Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358)最新文献

Error recovery in critical infrastructure systems 关键基础设施系统中的错误恢复

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798357

John C. Knight, Matthew C. Elder, Xing Du

引用次数: 21

Toward a scalable method for quantifying aspects of fault tolerance, software assurance, and computer security 朝着量化容错、软件保证和计算机安全方面的可扩展方法迈进

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798360

Philip Koopman

{"title":"Toward a scalable method for quantifying aspects of fault tolerance, software assurance, and computer security","authors":"Philip Koopman","doi":"10.1109/CSDA.1998.798360","DOIUrl":"https://doi.org/10.1109/CSDA.1998.798360","url":null,"abstract":"Quantitative assessment tools are urgently needed in the areas of fault tolerance, software assurance, and computer security. Assessment methods typically employed in various combinations are fault injection, formal verification, and testing. However these methods are expensive because they are labor-intensive, with costs scaling at least linearly with the number of software modules tested. Additionally, they are subject to human lapses and oversights because they require two different representations for each system, and then base results on a direct or an indirect representation comparison. The Ballista project has found that robustness testing forms a niche in which scalable quantitative assessment can be achieved at low cost. This scalability stems from two techniques. Associating state-setting information with test cases based on data types, and using one generic, but narrow, behavioral specification for all modules. Given that this approach has succeeded in comparing the robustness of various operating systems, it is natural to ask if it can be made more generally applicable. It appears that Ballista-like testing can be used in the fault tolerance area to measure the generic robustness of a variety of API implementations and in particular to identify reproducible ways to crash and hang software. In software assurance, it can be used as a quality check on exception handling, and in particular as a means to augment black box testing. Applying it to computer security appears more problematic, but might be possible if there is a way to orthogonally decompose various aspects of security-relevant system state into analogs of Ballista data types. While Ballista-like testing is no substitute for traditional methods, it can serve to provide a useful quality assurance check that augments existing practice at relatively low cost. Alternately, it can serve to quantify the extent of potential problems, enabling better informed decisions by both developers and customers.","PeriodicalId":171437,"journal":{"name":"Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358)","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1998-07-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127516507","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 23

A fault tolerance approach to survivability 可生存性的容错方法

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798367

P. Ammann, S. Jajodia, Peng Liu

{"title":"A fault tolerance approach to survivability","authors":"P. Ammann, S. Jajodia, Peng Liu","doi":"10.1109/CSDA.1998.798367","DOIUrl":"https://doi.org/10.1109/CSDA.1998.798367","url":null,"abstract":"Attacks on computer systems have received a great deal of press attention; however, most of the focus has been on how an attacker can disrupt an organization's operations. Although attack prevention is clearly preferred, preventive measures do fail, and some attacks inevitably succeed in compromising some or all of particular systems, i.e., databases. We propose research into a fault-tolerance approach that addresses all phases of survivability: attack detection, damage confinement, damage assessment and repair, and attack avoidance. We focus attention on continued service and recovery issue. A promising area of research for continued service addresses relaxed notions of consistency. Expanding on the notion of self stabilization, the idea is to formalize the degree of damage under which useful services is still possible. A complementary research area for recovery is the engineering of suitable mechanisms into existing systems. We explain the underlying models for these research areas and illustrate them with examples from the database domain. We argue that these models form a natural part of a fault tolerance approach and propose research into adapting these models for larger systems.","PeriodicalId":171437,"journal":{"name":"Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1998-07-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114837936","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Dependability-a unifying concept 可靠性——一个统一的概念

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798354

B. Randell

引用次数: 27

A symbiotic relationship between formal methods and security 形式化方法和安全性之间的共生关系

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798355

Jeannette M. Wing

引用次数: 64

Security and dependability: then and now 安全性和可靠性:过去和现在

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798363

Catherine Meadows, John McLean

引用次数: 19

Certificate revocation the responsible way 证书撤销的负责方式

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798366

Jonathan Millen, Rebecca N. Wright

引用次数: 21

Practical techniques for damage confinement in software 软件中损害约束的实用技术

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798361

David J. Taylor

引用次数: 5

Diversity against accidental and deliberate faults 多样性对抗偶然的和故意的错误

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798364

Y. Deswarte, K. Kanoun, J. Laprie

引用次数: 83

Should architectural principles be enforced? 应该执行架构原则吗?

Proceedings Computer Security, Dependability, and Assurance: From Needs to Solutions (Cat. No.98EX358) Pub Date : 1998-07-09 DOI: 10.1109/CSDA.1998.798359

N. Minsky

引用次数: 7