing is becoming a Popular field of Research Topic in Cloud
Computing and Software Engineering. As the advance of cloud technology and services, more
research work must be done to address the open issues and challenges in cloud security testing and
More innovative testing techniques and solutions, Although there are many published papers
discussing cloud Security testing, there is a lack of research papers addressing new issues,
challenges, and needs in Software Security Testing. however, there is no clear methodology to
follow in order to complete a cloud security testing. Since there is an increasing demand in Software
usage there is more in for Software Security Testing. This paper presents an overview of Cloud
Computing, Cloud security testing and comprehensive survey of security Testing Techniques and
methods. from this we have identified problems in the current security testing techniques. This work
has to presents a roadmap for new testers on the cloud with the necessary information to start their
test.
This document proposes OpenFlow, which allows researchers to run experimental network protocols on campus networks. OpenFlow is based on Ethernet switches that have an internal flow table and standardized interface to add and remove flow entries. This would enable researchers to evaluate new ideas in realistic campus network traffic settings. The goal is to encourage networking vendors to add OpenFlow to their campus switches so researchers can experiment without disrupting the normal network operations.
This document discusses applied observational studies in cybersecurity research. It begins by defining applied research as introducing a specific change or subject to evaluate, compared to observational studies which observe a system without changes. It then discusses two types of applied observational studies: applied exploratory studies which introduce changes to understand performance under conditions, and applied descriptive studies which focus on a specific subject's real-world integration. The document provides an example of an applied exploratory stress test of a new communication application's encryption on battery life under heavy usage. It outlines defining the system, behavior to study, and a host-based testing methodology to evaluate battery consumption without affecting results.
This document proposes an approach to creating cyber resiliency using emerging technologies and network architectures. It identifies key technologies like deep packet inspection, application performance management, and control plane architectures that can be leveraged to build more resilient networks. The document then illustrates an example architecture and proposes validating cyber resiliency solutions using academic network infrastructure to test solutions on real networks at scale.
The PETRAS project aims to address privacy, ethics, trust, reliability, acceptability, and security issues for the Internet of Things. It will take an integrated social science and technical approach through collaborative projects across nine UK universities and other partners. The projects will be organized into streams and constellations focused on different sectors to provide insights and recommendations.
In this presentation I will show a set of important topics about Software Engineering Empirical Studies that can be useful for increasing quality on your thesis and monographs in general. You can read this presentation and to think about how to do a good experimentation by apply its objectives, validation methods, questions, answers expected, define metrics and measuring it.I will exhibit how the researchers selected the data for avoid case studies in a biased way using a GQM methodology to sort the study in a simpler view as well.
Design and implementation of secured scan based attacks on ic’s by using on c...eSAT Journals
Abstract Physical designing of cryptographic analysis is subjected to various physical attacks. It has been formerly evidenced that scan chains introduce for hardware testability open a back door to potential attacks. Scan based testing technique is mainly used for testing and it provides full observabilty and controllability of the inner nodes of the IC. Therefore, in this paper, we propose a scan-protection scheme that provides testing facilities both at assembly time and over the course of the circuit’s life. An efficient principle is used to scan-in both input vectors and expected responses to compare expected and actual responses inside the circuit. This method has no impact on the feature of the test or the model-based fault analysis when compared to traditional scan tests. It occupies less area on the chip and avoids the authentication test mechanism. Keywords- security, testability, Design-for-testability (DFT), scan-based attack, test pattern generator
Design and implementation of secured scan based attacks on ic’s by using on c...eSAT Publishing House
The document proposes a scan-protection scheme that provides testing facilities both during chip assembly and over the course of the circuit's life. It compares expected and actual test responses inside the circuit using an efficient principle to scan-in both input vectors and expected responses. This avoids needing to disconnect scan chains after manufacturing testing for security purposes. The proposed approach compares test responses within the chip at the vector level rather than providing the value of each individual scan bit. This ensures security while not relying on costly external test infrastructure. Simulation results show the proposed scheme occupies less area on the chip than existing approaches.
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyScyllaDB
Freshworks creates AI-boosted business software that helps employees work more efficiently and effectively. Managing data across multiple RDBMS and NoSQL databases was already a challenge at their current scale. To prepare for 10X growth, they knew it was time to rethink their database strategy. Learn how they architected a solution that would simplify scaling while keeping costs under control.
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...DanBrown980551
This LF Energy webinar took place June 20, 2024. It featured:
-Alex Thornton, LF Energy
-Hallie Cramer, Google
-Daniel Roesler, UtilityAPI
-Henry Richardson, WattTime
In response to the urgency and scale required to effectively address climate change, open source solutions offer significant potential for driving innovation and progress. Currently, there is a growing demand for standardization and interoperability in energy data and modeling. Open source standards and specifications within the energy sector can also alleviate challenges associated with data fragmentation, transparency, and accessibility. At the same time, it is crucial to consider privacy and security concerns throughout the development of open source platforms.
This webinar will delve into the motivations behind establishing LF Energy’s Carbon Data Specification Consortium. It will provide an overview of the draft specifications and the ongoing progress made by the respective working groups.
Three primary specifications will be discussed:
-Discovery and client registration, emphasizing transparent processes and secure and private access
-Customer data, centering around customer tariffs, bills, energy usage, and full consumption disclosure
-Power systems data, focusing on grid data, inclusive of transmission and distribution networks, generation, intergrid power flows, and market settlement data
More Related Content
Similar to Current Developments in DETER Cybersecurity Testbed Technology
This document discusses using wireless sensor networks for habitat monitoring. It presents requirements for a system to monitor seabird nesting environments and behaviors. The currently deployed network consists of 32 sensor nodes on an island off the coast of Maine that stream live data online. The application-driven design helps identify important areas for further work like data sampling, communications, network tasks, and health monitoring.
Testimony of Terry V. Benzel, University of Southern California Information S...DETER-Project
1. The witness discusses the importance of expanding the scope of cybersecurity research to address evolving threats. Narrowly focused research is not enough to keep up with adversaries who plan attacks across systems.
2. Infrastructure is needed to enable experimental cybersecurity research and testing at scale. This allows innovations to be proven in realistic settings and better prepared for technology transfer.
3. New models are needed to successfully transfer university research into commercial products. Not all innovations work as expected outside controlled labs.
An organized and Secured Local Area Network in Naval Post Graduate SchoolJude Rainer
This document presents a case study on establishing an organized and secure local area network for the laboratories at the Naval Postgraduate School. It discusses the current unsecured state of the network and identifies problems like unorganized user accounts, unsafe external device connections, and indirect instructor-student communication. The study aims to implement solutions like active directory for user organization, a proxy server to block unnecessary websites, disabling external ports, a local mail server for communication, and a firewall for security screening. The overall goal is to develop a fully secured network that protects hardware, software and information resources.
This document proposes a multi-agent system architecture for reacting to security alerts in heterogeneous distributed networks. The architecture has three layers - a low level that interfaces with the target infrastructure, an intermediate level that correlates alerts from different domains and deploys reaction actions, and a high level global view. It uses an ontology and Bayesian network based decision support system to help agents make decisions according to preferences and influence diagrams. The approach is illustrated using a case study of a medical application distributed across buildings, campuses and metropolitan areas.
A security decision reaction architecture for heterogeneous distributed networkchristophefeltus
This document proposes a multi-agent system architecture for reacting to security alerts in heterogeneous distributed networks. The architecture has three layers - low, intermediate, and high - and consists of agents that perform alert correlation, reaction decision making, and policy deployment. The agents communicate by exchanging messages. The architecture is intended to allow for quick and efficient reaction to security attacks while ensuring coordinated configuration changes across network components. It was developed and illustrated using a case study of a medical application distributed across buildings, campuses, and metropolitan areas.
BUILDING RELIABLE CLOUD SYSTEMS THROUGH CHAOS ENGINEERINGIJMIT JOURNAL
Cloud computing systems need to be reliable so that they can be accessed and used for computing at any
given point in time. The complex nature of cloud systems is the motivation to conduct research in novel
ways of ensuring that cloud systems are built with reliability in mind. In building cloud systems, it is
expected that the cloud system will be able to deal with high demands and unexpected events that affect the
reliability and performance of the system.
In this paper, chaos engineering is considered a heuristic method that can be used to build reliable cloud
systems. Chaos engineering is aimed at exposing weaknesses in systems that are in production. Chaos
engineering will help identify system weaknesses and strengths when a system is exposed to unexpected
knocks and shocks while it is in production.
Chaos engineering allows system developers and administrators to get insights into how the cloud system
will behave when it is exposed to unexpected occurrences.
BUILDING RELIABLE CLOUD SYSTEMS THROUGH CHAOS ENGINEERINGIJMIT JOURNAL
Cloud computing systems need to be reliable so that they can be accessed and used for computing at any
given point in time. The complex nature of cloud systems is the motivation to conduct research in novel
ways of ensuring that cloud systems are built with reliability in mind. In building cloud systems, it is
expected that the cloud system will be able to deal with high demands and unexpected events that affect the
reliability and performance of the system.
In this paper, chaos engineering is considered a heuristic method that can be used to build reliable cloud
systems. Chaos engineering is aimed at exposing weaknesses in systems that are in production. Chaos
engineering will help identify system weaknesses and strengths when a system is exposed to unexpected
knocks and shocks while it is in production.
Chaos engineering allows system developers and administrators to get insights into how the cloud system
will behave when it is exposed to unexpected occurrences.
This document proposes an architectural model for ensuring reliability, availability, safety and security in large scale distributed systems. The model includes components for failure detection, security decision making, and dynamic adaptation. It aims to provide fault prevention, removal, tolerance and forecasting. The core allows modularity and integration with grid technologies. It uses both replication and survivability mechanisms to ensure functions continue in the face of faults or attacks. The goal is a unified approach to dependability that can scale to large, complex distributed systems.
The document proposes developing software to enable secure and authorized dynamic group resource management. It aims to implement attribute-based access control and dynamic delegation of access rights to address limitations in existing group-centric applications. The research plan involves three phases: literature review and requirements analysis; core implementation of access control and delegation features; and testing, performance analysis, and real-world deployment. The proposed software would facilitate secure collaboration and resource sharing for educational institutions and organizations.
The document discusses Cisco's approach to endpoint security which goes beyond traditional prevention and point-in-time detection. It involves continuous monitoring, detection and response across the full attack continuum before, during and after an attack. This continuous approach provides visibility into compromise and persistence unlike traditional methods. It allows security teams to quickly contain and remediate infections without disrupting users. The approach weaves together file, process and communication streams over time to capture relationships and detect behavioral indicators of compromise in real-time.
This document discusses using virtual laboratories for security education. It begins with an introduction on using virtual environments for practical coursework. It then discusses the strengths, weaknesses, opportunities and threats (SWOT analysis) of using virtual security laboratories. The key strengths are that virtual environments allow students administrator privileges safely, have simple saving and roll-back of states, and are scalable and versatile for security networking scenarios. Weaknesses include potential loss of computing power compared to physical machines. Opportunities include more efficient use of hardware and potential cost savings. Threats include software licensing issues and ensuring virtual machines are securely contained.
The Art of Penetration Testing in Cybersecurity.Expeed Software
It is important to detect vulnerabilities in a system to safeguard it from cyber attacks. This is where penetration testing comes into the picture. In this presentation, explore everything there is to know about penetration testing, why it is important and how it helps you to detect vulnerabilities through various techniques. At Expeed software, we prioritize security, being a web development company at the forefront. Connect to Expeed Software for secure and robust solutions with privacy being an assurance. https://expeed.com/
ANALYSIS OF SOFTWARE SECURITY TESTING TECHNIQUES IN CLOUD COMPUTINGEditor IJMTER
Cloud Security Testing is becoming a Popular field of Research Topic in Cloud
Computing and Software Engineering. As the advance of cloud technology and services, more
research work must be done to address the open issues and challenges in cloud security testing and
More innovative testing techniques and solutions, Although there are many published papers
discussing cloud Security testing, there is a lack of research papers addressing new issues,
challenges, and needs in Software Security Testing. however, there is no clear methodology to
follow in order to complete a cloud security testing. Since there is an increasing demand in Software
usage there is more in for Software Security Testing. This paper presents an overview of Cloud
Computing, Cloud security testing and comprehensive survey of security Testing Techniques and
methods. from this we have identified problems in the current security testing techniques. This work
has to presents a roadmap for new testers on the cloud with the necessary information to start their
test.
This document proposes OpenFlow, which allows researchers to run experimental network protocols on campus networks. OpenFlow is based on Ethernet switches that have an internal flow table and standardized interface to add and remove flow entries. This would enable researchers to evaluate new ideas in realistic campus network traffic settings. The goal is to encourage networking vendors to add OpenFlow to their campus switches so researchers can experiment without disrupting the normal network operations.
This document discusses applied observational studies in cybersecurity research. It begins by defining applied research as introducing a specific change or subject to evaluate, compared to observational studies which observe a system without changes. It then discusses two types of applied observational studies: applied exploratory studies which introduce changes to understand performance under conditions, and applied descriptive studies which focus on a specific subject's real-world integration. The document provides an example of an applied exploratory stress test of a new communication application's encryption on battery life under heavy usage. It outlines defining the system, behavior to study, and a host-based testing methodology to evaluate battery consumption without affecting results.
This document proposes an approach to creating cyber resiliency using emerging technologies and network architectures. It identifies key technologies like deep packet inspection, application performance management, and control plane architectures that can be leveraged to build more resilient networks. The document then illustrates an example architecture and proposes validating cyber resiliency solutions using academic network infrastructure to test solutions on real networks at scale.
The PETRAS project aims to address privacy, ethics, trust, reliability, acceptability, and security issues for the Internet of Things. It will take an integrated social science and technical approach through collaborative projects across nine UK universities and other partners. The projects will be organized into streams and constellations focused on different sectors to provide insights and recommendations.
In this presentation I will show a set of important topics about Software Engineering Empirical Studies that can be useful for increasing quality on your thesis and monographs in general. You can read this presentation and to think about how to do a good experimentation by apply its objectives, validation methods, questions, answers expected, define metrics and measuring it.I will exhibit how the researchers selected the data for avoid case studies in a biased way using a GQM methodology to sort the study in a simpler view as well.
Design and implementation of secured scan based attacks on ic’s by using on c...eSAT Journals
Abstract Physical designing of cryptographic analysis is subjected to various physical attacks. It has been formerly evidenced that scan chains introduce for hardware testability open a back door to potential attacks. Scan based testing technique is mainly used for testing and it provides full observabilty and controllability of the inner nodes of the IC. Therefore, in this paper, we propose a scan-protection scheme that provides testing facilities both at assembly time and over the course of the circuit’s life. An efficient principle is used to scan-in both input vectors and expected responses to compare expected and actual responses inside the circuit. This method has no impact on the feature of the test or the model-based fault analysis when compared to traditional scan tests. It occupies less area on the chip and avoids the authentication test mechanism. Keywords- security, testability, Design-for-testability (DFT), scan-based attack, test pattern generator
Design and implementation of secured scan based attacks on ic’s by using on c...eSAT Publishing House
The document proposes a scan-protection scheme that provides testing facilities both during chip assembly and over the course of the circuit's life. It compares expected and actual test responses inside the circuit using an efficient principle to scan-in both input vectors and expected responses. This avoids needing to disconnect scan chains after manufacturing testing for security purposes. The proposed approach compares test responses within the chip at the vector level rather than providing the value of each individual scan bit. This ensures security while not relying on costly external test infrastructure. Simulation results show the proposed scheme occupies less area on the chip than existing approaches.
Similar to Current Developments in DETER Cybersecurity Testbed Technology (20)
Freshworks Rethinks NoSQL for Rapid Scaling & Cost-EfficiencyScyllaDB
Freshworks creates AI-boosted business software that helps employees work more efficiently and effectively. Managing data across multiple RDBMS and NoSQL databases was already a challenge at their current scale. To prepare for 10X growth, they knew it was time to rethink their database strategy. Learn how they architected a solution that would simplify scaling while keeping costs under control.
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...DanBrown980551
This LF Energy webinar took place June 20, 2024. It featured:
-Alex Thornton, LF Energy
-Hallie Cramer, Google
-Daniel Roesler, UtilityAPI
-Henry Richardson, WattTime
In response to the urgency and scale required to effectively address climate change, open source solutions offer significant potential for driving innovation and progress. Currently, there is a growing demand for standardization and interoperability in energy data and modeling. Open source standards and specifications within the energy sector can also alleviate challenges associated with data fragmentation, transparency, and accessibility. At the same time, it is crucial to consider privacy and security concerns throughout the development of open source platforms.
This webinar will delve into the motivations behind establishing LF Energy’s Carbon Data Specification Consortium. It will provide an overview of the draft specifications and the ongoing progress made by the respective working groups.
Three primary specifications will be discussed:
-Discovery and client registration, emphasizing transparent processes and secure and private access
-Customer data, centering around customer tariffs, bills, energy usage, and full consumption disclosure
-Power systems data, focusing on grid data, inclusive of transmission and distribution networks, generation, intergrid power flows, and market settlement data
Essentials of Automations: Exploring Attributes & Automation ParametersSafe Software
Building automations in FME Flow can save time, money, and help businesses scale by eliminating data silos and providing data to stakeholders in real-time. One essential component to orchestrating complex automations is the use of attributes & automation parameters (both formerly known as “keys”). In fact, it’s unlikely you’ll ever build an Automation without using these components, but what exactly are they?
Attributes & automation parameters enable the automation author to pass data values from one automation component to the next. During this webinar, our FME Flow Specialists will cover leveraging the three types of these output attributes & parameters in FME Flow: Event, Custom, and Automation. As a bonus, they’ll also be making use of the Split-Merge Block functionality.
You’ll leave this webinar with a better understanding of how to maximize the potential of automations by making use of attributes & automation parameters, with the ultimate goal of setting your enterprise integration workflows up on autopilot.
This talk will cover ScyllaDB Architecture from the cluster-level view and zoom in on data distribution and internal node architecture. In the process, we will learn the secret sauce used to get ScyllaDB's high availability and superior performance. We will also touch on the upcoming changes to ScyllaDB architecture, moving to strongly consistent metadata and tablets.
"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor IvaniukFwdays
At this talk we will discuss DDoS protection tools and best practices, discuss network architectures and what AWS has to offer. Also, we will look into one of the largest DDoS attacks on Ukrainian infrastructure that happened in February 2022. We'll see, what techniques helped to keep the web resources available for Ukrainians and how AWS improved DDoS protection for all customers based on Ukraine experience
"Choosing proper type of scaling", Olena SyrotaFwdays
Imagine an IoT processing system that is already quite mature and production-ready and for which client coverage is growing and scaling and performance aspects are life and death questions. The system has Redis, MongoDB, and stream processing based on ksqldb. In this talk, firstly, we will analyze scaling approaches and then select the proper ones for our system.
In the realm of cybersecurity, offensive security practices act as a critical shield. By simulating real-world attacks in a controlled environment, these techniques expose vulnerabilities before malicious actors can exploit them. This proactive approach allows manufacturers to identify and fix weaknesses, significantly enhancing system security.
This presentation delves into the development of a system designed to mimic Galileo's Open Service signal using software-defined radio (SDR) technology. We'll begin with a foundational overview of both Global Navigation Satellite Systems (GNSS) and the intricacies of digital signal processing.
The presentation culminates in a live demonstration. We'll showcase the manipulation of Galileo's Open Service pilot signal, simulating an attack on various software and hardware systems. This practical demonstration serves to highlight the potential consequences of unaddressed vulnerabilities, emphasizing the importance of offensive security practices in safeguarding critical infrastructure.
Northern Engraving | Nameplate Manufacturing Process - 2024Northern Engraving
Manufacturing custom quality metal nameplates and badges involves several standard operations. Processes include sheet prep, lithography, screening, coating, punch press and inspection. All decoration is completed in the flat sheet with adhesive and tooling operations following. The possibilities for creating unique durable nameplates are endless. How will you create your brand identity? We can help!
"$10 thousand per minute of downtime: architecture, queues, streaming and fin...Fwdays
Direct losses from downtime in 1 minute = $5-$10 thousand dollars. Reputation is priceless.
As part of the talk, we will consider the architectural strategies necessary for the development of highly loaded fintech solutions. We will focus on using queues and streaming to efficiently work and manage large amounts of data in real-time and to minimize latency.
We will focus special attention on the architectural patterns used in the design of the fintech system, microservices and event-driven architecture, which ensure scalability, fault tolerance, and consistency of the entire system.
inQuba Webinar Mastering Customer Journey Management with Dr Graham HillLizaNolte
HERE IS YOUR WEBINAR CONTENT! 'Mastering Customer Journey Management with Dr. Graham Hill'. We hope you find the webinar recording both insightful and enjoyable.
In this webinar, we explored essential aspects of Customer Journey Management and personalization. Here’s a summary of the key insights and topics discussed:
Key Takeaways:
Understanding the Customer Journey: Dr. Hill emphasized the importance of mapping and understanding the complete customer journey to identify touchpoints and opportunities for improvement.
Personalization Strategies: We discussed how to leverage data and insights to create personalized experiences that resonate with customers.
Technology Integration: Insights were shared on how inQuba’s advanced technology can streamline customer interactions and drive operational efficiency.
Fueling AI with Great Data with Airbyte WebinarZilliz
This talk will focus on how to collect data from a variety of sources, leveraging this data for RAG and other GenAI use cases, and finally charting your course to productionalization.
[OReilly Superstream] Occupy the Space: A grassroots guide to engineering (an...Jason Yip
The typical problem in product engineering is not bad strategy, so much as “no strategy”. This leads to confusion, lack of motivation, and incoherent action. The next time you look for a strategy and find an empty space, instead of waiting for it to be filled, I will show you how to fill it in yourself. If you’re wrong, it forces a correction. If you’re right, it helps create focus. I’ll share how I’ve approached this in the past, both what works and lessons for what didn’t work so well.
"Scaling RAG Applications to serve millions of users", Kevin GoedeckeFwdays
How we managed to grow and scale a RAG application from zero to thousands of users in 7 months. Lessons from technical challenges around managing high load for LLMs, RAGs and Vector databases.
Must Know Postgres Extension for DBA and Developer during MigrationMydbops
Mydbops Opensource Database Meetup 16
Topic: Must-Know PostgreSQL Extensions for Developers and DBAs During Migration
Speaker: Deepak Mahto, Founder of DataCloudGaze Consulting
Date & Time: 8th June | 10 AM - 1 PM IST
Venue: Bangalore International Centre, Bangalore
Abstract: Discover how PostgreSQL extensions can be your secret weapon! This talk explores how key extensions enhance database capabilities and streamline the migration process for users moving from other relational databases like Oracle.
Key Takeaways:
* Learn about crucial extensions like oracle_fdw, pgtt, and pg_audit that ease migration complexities.
* Gain valuable strategies for implementing these extensions in PostgreSQL to achieve license freedom.
* Discover how these key extensions can empower both developers and DBAs during the migration process.
* Don't miss this chance to gain practical knowledge from an industry expert and stay updated on the latest open-source database trends.
Mydbops Managed Services specializes in taking the pain out of database management while optimizing performance. Since 2015, we have been providing top-notch support and assistance for the top three open-source databases: MySQL, MongoDB, and PostgreSQL.
Our team offers a wide range of services, including assistance, support, consulting, 24/7 operations, and expertise in all relevant technologies. We help organizations improve their database's performance, scalability, efficiency, and availability.
Contact us: info@mydbops.com
Visit: https://www.mydbops.com/
Follow us on LinkedIn: https://in.linkedin.com/company/mydbops
For more details and updates, please follow up the below links.
Meetup Page : https://www.meetup.com/mydbops-databa...
Twitter: https://twitter.com/mydbopsofficial
Blogs: https://www.mydbops.com/blog/
Facebook(Meta): https://www.facebook.com/mydbops/
Must Know Postgres Extension for DBA and Developer during Migration
Current Developments in DETER Cybersecurity Testbed Technology
1. Current Developments in DETER Cybersecurity Testbed Technology
Terry Benzel1*, Bob Braden*, Ted Faber*, Jelena Mirkovic*,
Steve Schwab†, Karen Sollins§, and John Wroclawski*
*
USC Information Sciences Institute, §MIT CSAIL, and †Sparta, Inc.
{tbenzel, braden, faber, mirkovic, jtw}@isi.edu, sollins@csail.mit.edu, schwab@sparta.com
Abstract emergent effects may need to be quite large and
complex to be accurate or indicative.
From its inception in 2004, the DETER testbed
facility has provided effective, dedicated experimental • Multi-party nature. Most interesting cybersecurity
resources and expertise to a broad range of academic, experiments involve more than one logical or
industrial and government researchers. Now, building physical party, due to the adversarial nature of the
on knowledge gained, the DETER developers and problem as well as the distributed, decentralized
community are moving beyond the classic “testbed” nature of the networked systems environment.
model and towards the creation and deployment of • Risk. Cybersecurity experiments by their
fundamentally transformational cybersecurity research fundamental nature may involve significant risk if
methodologies. This paper discusses underlying not properly contained and controlled. At the same
rationale, together with initial design and time, these experiments may well require some
implementation, of key technical concepts that drive degree of interaction with the larger world to be
these transformations. useful.
1. Introduction Meeting these challenges requires both
transformational advance in capability and
The DETER cybersecurity testbed [3] is a dedicated transformational advance in usability of the underlying
network testbed facility customized for cybersecurity research infrastructure. A truly large experiment cannot
research. Initally deployed in 2004, DETER’s first be carried out unless the researcher has access to a
accomplishment was to provide effective, truly large facility, but is also unlikely to be successful
professionally managed research infrastructure and a if the researcher has to create a twenty thousand node
shared user community for leading academic and experiment description by hand. A potentially risky
industrial cybersecurity researchers. With this first experiment is likely to take place only if the
objective largely met, and building on knowledge experimental platform can control the risk and all
gained, the DETER team now aims to identify, concerned can be sure it is doing so. A multi-party
understand, and enable new, fundamentally experiment will best be supported if the experiment
transformative, rigorous and scientific methodologies control framework explicitly accommodates multiple
for cybersecurity research and development. This paper parties and their concerns.
describes key technical contributions of our current and
ongoing work in support of these goals. This paper describes a suite of significant advances to
today’s state of the testbed art, which taken together
Effective cybersecurity experiments are challenging to move the concept of “testbed” from simple hardware
today’s network testbeds for a number of reasons. infrastructure to powerful and effective user-oriented
Among these are research support facility. Central to the paper is our
work in three synergistic areas:
• Scale. Experiments that involve complicated
composite behaviors, rare event detection or First, our unique model for risky experiment
management enables researchers to carry out
1
Authors’ names in alphabetical order.
This material is based upon work supported by the Department of Homeland Security and the Space and Naval Warfare Systems Center, San
Diego, under contract No. N66001-07-C-2001, and by the National Science Foundation under Grant No. CNS-0751027. Any opinions, findings
and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the
Department of Homeland Security, the Space and Naval Warfare Systems Center, San Diego, or the National Science Foundation.
1
2. experiments that interact with their larger environment malware code, operating a real botnet, or creating other
while retaining both control and safety. The key benefit highly disruptive network conditions. Realistic
of this model is that both experimenter and testbed replication of such attacks is necessary to thoroughly
operator can proceed with assurance in carrying out a test detection and defense mechanisms.
wide and interesting range of heretofore unsupportable
The common response to this risk is to implement
experiments.
strict isolation capabilities within a testbed, in an
Second, our model and structure for experiment health attempt to ensure that no actual damage will be caused
monitoring ensures that the underlying conditions and by an experiment. Depending on the testbed,
invariants required for an experiment to be valid do in containment mechanisms may range from complete
fact hold. The key benefit of this structure is that disconnection from the outside world to allowing
experiments receive active support from the facility to narrowly-controlled console access, and include disk
ensure that they are proceeding as the designer scrubbing before and after each experiment.
intended.
But such containment itself is highly limiting. A fully
Third, our model and mechanism for dynamic contained experiment is hard to observe, hard to
federation allows different testbed facilities to come establish, and hard to control, because it must be
together on demand to support large-scale, complex, completely isolated from its environment. Similarly,
heterogeneous, multi-party experiments. The key full containment is hard to create with any assurance.
benefit of this work is that experimenters ranging from Sneak paths, equipment failures, and design mistakes
lone individuals to large institutions can bring together can render containment ineffective in myriad
rich coalitions of otherwise unavailable resources and unexpected ways.
unconnected communities, all within our larger context
Most importantly, full containment is not very useful.
of complex, yet safely and reliably executed, risky
An interesting and powerful class of experiments are
experiments.
those that can interact with the larger environment (i.e.,
When considered together, these capabilities allow the touch the Internet), but only in carefully controlled and
cybersecurity researcher to carry out experiments that well understood ways. Thus, our work aims to move
are, simultaneously, more useful, more reliable, and from risky experiment containment to risky experiment
more complex, scalable, and realistic than anything management as a strategy.
possible in today’s testbed environment.
To integrate these capabilities into a coherent and 2.1 Risky Experiment Management: Concepts
easily accessible facility, we develop new abstractions Our approach to risky experiment management is
and functions for our experiment control toolkit, based on a very simple line of reasoning:
known as SEER [1]. With these new capabilities in
place SEER will allow users of widely varying • If the behavior of an experiment is completely
sophistication to easily and effectively make use of the unconstrained, the behavior of the host testbed
next-generation experimental facilities we describe, for must be completely constraining, because it can
purposes ranging from structured undergraduate assume nothing about the experiment.
education to research experiments with order-of- • But, if the behavior of the experiment is
magnitude increases in complexity over those possible constrained in some particular and well-chosen
today. way or ways, the behavior of the testbed can be
Our work is embodied in extensions to the DETER less constraining, because the combination of
testbed, a large Emulab[2]-derived facility sited at ISI experiment and testbed constraints together can
and UC Berkeley and targeted to support cyber- provide the required overall assurance of safe
security research. DETER’s existing, successful behavior.
capabilities and community, together with our long We call constraints on experiment behavior “T1
involvement in its design, operation, and ongoing constraints”, while the corresponding constraints on
development, provide crucial starting points and create testbed behavior are called “T2 constraints”.
unique insights for the work described here.
The composition of T1 and T2 constraints determines
the overall safety goal for the testbed. This testbed
2. Risky Experiment Management safety goal is a fixed property, defined by the
Experimental cybersecurity research is often inherently operational and administrative parameters of a
risky. An experiment may involve releasing live particular testbed. While the safety goals of each
2
3. testbed will have a common flavor of “no harm to testbed. Our approach to auditing is to use the
other users, the testbed or the Internet,” each testbed Experiment Health Management infrastructure
may define notions of harm differently. Unacceptable described in Section 3 to implement monitoring tools
behaviors may depend on the testbed’s mission and the that verify each constraint throughout the experiment’s
policies at the hosting institutions. Testbed goals must lifetime. When experiment constraints are violated, the
thus be explicitly defined in detail. Experiment Health Management infrastructure will
take corrective actions that may range from emailing
Three points should be noted. First, the separate
the user and testbed operators to terminating the
expression of T1 and T2 constraints in this model
experiment.
represents a separation of concerns. This separation
allows experiment and testbed constraints to be framed
and expressed independently and in terms directly 2.2 Framework
meaningful to their audiences, experimenters and Our current objectives are to 1) develop a set of T1/T2
testbed designers, respectively. Explicit experiment constraint sets targeting both practical usefulness to the
(T1) constraints will allow an experimenter to reason community and advancement of our understanding of
about which constraints are acceptable without the T1/T2 risk management model; 2) develop and
affecting the validity of the experiment. Similarly, a deploy necessary mechanisms and tools to implement
testbed designer can reason about how to offer this risky experiment management model in the
different T2 constraint environments as well-known, DETER facility; and 3) evaluate the success of our
robust, and documented services, rather than having to work through interactions with current DETER users
separately determine an operating procedure for each and others in the research and education community.
new experiment.
To accomplish these objectives we are developing a
Second, we note that the semantics of T1 and T2 risky experiment management framework. Our
constraint composition to obtain a desired overall framework addresses the following top-level concerns:
safety goal is interesting and rich. As an oversimplified the experimenter’s research goals, testbed safety goals,
thought example, one might imagine a worm that can and experimenter privacy goals. We identify useful
only propagate by first contacting a “propagation points in each of these spaces, and develop candidate
service” (T1 constraint), composed with a testbed sets of experiment (T1) and testbed (T2) constraints
firewall (T2 constraint) that allows access to this that together provide these useful behaviors. Presently,
service only from within the testbed. The result is to we have deployed implementations of a small number
limit the worm’s propagation to the defined bounds of of selected constraint sets to our early-adopter users.
the experiment.
Current testbeds assume one liberal set of user privacy
Finally, T1 constraints might be enforced by (1) goals, but this is not realistic since, for example,
explicit modification of malware to constrain its commercial users may have very different privacy
behavior, (2) implicit constraints using encapsulation, expectations than academic users. Some monitoring of
or (3) simply asserting a constrained behavior that the user actions and traffic by the testbed will be necessary
network can verify. for several purposes: (1) to support health management
Constraints are associated with each experiment within described in Section 3, (2) to ensure that user
a project and are continuously active. Because a given constraints are implemented correctly, and (3) to
experimental topology can be used for multiple reduce testbed liability in case of malicious incidents.
different “runs” [5], ideally constraints would be To successfully support risky but controlled
generated and applied for each run. This however experiments, our framework must capture user needs.
would increase the burden for users whose runs exhibit We have developed an initial experiment
the same risky behavior, and it is also challenging categorization taxonomy based on the type of risky
because we lack means to detect different “runs” from behaviors necessary to an experiment, such as self-
within the testbed. Instead, we can associate constraints propagating malware, high-volume traffic, etc. Our
with experiments, but will provide mechanisms for initial taxonomy defines a small list of categories,
users to modify these constraints while the experiment based on current experimental uses of DETER. We
is active. expect this list to grow as work progresses, based on
The T1/T2 concept is only useful if we can ensure that user input.
the selected T1 and T2 constraints are met. We must Users are presently required to specify experiment
require that all experiment constraints either be shown categorization, privacy goals and appropriate
to be “correct by construction” or be auditable by the experiment constraints at the time of experiment
3
4. creation. Testbed constraints are generated based both To meet the needs of DETER’s current research
on the specification input by the user, and the testbed community, we initially address the following risks
safety requirements defined once by the testbed from experiments: (1) malware traffic may infect
operators. These constraints are put into action by the testbed hardware infrastructure needed for correct
testbed and our health management infrastructure operation, (2) experimental traffic of any sort may
ensures that they are continuously enforced. overload control plane and shared hardware, (3)
disruptive actions may affect control plane and shared
2.3 Implementation hardware (4) in experiments with the outside
connectivity, experimental traffic sent to remote
Our ultimate goal is to develop a fine-grain model for machines may infect, overload or disrupt these
T1 and T2 constraints and a formal structure to reason machines and remote networks, (5) in experiments
about their composition. In current work we adopt a with the outside connectivity, experimental traffic may
simpler approach, as a first practical step towards provoke retribution toward the testbed (e.g., from the
deploying a useful risky experiment management Storm Network [44]) or create liability problems to the
capability and as an assessment of the value of the testbed, (6) malware may stay resident on machines
concept. We are developing a small selection of after they are reclaimed by the testbed and may affect
matching T1/T2 constraint sets, where a) the T1 future experiments by other users. Our framework is
constraints are chosen to be appropriate and useful for evolvable so new threats will be incorporated as
a particular class of experiment; b) the T2 constraints research objectives dictate; we expect this list of risks
are chosen to be implementable and verifiable in a to grow as we proceed with our work.
particular testbed environment, and c) the composition
of the chosen T1 and T2 constraints produces an The above risks are contained via experiment and
acceptable risk management result. We develop a testbed constraints. Our initial list of experiment (T1)
mechanism to allow researcher and testbed operator to constraints includes: (1) users limit scanning behavior
agree on particular sets, implement and enforce both of self-propagating malware, (2) users limit targets of
experiment and testbed constraints, and thus obtain the disruptive actions, such as denial-of-service, to
level of risk management required for the particular addresses within experimental network, (3) users limit
testbed environment. their malware choice to well-known malware
contained in the DETER-supplied library, (4) users
We are developing a domain-specific language limit experimental connectivity with the outside world
language called REALM for specification and to a set of machines under their control, and to specific
manipulation of T1/T2 constraints as well as protocols, (5) users limit the rate of traffic in their
operational safety objectives. Although it will be experiments, (6) users limit experimental traffic to the
possible for users to write REALM specifications experimental network, (7) users implement signatures
directly, our intent is that REALM be the output and or self-terminating behavior in malware they plan to
interchange language that a variety of tools use to use. Our current prototype of risky experiment
capture and manipulate constraint information. management supports definition of constraints 1-6.
REALM will be integrated with the SEER toolkit
described in Section 5, including guided dialogs for Our initial list of testbed (T2) constraints includes: (1)
users. The current version is also integrated with the isolation of experiments on the control plane using a
DETER facility’s “Create an Experiment” Web page. separate virtual LAN for each experiment, (2)
User input is recorded through these interfaces and experimental traffic filtering and rate-limiting on the
translated into REALM specifications associated with control plane using hardware-specific filters at
the experiment. switches to prevent disruption and overload of shared
infrastructure, (3) allowing outside connectivity only
We regard each experiment as potentially risky until via specialized nodes (“tunnel nodes”) that connect the
proven otherwise. We initially address three types of experimental network to the Internet, (4) controlling
potentially risky behavior: (1) running malware, (2) experimental traffic contents and rate with the outside
creating disruptive behavior, and (3) requiring Internet via firewall rules and the Bro intrusion
connectivity with the outside Internet. The first two detection system [50] for deep packet inspection, both
behaviors are intentionally risky, whereas the third installed on all paths to the Internet, (5) recording
behavior may be risky by accident, if experimental traffic on tunnel nodes, recording of login activity on
traffic with the outside is misconfigured and overloads experimental nodes, and association of traffic, logged
resources, provokes an external attack on the testbed or users, and experiment names for potential liability
creates liability. reasons. Constraints 1 and 3 are implemented in our
4
5. current prototype system, with others to be added in experiments, a security constraint being violated, and
the near future. so forth. The initial DETER system, as with many
similar testbed environments [2][7][12], provided little
3. Experiment Health Management or no support for either determining whether an
experiment is behaving as expected (its current health)
Experiment health management addresses two broad or for diagnosing failures and improving the situation
and increasingly important needs within experimental (improving its health). Our experiment health
cybersecurity research. First is the need to support management system addresses this missing function.
order of magnitude greater complexity in the creation
of realistic cybersecurity experiments. Second is the The experiment health problem is characterized by
need to bring greater rigor and scientific discipline to three key properties. First, in contrast with the
the experimental research paradigm. We address these “network management” problem of maintaining
needs through a research facility subsystem based on functional behavior in an operating network, our
two observations: domain is the very different problem of supporting
security-related experimentation on a networking
• The validity, accuracy, and usefulness of an testbed. The consequence is that potential range of
experiment depend critically on some set of expected behaviors is very broad must be user-
invariants or expectations identified by the supplied, because many cybersecurity experiments
experiment’s creator being met. require and intentionally create worst-case conditions
• Any given experiment will have a number of other of overload, resource denial, host penetration and
behaviors that are not invariants, and cannot be unreliability.
predicted by researchers, since experiments are Second, expectations of behavior will range from
done to study unknown effects. extremely low level and concrete “invariants” valuable
The rigor and scientific validity of an experiment is for educational exercises (such as “node A is up”) to
greatly increased when the expectations and invariants composite, complex, perhaps statistical, and much
on which its validity depends are clearly understood by more abstract expectations (such as “service has been
the researcher and by others who wish to utilize or denied”). An ideal experiment health system will
build on the results of the experiment. A system that handle this wide range of invariants.
makes these expectations explicit and ensures that they Finally, usability is critical. It must be possible for
are met during an experiment will contribute greatly to users to capture desired invariants and health
the rigor of future experimental research. enforcement actions with minimal overhead and
This problem is complicated when experimental maximum clarity if the system is to meet its objectives.
complexity is increased, because the maintenance of Our goal is to support, with these properties,
experimental invariants and expectations becomes experiment health maintenance in testbeds such as
exponentially more difficult. Managing the complexity DETER, and, by extension, to the federation of such
of experiments that involve more than a handful of testbeds as described in Section 4. Our experiment
elements demands system support to assist researchers health system includes five elements, each with its own
in understanding, documenting, and maintaining the research and implementation challenges. We outline
health of their experiments – the validity of the the elements here and expand on each in the following
experiment’s assumptions, expectations, and sections. The system includes functions to support:
invariants.
• Expectation capture. Concerns are the sources and
The challenge of experiment health monitoring and expression of data about experiment expectations.
management is to ensure that the underlying conditions
and invariants required for an experiment to be valid • Data collection and monitoring. Concerns are
are being met by the facility, and to aid the researcher kinds and sources of data, reasons that the
in detecting and modifying errors in experiment information may be incomplete, and how to
design. Here “health” refers both to the behavior provide controlled sharing between these tools and
desired by a researcher of his experiment and that health evaluators .
desired of the underlying testbed. Reasons for reduced • Health evaluators. This includes observation of
health include, but are not limited to, mistakes by the collected data and its comparison against an
experimenter, failures or faults of testbed resources, expectation to evaluate if the expectation is being
misunderstandings the researcher has about the testbed, met.
unintended interactions between simultaneous
5
6. • Enforcement or repair. In its most basic form, that are unimportant or should change from experiment
enforcement may simply involve repair or to experiment.
replacement, but because expectations may be
Our initial implementation requires explicit expression
quite abstract, there may be several diagnostic
of expectations by experimenters and testbed system
steps involved in the process, and a selection of
managers, with minor automation from the testbed. We
repair or enforcement options.
include design hooks for the system to use additional
• Support for sharing of information and expectation expectation capture methods in the future. We
data. This problem has two aspects: an information implement an expectation capture language that
plane to manage the availability and sharing of specifies a set of conditions under which the
operating information between experiments and expectation will be evaluated, a subject for the
the underlying testbed, and a library for evaluation, a health evaluator, and a set of responses to
cataloguing and accessing expectation templates, the evaluation. Together these items capture an
resource definitions, data collection tools, current expectation and its enforcement and response methods.
performance tools and health evaluators.
A simple example is to expect a server to be running,
verify this by sending a ping once a minute and reboot
3.1. Expectations the server if the ping fails. In a more sophisticated
In operating networks, network management has the example, the expectation may be of a certain level of
goal of maintaining connectivity, distributing load, traffic among a set of gossiping nodes. The traffic level
setting up network configuration, and in general might be checked every minute and if it is below a
supporting the network mission of delivering traffic threshold, each node might be told to increment by one
effectively between end nodes. This common mission the number of nodes it contacts during a gossiping
is well understood and agreed upon by all participants. episode. A security expectation might lead to allowing
In shared testbeds, management needs to achieve a a traffic flow from the Internet into an experiment
more complex definition of a desired behavior. For a (response), if a particular experiment is running, no
particular user, desired behavior may be to deny other experiments are running, and the traffic is all
service or disrupt connectivity in the experimental addressed to a particular port (conditions).
network, to test a new worm or to maintain some long- We identify a long list of requirements for
lived service running reliably. expressiveness in invariant capture, including but not
Users also have goals related to research privacy and limited to: time, location, service quality evaluation;
the usability they expect from the testbed, and these verification of particular actions, continuous states,
goals differ from person to person. From the testbed privacy; higher-level concepts such as restriction on
operator’s perspective, the desired behavior may be to code propagation; dependencies among expectations,
provide reliable service to users, to control risky coupling of expectations to actions; and composition
experiments, to federate with remote testbeds and to into higher level expectations. To create the capture
protect the privacy of its users. language, we build on past work such as Ponder [30]
and Tcl expect [28], with a domain-specific user-
Because desired behaviors differ widely across friendly and higher-level syntax, for easier use.
different experiments and depend on the nature of
experimentation and testbed maintenance, it is We briefly discuss key issues with respect to the
impossible to identify universally appropriate expectation subjects – things about which an
behaviors. Instead we require an explicit expression of expectation may be expressed. These subjects range
individual experiment expectations. The two key issues from simple base level instances, such as a link or
we address are sources of expectations and the node, to more complex elements such as an entire
language for codifying them. Gnutella-like P2P system. We differentiate between the
type of the subject (e.g., link), and the instantiation of
Expectations may be identified in a variety of ways. it (e.g., link between A and B). The choice of health
First, they could come directly from the experimenter. evaluation tools and repair functions then depends both
This could be explicit, or inferred from the researcher's on the type and the instantiation of a given expectation,
behavior ("if he keeps fixing the DNS system when it and may lead to decomposition of that expectation
breaks, it must mean the DNS system should be evaluation into more primitive evaluations. To capture
working"). Ideally a system could simply learn these nuances we provide parameterized templates for
invariants by looking at a working experiment, but the many common expectations in our library, for users to
problem lies in recognizing the non-invariants - things instantiate.
6
7. 3.2. Data collection tools In an alternate approach, we define the health
evaluation of a complex subject as the composition of
To implement health evaluation the system provides the health evaluations of simpler components. In this
monitoring and data collection about what is happening case, the system evaluates the behavior and health of
in the testbed as a whole as well as in each particular each simpler component and then composes the results
experiment. There are three key sources of such data: into a single health evaluation. Because each approach
(1) static data such as node allocation to a particular is preferable in different circumstances, we define both
experiment, etc. (2) data collected routinely in all approaches and allow the user to reason about
experiments and by the facility itself, such as packet tradeoffs.
tracing, node liveness, etc., and (3) explicit data
collection requested by an experimenter or the testbed
3.4. Enforcement and repair
management, in context of a specific expectation’s
evaluation. Enforcement and repair are two sides of the same coin.
Enforcement provides some level of guarantee that an
There are several challenges to data collection. First,
expectation continues to be met. Thus, for example, in
because of scale and system unreliability, available
order to enforce that any reproducing malware does not
data may be incomplete. Second, the desired
overload resources, the testbed could rate limit the
information may not be directly measurable, but must
traffic from experimental nodes. Enforcement is likely
be inferred from other measurements that can be
to require frequent periodic evaluation of expectations.
gathered directly. Finally, in light of security
In contrast, repair uses similar mechanisms but aims to
expectations that relate to privacy, some information
correct a detected failure. Since failures are not very
may not be accessible to a particular experimenter or
frequent, evaluation of expectations that involve repair
portion of an experiment. Either an experiment or the
actions may occur on demand or periodically but
testbed system may withhold information from the
infrequently.
other. As an initial step towards meeting these
challenges, we provide a base set of data collection A third alternative is to detect an unhealthy situation,
tools in our library, which will be extensible by but take no action to address it other than notifying the
researchers. user. This may be necessary in cases when there is no
specified repair action, or the repair itself has failed.
3.3. Health evaluation For example if an experiment expects 50 nodes, is
assigned the only 50 nodes available and one fails, the
The job of health evaluation is to determine whether an only option is to halt the experiment. On the other
expectation – in our framing, the static or dynamic hand, if some nodes were optional and some critical,
behavior of a expectation’s subject – meets specified the experiment might continue as long as a critical
health criteria. There are two aspects to evaluating the node did not fail.
health of a subject. The first is to select the particular
behaviors of the subject, such as link bandwidth, jitter We allow the user to specify each of these cases, and
or loss rate, that are to be evaluated. This will in turn the desired enforcement or repair action, using our
determine one or more tools for evaluating the expectation language. We provide tools for common
behavior. The second is to determine the health of that enforcement and repair operations in our library for
subject by comparing observed and expected behavior. easy use. Additional language constructs support
As a simple example, the experiment health may sophisticated users that wish to provide enforcement or
require either a high or a low loss rate, depending on repair actions that are specialized to the nature of their
the user’s desires. experiment.
In the case of a more complex subject, with a rich set
3.5. Sharing
of possible behaviors and the potential for a complex
user definition of health, we break the problem down To monitor and enforce expectations, a health system
with a composite evaluation. One approach is to define must depend on significant amounts of information
the more complex behavior as a composition of a set of about experiment performance. Because DETER and
simpler behaviors. Then when asked to evaluate the similar testbeds utilize reusable and shared resources,
health of the subject, the target behavior is computed this information must be collected and accessible from
as a composition of those simpler behaviors and the several contexts simultaneously. Conversely, the same
result is evaluated for its health. In this approach the information may be valuable to more than one
composite behavior is completely synthesized and then monitoring tool either simultaneously or at different
a single health evaluation is performed.
7
8. times. Each of these situations leads to information characteristics of the particular experiment to be
sharing. federated, and thus require domain-specific knowledge.
Other functions are common across experiments, and
For example, it may be important to collect packet
can be modularized and generalized. The DFA
traces in an experiment for a variety of different uses.
accommodates this by including 1) elements and
Monitoring tools used on behalf of the experimenter
interfaces to support common functions; 2) system
may depend on these traces to verify correct
interfaces and framework for a “plug-in” extensible
experiment behavior, while the underlying testbed
implementation of domain-specific functions; and 3)
system may simultaneously use such traffic
an ontology and language to express information used
information to determine the health of the complete set
to drive the federation process. Figure 1 gives an
of resources it is managing. At the same time, these
overview of the architecture. Key elements are
traffic traces can provide an audit trail if an experiment
described in the following text.
creates a security risk for the testbed, e.g., by running a
worm that escapes into the Internet. Other contexts for
reuse of the same information are possible.
Thus information should be collected once and
managed effectively to allow for multiple uses. This
requires a common information substrate or
information plane, with well-defined access rules and
contexts. Information collection and access must be
designed to reflect the security and privacy
expectations that are critical for the whole experiment
health management. In this area our development effort
draws on and is synergistic with other efforts with this
specific focus, particularly the Knowledge Plane
activity described in [18].
4.1. Sub-Experiment Decomposition
4. Dynamic Federation Intelligent decomposition of a single large experiment
into per-testbed sub-experiments must of necessity
Federation is the task of creating, on demand, a multi-
consider two factors: heterogeneity within the
testbed structure to support a single large experiment.
experiment in one or more dimensions, and testbed
The goal of federation is to subdivide and embed a
capabilities along one or more axes. Examples of
single experiment across multiple testbeds, in a way
experiment heterogeneity that may influence
that meets the objectives, requirements and constraints
decomposition include
of both the researcher and the testbed operators.
Reasons to federate experiments include scale and • Topology and bandwidth requirements – e.g.
realism, access to heterogeneous testbed capabilities, embedding densely connected regions of the
integration of multiple research communities, and experiment within a single testbed.
information hiding. Of particular interest for large
cybersecurity experiments is simultaneously creating • Specific hardware or software requirements within
federated environments while addressing risky some portion of the experiment graph.
experiment management and health management goals • Security constraints – in our model, specific T1
based on the mechanisms of Sections 2 and 3. constraints that can be offered over some portion
The DETER federation architecture (DFA) of an experiment, and/or specific T2 constraints
implements federation over Emulab-style testbeds. The required from the testbed hosting some portion of
architecture breaks the federation task into three steps: the experiment.
1) decomposing the experiment to be federated into • Information hiding – particularly in a composite
sub-experiments to be assigned to individual testbeds; experiment, such as a red-team/blue-team
2) embedding the sub-experiments into individual scenario.
testbeds and building the necessary connections
between testbeds, and 3) operating and supporting the Because the factors that should influence the
federated experiment. decomposition of a particular experiment are known
only to the experimenter, decomposition is a domain
The architecture recognizes that within the three tasks specific function. Thus, the DFA provides for an
some functions are dependent on the requirements and extensible set of decompositors, together with a well-
8
9. defined environment for their implementation. DFA outline the structure and scope of the proposed
provides common information to decompositors using ontology.
the ontology described in Section 4.3. Inputs or
The form of expression is attribute/value assertions
knowledge specific to a single decompositor may be
potentially attested to by principals or outsiders: (X
provided by a custom interface, or simply programmed
asserts that Y is/has Z). Some example attributes,
into the decompositor’s implementation. As a
values, and meanings are shown in the table.
particularly simple case, the decomposition function
can be performed without involvement of higher level Attribute Value Meaning
software by a human writing directly in the CEDL
(keyid,
language described below. User: PGP_Key User PGP ID
server)
4.2. Canonical Experiment Description Testbed: X.509, Acceptable user
Language and Federator Access_Policy Kerberos authentications
Canonical experiment description language (CEDL) is Sub_Experiment: T1 constraint set
the output language for all decompositors in the DFA. T1_Imposed String exp. meets
It can be thought of as an “assembly language” for Multiple attribute assertions can be assembled into
federated experiments – a common, low-level format descriptions or requests. The operators are grouping,
that many different tools can generate. CEDL is an conjunction, and inclusive and exclusive disjunction.
extension of Emulab’s current NS2-based experiment
(DETER asserts that its access policy is X.509
description language. CEDL describes an experiment
certificate AND
as an interconnected topology of nodes, together with a
number of annotations that guide the embedding of an (DETER asserts that it has 100 nodes AND DETER
experiment into its federation of testbeds. Annotations asserts that it has 1Gb/s cross-connect) XOR
include such information as the target testbed for (DETER asserts that it has 1000 nodes AND DETER
placing a particular node, and whether a node is critical asserts that it has 1000Mb/s cross-connect))
to the experiment or can be ignored if it cannot be The ontology’s domain of discourse is testbeds,
embedded successfully. experimenters, resources, sub-experiments, and
An experiment’s CEDL description forms the input to attesters. Examples of representable concepts within
the federator. The federator is responsible for the ontology are given below, for flavor. Of particular
embedding the sub-experiments within each federated interest is the ontology’s ability and requirement to
testbed, after creating the additional hidden nodes and represent our T1/T2 risky experiment management
links necessary to interconnect regions of the constraints. It follows that the ontology will evolve in
experiment. This task is essentially mechanical, but this respect as our work in that area proceeds.
requires parsing and understanding the CEDL The simple semantic model of this ontology is intended
description sufficiently to forward experiment to allow the use of a variety of existing representation
information, security configuration, and user and constraint matching tools to facilitate reasoning
credentials to testbeds, establish the shared experiment about the federation problem. Our research lies in what
support environment of Section 4.4, handle error must be said and how to interpret it, not in the form of
conditions that may arise, and similar functions. the ontology.
4.3. Federation Resource Description 4.4. Scaling the Experiment Support
Ontology Environment
Elements of the DETER federation architecture are Centralized testbeds such as Emulab have historically
bound together by an ontology of information needed provided a rich experiment support environment of
to carry out the federation task. This ontology, and its functions intended to simplify the job of the researcher
expression in a concrete format, allow the different by providing useful building-block capabilities.
principals to communicate requirements, needs, and Emulab’s experiment support environment includes a
constraints to each other. Statements and requests shared filesystem, an event system, a simple error
expressed in this ontology are communicated between management system, and several related functions.
testbeds, the DFA federator, and decompositors acting When moving to a decentralized, federated
on behalf of potential users, to implement environment, the scalability and appropriateness of
decomposition and embedding functions. We briefly
9
10. these functions must be revisited. Several outcomes are recognize that without significant advances in this
possible. regard, the increased experiment complexity enabled
by our other advances could potentially reduce testbed
The function may be fully scalable, perhaps with a new
usability. For this reason, our goal is to leapfrog
implementation, as it is commonly used. The function
existing usability models, creating new experiment
may be scalable as defined, but not as commonly used,
creation and control interfaces that directly address this
leading to the need for careful re-thinking. Or, the
increased complexity. Further, it is useful to address
function may not be scalable at all, leading to its
separately the needs of sophisticated experimenters,
removal from the federated environment, and possible
who frequently must operate at low level and shape
replacement with a more scalable alternative
their own tools, and for more casual users, who need
capability.
simple access to complex function.
Different Emulab support functions exhibit each of
SEER is structured as a GUI that communicates with a
these properties. As examples,
master controller agent (CA) for each experiment. In
• The use of a shared filesystem is reasonably turn, the controller agent communicates with and
scalable in concept, if not always in controls a SEER agent running on each experimental
implementation. A number of researchers have node. The GUI and CA provide the experimenter with
proposed approaches to highly scalable distributed access to SEER capabilities through an XML-RPC
filesystems that could be adopted. interface, which allows for interaction with the
controller by other programs. For example, even now
• The Emulab event system is scalable in concept, an experimenter can interact with the controller
because it does not define either tight real-time
through a command-line interface. The controller agent
semantics or assured ordering semantics.
contains logic in the form of execution scripts to
However, in practice it exhibits both of these
support potential experimenter requests, as well as the
properties in a local testbed, and they have come
event state necessary to monitor and manage those
to be relied on by some experimenters. In a
requests. The controller agent communicates directly
federated environment, two separate mechanisms
with the local node agents with requests or commands
may be appropriate: one that provides tight real-
for local operations and information. This structure
time constraints on single event delivery, to
provides a framework to support the major functional
coordinate the actions of different elements across
developments described in this paper. We briefly
a highly scaled experiment, and one that provides consider each of these in the context of the SEER agent
explicit ordering semantics [42][43] to support system.
complex dependency graphs in highly structured
experiments. As described in Section 4, federation of testbeds in
support of large experiments is achieved by
In general, the design of an experiment support
decomposition of the experiment into partitions, each
environment for large federated facilities must
of which is run on one of the federants under its local
carefully and explicitly consider tradeoffs between
control. We reflect that same decomposition in the
scalability, robustness, implementability, and
SEER experiment control, by splitting and distributed
usefulness to the experimenter. In our implementation
the responsibilities of the controller. Under federation,
of DFA within DETER, each of the existing Emulab
we extend SEER to provide a single experiment
services is analyzed for suitability to the federated
controller, a set of federant controllers, and the
environment, and updated or replaced if necessary.
requisite node agent for each node. In this case, the
experiment controller provides high-level oversight
5. SEER as Integration Platform and and partitioning of the SEER activities, and is capable
Usability Framework of partitioning inferior responsibilities to the federant
controllers, which in turn interact with the local node
The DETER testbed’s SEER system [1] is an
agents. The experiment controller operates using an
extensible framework for experiment support and
experiment-wide event stream, while the individual
control. We rely on SEER to provide broad
federant controllers each have their own, partitioned,
infrastructural support for our new capabilities of
event state and sequence of events. Notice that this is
experiment health maintenance, risky experiment
an example of a situation in which the invoker of an
management, and federation.2 It is important to
2 APIs. It is both possible and expected that additional higher level
We note that it is not necessary to use SEER to access these integration tools will be developed in the future.
capabilities; each is also accessible through new low-level system
10
11. XML-RPC on a (federant) controller will be another perspective these do not provide the ability to control
controller, not the GUI – a new capability that is or limit access to information based on security and
naturally supported by the modular SEER architecture. privacy policies. The second is more specialized
With further extensions expected in the longer run, we information planes, including iPlane [38], which
plan for other situations in which controllers will be provides path behaviors for managing peer-to-peer
invoked by something other than the GUI. overlays, the Lord of the Links project [39] which
provides comprehensive network topology
In the case of risky experiment management the
information, and the 4D proposal [40] for route
challenge is slightly different, but is equally
computation and distribution. In contrast we propose a
accommodated with an extension to the underlying
general-purpose information plane for sharing, but one
agent system. The problem for risky experiments is
that permits control or limitation of access to
that the interaction with the outside Internet is not
information for policy (proprietary or security) reasons.
based in a “node” of the experiment in the same sense
as the traffic and actions of a completely internal There is vast work in network management; a field that
experiment. Therefore, in order to manage and monitor is related to our health management effort. The main
that interaction, a T2 agent is used to manage the distinction between network management and our
testbed’s constraint mechanisms. In terms of overall work is that testbed experiments lack generally agreed-
control of the experiment, this agent is a peer of the upon correctness or performance goals. Namely, what
node agents. Concretely, this agent is hosted on the may be regarded as poor performance in one
same node as the federant’s controller. The job of this experiment, such as frequent link failures, may be a
T2 agent is qualitatively different than that of the node desired effect in another experiment. Another
agents because it may have less control over what difference lies in the granularity at which management
actually happens, but may require more control over is done: networks are managed at high granularity of
the flow or distribution of information from its “target” network elements and links, while experiments also
to the other components of the experiment. By need to be managed at low granularity of user actions.
isolating that control in a separate agent, we increase Thus, we expect to reuse existing work in network
our ability to make it trustworthy, independently of the management for coarse-granularity management of the
other components of the SEER environment. testbed and the experiments, but we extend this field
with our fine-granularity management functionalities.
Our experiment health management architecture maps
directly onto the appropriate SEER agent infrastructure Network monitoring has received significant attention
for each experiment. By piggy-backing experiment with the advent of grid and cloud computing (to
health management monitoring agents onto the existing mention just a few publications [14][15][16][31]). We
SEER agent structure, we guarantee that the plan to reuse existing monitoring approaches and tools
appropriate data collection, behavior evaluation, health for our health management. The novelty of our work
determination, and responses will be managed along lies in interpretation of the outputs of those tools, and
exactly the same paths of control as those of the in orchestration of their activity.
experiment itself. This also allows for policy controls,
Ballani and Francis propose Complexity Oblivious
such as those that may be necessary in the information
Network Management [17], in which the management
plane component of the health management system, to
interface abstracts much of the underlying
follow the structure cleanly, giving each node agent,
implementation complexity, facilitating more effective
federant controller, or T2 agent local control over local
high-level management. We expect to leverage and
access. Finally, we extend the SEER GUI itself to
extend this work to simplify our management tasks.
provide access to these new capabilities in intuitive
ways. There are a number of tools for distributed application
management on PlanetLab [12], such as Plush and
6. Related Work Nebula [4], PlMan [19], Stork [20], pShell [21],
Planetlab Application Manager [22], parallel open SSH
Our experiment health work is an extension and tools [23], plDist [24], Nixes [25], PLDeploy [26] and
customization of knowledge plane [18] ideas to vxargs [27]. With the exception of Plush and Nebula,
network testbeds. Much recent work in this area has these tools are all low-level monitoring or management
concentrated on the sub-problem of supporting an tools that are engaged manually at the setup time of a
information plane. Two approaches are seen. With PlanetLab experiment. They enable parallel execution
Sophia [34] and the work of Loo et al. [35][36][37], of multiple tasks, or monitor nodes for liveness,
the objective is to provide an all-purpose information connectivity, and state, and present summarized
plane, in which all information is shared. From our information to a user. Plush [4] is a toolkit for
11
12. distributed application configuration, management and development [51][52][53], though much of this is the
visualization. Plush enables users to specify tasks in foundational work of interconnecting the testbeds at
XML format, then executes them invoking low-level the operational level. Our work extends this to enable
process, file and resource monitoring to detect failures. experiments that configure the federated environment
Plush also provides synchronization primitives and based on policy considerations such as the risk level of
performs resource acquisition and reallocation as the experiment, and to include distributed monitoring
needed. The primary distinction between Plush and our capability. The PlanetLab research community has also
proposed health monitoring is that Plush manages for begun to federate instantiations of PlanetLab [54][55].
known performance goals (connectivity, process Much of this work centers on splitting a centralized
liveness, etc.) that are suitable for continuously running authority between a few entities; our work is more
applications, while we additionally manage for focused on federation without a central authority. The
customizable performance goals that are suitable for Grid community provides both tools [56] and standards
widely varying testbed experiments. Our management [57][58][59][60] that are useful in addressing several
thus includes the notion of “expected performance” aspects of federation. Primarily, Grid tools simplify
and covers a wider range of behaviors than Plush. exchange of authentication requirements and trust
requirements, which are required in a practical
Emulab’s Experimenters Workbench [5] contains
federation system but are not central to our research.
support for experiment versioning, cloning via a
Adopting these standards and tools frees us to focus on
template, and archiving. These capabilities support pre-
the new aspects of our problem domain.
packaged experiments, and are complementary to the
capabilities provided by SEER. Emulab’s workbench Honeynets [32] address a problem related to our risky
does not, however, provide any support for experiment experiment control. Honeynets must allow some
creation and correctness checking, which is the main malware interaction with the outside Internet, but
focus of our health management infrastructure. control it so that the honeynet does not participate in
attacks on others [33]. This resembles our goal of
In the area of expectation or policy specification
allowing experiments to communicate safely with the
languages, we mention two extremes. XACML [29] is
Internet. However our problem is more constrained
declarative and serves as a policy capture framework,
since testbed researchers often have some knowledge
expecting enforcement through other means. From our
of the malware they want to study and can describe
perspective, policy declarations are only a small part of
some aspects of its behavior, while honeynets must
our challenge. In contrast, Ponder [30] [41] is an object
support unknown malware and live attackers. Despite
based language for declaring not only security and
these distinctions we find it useful to reuse honeynet
management policies, but time, state, and composite
practices for our testbed constraint implementation.
conditions under which the policies should be
evaluated, sets of subjects to be evaluated, sets of
targets over which some action might be taken, and the 7. Conclusion
actions themselves. All of these can be individuals, From its inception in 2004, the DETER testbed facility
composites, or abstractions. In fact, Ponder policies are and community have provided effective, dedicated
also objects and can themselves be the subjects of experimental resources and expertise to a broad range
policies. Simpler than Ponder, Tcl Expect [28] is a of academic, industrial and government researchers.
scripting environment whose syntax enables Now, building on knowledge gained, the DETER
specification of control flows that depend on controlled developers and community are moving beyond the
program outputs, thus automating system testing. As classic “testbed” model and towards the creation and
discussed earlier, our expectation language deployment of fundamentally transformational
incorporates such capabilities, with the specific cybersecurity research methodologies. The risky
objective of making expectation capture easily experiment management, experiment health support,
accessible, usable, and understandable by a broad set and federation technologies described in this paper
of differently skilled researchers. We find it useful to simultaneously enable order of magnitude increases in
reuse features of Tcl Expect and Ponder, wrapping both scientific rigor and realism for such research,
them in more user-friendly syntax and/or higher level leading to dramatic increases in researcher productivity
language constructs. and quality of results. Further, these DETER advances
Though there has been much work on federating serve as an incubator for similar capabilities in projects
databases or constructing meta-computers, federating such as GENI and the proposed National Cyber Range,
testbeds is a relatively recent area of research. Emulab- catalyzing dramatic and broad improvement in the
to-Emulab federation remains a topic of ongoing nation’s cyber research capability.
12
13. [15] A. W. Cooke et al. “The Relational Grid Monitoring
8. References Architecture: Mediating Information about the Grid” Journal
of Grid Computing, vol 2 no 4 December 2004.
[1] S. Schwab, B. Wilson, C. Ko, and A. Hussain, “SEER: A
Security Experimentation EnviRonment for DETER”, In [16] A. J. Wilson et al. “Information and Monitoring
Proceedings of the DETER Community Workshop on Cyber Services within a Grid Environment,” Proceedings of CHEP
Security Experimentation and Test, August 2007. 2004.
[2] B. White, J. Lepreau, L. Stoller, R. Ricci, S. Guruprasad, [17] H. Ballani and P. Francis, “CONMan: A Step Towards
M. Newbold, M. Hibler, C. Barb and A. Joglekar, “ An Network Manageability”, Proceedings of ACM SIGCOMM
Integrated Experimental Environment for Distributed 2007.
Systems and Networks”, Proceedings of the Fifth
Symposium on Operating Systems Design and [18] D. D. Clark, C. Partridge, J. C. Ramming, and J. T.
Implementation, USENIX, Boston, MA, 2002. Wroclawski, “A Knowledge Plane for the Internet,” in
Proceedings of ACM SIGCOMM, 2003.
[3] T. Benzel, R. Braden, D. Kim, B. C. Neuman, A. Joseph,
K. Sklower, Ron Ostrenga and S. Schwab, “Experience with [19] T. Isdal, T. Anderson, A. Krishnamurthy and E.
DETER: A Testbed for Security Research,” In Proceedings Lazowska, “PlanetLab Experiment Manager”,
of Tridentcom (International Conference on Testbeds and http://www.cs.washington.edu/research/networking/cplane/
Research Infrastructures for the Development of Networks & [20] University of Arizona, “Stork”,
Communities), March 2006. http://www.cs.arizona.edu/stork/
[4] J. Albrecht, C. Tuttle, A. C. Snoeren, and A. Vahdat. [21] McGill University, “pShell”,
“PlanetLab Application Management Using Plush,” ACM http://www.cs.mcgill.ca/~anrl/projects/pShell/index.php
Operating Systems Review (SIGOPS-OSR), 40(1), January
2006. [22] Intel Research Berkeley, “PlanetLab Application
Manager”, http://appmanager.berkeley.intelresearch.net/
[5] E. Eide, L. Stoller, and J. Lepreau, “An Experimentation
Workbench for Replayable Networking Research”, [23] Intel Research Berkeley, “Parallel open ssh tools”,
Proceedings of NSDI 2007. http://www.theether.org/pssh/
[6] A. Bavier, N. Feamster, M. Huang, L. Peterson and J. [24] M. Georg, University of Washington at St Louis,
Rexford, “In VINI Veritas: Realistic and Controlled Network “plDist”, http://www.arl.wustl.edu/~mgeorg/plDist.html
Experimentation,” Proceedings of ACM SIGCOMM 2006. [25] AquaLab, Northwestern University, “Nixes”,
[7] WAIL testbed, http://www.schooner.wail.wisc.edu/ http://www.aqualab.cs.northwestern.edu/nixes.html
[8] TCPreplay, http://tcpreplay.synfin.net/trac/ [26] Intel Oregon, “PLDeploy”, http://psepr.org/tools/
[9] Harpoon traffic generator, [27] Y. Mao, University of Pennsylvania, “vxargs: Running
http://pages.cs.wisc.edu/~jsommers/harpoon/ arbitrary commands with explicit parallelism, visualization
and redirection”,
[10] J. Mirkovic, A. Hussain, B. Wilson, S. Fahmy, P. http://dharma.cis.upenn.edu/planetlab/vxargs/
Reiher, R. Thomas, W. Yao, and S. Schwab, “Towards User-
Centric Metrics for Denial-Of-Service Measurement,” [28] D. Libes, “expect: Curing those Uncontrollable Fits of
Proceedings of the Workshop on Experimental Computer Interaction”, Proceedings of the Summer 1990 USENIX
Science, June 2007 Conference, Anaheim, CA, June 11-15, 1990.
[11] TCPdump, http://www.tcpdump.org [29] OASIS, “OASIS extensible Access Control Markup
Language”, http://www.oasis-
[12] L. Peterson, A. Bavier, M. Fiuczynski, and S. Muir, open.org/committees/tc_home.php?wg_abbrev=xacml
“Experiences Building PlanetLab”, Proceedings of Operating
Systems Design and Implementation Symposium (OSDI [30] N. Damianou, N.. Dulay, E. Lupu, M. Sloman, “The
‘06), November 2006 Ponder policy specification language”, Proceedings of
Workshop on Policies for Distributed Systems and Networks,
[13] T. Faber, J. Wroclawski, and K. Lahey, “A DETER 2001.
Federation Architecture”, In Proceedings of the DETER
Community Workshop on Cyber Security Experimentation [31] Y. Mao, H. Jamjoom, S. Tao, J. M. Smith,
and Test, August 2007. “NetworkMD: Topology Inference and Failure Diagnosis in
the Last Mile”, Proceedings of IMC 2007.
[14] I. C .Legrand, H. B. Newman, R. Voicu, C. Cirstoiu, C.
Grigoras, M. Toarta, C. Dobre “MonALISA: An Agent [32] The Honeynet Project, Web page,
based, Dynamic Service System to Monitor, Control and http://www.honeynet.org
Optimize Grid based Applications, Proceedings of CHEP nd
2004. [33] The Honeynet Project, “Know your Enemy”, 2 edition,
Addison-Wesley Profeesional, May 2004.
13
14. [34] M. Wawrzoniak, L. Peterson, and T. Roscoe, Sophia: [48] M. Mehta, K. Thapar, G. Oikonomou and J. Mirkovic,
An Information Plane for Networked Systems, ACM "Combining Speak-up with DefCOM for Improved DDoS
SIGCOMM (HOTNETS-II) Proc. 2nd Workshop on Hot Defense", Proceedings of ICC 2008.
Topics in Networks, 2004, 15-20.
[49] J. Li, D. Lim, K. Sollins. The 16th USENIX Security
[35] J. Kopena and B. Loo, OntoNet: Scalable Knowledge- Symposium, DETER Community Workshop on Cyber
Based Networking, 4th Workshop on Networking Meets Security Experimentation and Test 2007, Boston, MA,
Databases, 2008. August 6-7, 2007.
[36] Y. Mao, B. Loo, Z. Ives, and J. Smith, The Case for a [50] V. Paxson, Bro: A System for Detecting Network
Unified Extensible Data-Centric Mobility Infrastructure, Intruders in Real-Time, Computer Networks, 31(2324), pp.
ACM SIGCOMM International Workshop on Mobility in the 2435-2463, 14 Dec. 1999.
Evolving Internet Architecture, 2007.
[51] J. Lepreau, R. Ricci, L. Stoller, M. Hibler, "Federation
[37] W. Zhou, E. Cronin, and B. Loo, Provenance-aware of Emulabs and Relevant New Development," Presentation at
Secure Networks, 4th Workshop on Networking Meets the USC/ISI Federation Workshop, December 2006.
Databases, 2008. http://www.cs.utah.edu/flux/testbed-docs/emulab-fed-issues-
dec06.pdf
[38] H. V. Madhyastha, T. Isdal, M. Piatek, C. Dixon, T.
Anderson, A. Krishnamurthy, and A. Venkatramani, iPlane: [52] R. Ricci, J. Lepreau, L. Stoller, M. Hibler, "Emulab
An Information Plane for Distributed Services, USENIX Federation Preliminary Design," Presentation at the USC/ISI
(OSDI) Proc. Symposium on Operating Systems Design and Federation Workshop, December 2006.
Implementation, 2006. http://www.cs.utah.edu/flux/testbeddocs/emulab-fed-design-
dec06.pdf
[39] Y. He, G. Siganos, M. Faloutsos, and S Krishnamurthy,
A Systematic Framework for Unearthing the Missing Links: [53] J. Lepreau, "The Utah ProtoGENI Project," Presentation
Measurements and Impact, Symposium on Networked at the 1st GENI Engineering Conference, October 2007.
Systems Design and Implementation, April 2007. http://www.geni.net/docs/Utah_ProtoGENI.pdf
[40] A. Greenberg, G. Hjalmtysson, D. A. Maltz, A. Myers, [54] http://www.planet-lab.org/federation
and J. Rexford, A Clean Slate {4D} Approach to Network
Control and Management, ACM SIGCOMM Computer [55] PlanetLab/OneLab Consortium, "Federation Roadmap",
Communications Review, 35(5), 2005. Draft White Paper,
http://www.cs.princeton.edu/~llp/federation-roadmap.pdf
[41] N. Dulay, E. Lupu, M. Sloman, and N. Damianou, A
Policy Deployment Model for the Ponder Language, IEEE [56] I. Foster, C. Kesselman, "Globus: A Metacomputing
Infrastructure Toolkit," International Journal of
International Symposium on Integrated Network
Management, 2001. Supercomputing Applications, vol. 11, pp. 115-128, 1997.
[42] L. L. Peterson, N.C. Buchholz, and R. D. Schlichting, [57] "Web Services Federation Language (WS-Federation)",
Preserving and Using Context Information in Interprocess December 2006.
communication. ACM Trans. Comput. Syst. 7, 3 (Aug. http://specs.xmlsoap.org/ws/2006/12/federation/
1989), 217-246. [58] OASIS Standard, "WS-Trust 1.3", March 2007
[43] K. Birman, and T. Joseph, Exploiting Virtual Synchrony http://docs.oasis-open.org/ws-sx/ws-trust/200512
in Distributed Systems. SIGOPS Oper. Syst. Rev. 21, 5 (Nov. [59] W3C Member Submission "Web Services Policy 1.2 -
1987), 123-138. Framework", 25 April 2006.
http://www.w3.org/Submission/2006/SUBM-WS-Policy-
[44] J. Stewart, Storm Worm DDoS Attack, SecureWorks
Research, available at 20060425/
http://www.secureworks.com/research/threats/storm-worm [60] OASIS Standard, "WS-SecurityPolicy 1.2", July 2007.
[45] J. Mirkovic, M. Robinson, P. Reiher, and G. Kuenning, http://docs.oasis-open.org/ws-sx/wssecuritypolicy/200702
Alliance Formation for DDoS Defense, Proceedings of the
New Security Paradigms Workshop, ACM SIGSAC, August
2003.
[46] G. Oikonomou, J. Mirkovic, P. Reiher and M. Robinson,
A Framework for Collaborative DDoS Defense, Proceedings
of ACSAC 2006, December 2006.
[47] M. Natu and J. Mirkovic, Fine-Grained Capabilities for
Flooding DDoS Defense Using Client Reputations,
Proceedings of the Large-Scale Attack and Defense
Workshop, August 2007.
14