Normal Execution Research Articles

Ensemble of Bayesian Predictors and Decision Trees for Proactive Failure Management in Cloud Computing Systems

In modern cloud computing systems, hundreds and even thousands of cloud servers are interconnected by multi-layer networks. In such large-scale and complex systems, failures are common. Proactive failure management is a crucial technology to characterize system behaviors and forecast failure dynamics in the cloud. To make failure predictions, we need to monitor the system execution and collect health-related runtime performance data. However, in newly deployed or managed cloud systems, these data are usually unlabeled. Supervised learning based approaches are not suitable in this case. In this paper, we present an unsupervised failure detection method using an ensemble of Bayesian models. It characterizes normal execution states of the system and detects anomalous behaviors. After the anomalies are verified by system administrators, labeled data are available. Then, we apply supervised learning based on decision tree classifiers to predict future failure occurrences in the cloud. Experimental results in an institute-wide cloud computing system show that our methods can achieve high true positive rate and low false positive rate for proactive failure management.

Building safe PaaS clouds: A survey on security in multitenant software platforms

This paper surveys the risks brought by multitenancy in software platforms, along with the most prominent solutions proposed to address them. A multitenant platform hosts and executes software from several users (tenants). The platform must ensure that no malicious or faulty code from any tenant can interfere with the normal execution of other users’ code or with the platform itself. This security requirement is specially relevant in Platform-as-a-Service (PaaS) clouds. PaaS clouds offer an execution environment based on some software platform. Unless PaaS systems are deemed as safe environments users will be reluctant to trust them to run any relevant application. This requires to take into account how multitenancy is handled by the software platform used as the basis of the PaaS offer. This survey focuses on two technologies that are or will be the platform-of-choice in many PaaS clouds: Java and .NET. We describe the security mechanisms they provide, study their limitations as multitenant platforms and analyze the research works that try to solve those limitations. We include in this analysis some standard container technologies (such as Enterprise Java Beans) that can be used to standardize the hosting environment of PaaS clouds. Also we include a brief discussion of Operating Systems (OSs) traditional security capacities and why OSs are unlikely to be chosen as the basis of PaaS offers. Finally, we describe some research initiatives that reinforce security by monitoring the execution of untrusted code, whose results can be of interest in multitenant systems.

Virtual machine monitor-based lightweight intrusion detection

As virtualization technology gains in popularity, so do attempts to compromise the security and integrity of virtualized computing resources. Anti-virus software and firewall programs are typically deployed in the guest virtual machine to detect malicious software. These security measures are effective in detecting known malware, but do little to protect against new variants of intrusions. Intrusion detection systems (IDSs) can be used to detect malicious behavior. Most intrusion detection systems for virtual execution environments track behavior at the application or operating system level, using virtualization as a means to isolate themselves from a compromised virtual machine. In this paper, we present a novel approach to intrusion detection of virtual server environments which utilizes only information available from the perspective of the virtual machine monitor (VMM). Such an IDS can harness the ability of the VMM to isolate and manage several virtual machines (VMs), making it possible to provide monitoring of intrusions at a common level across VMs. It also offers unique advantages over recent advances in intrusion detection for virtual machine environments. By working purely at the VMM-level, the IDS does not depend on structures or abstractions visible to the OS (e.g., file systems), which are susceptible to attacks and can be modified by malware to contain corrupted information (e.g., the Windows registry). In addition, being situated within the VMM provides ease of deployment as the IDS is not tied to a specific OS and can be deployed transparently below different operating systems. Due to the semantic gap between the information available to the VMM and the actual application behavior, we employ the power of data mining techniques to extract useful nuggets of knowledge from the raw, low-level architectural data. We show in this paper that by working entirely at the VMM-level, we are able to capture enough information to characterize normal executions and identify the presence of abnormal malicious behavior. Our experiments on over 300 real-world malware and exploits illustrate that there is sufficient information embedded within the VMM-level data to allow accurate detection of malicious attacks, with an acceptable false alarm rate.

Runtime Defense against Code Injection Attacks Using Replicated Execution

The number and complexity of attacks on computer systems are increasing. This growth necessitates proper defense mechanisms. Intrusion detection systems play an important role in detecting and disrupting attacks before they can compromise software. Multivariant execution is an intrusion detection mechanism that executes several slightly different versions, called variants, of the same program in lockstep. The variants are built to have identical behavior under normal execution conditions. However, when the variants are under attack, there are detectable differences in their execution behavior. At runtime, a monitor compares the behavior of the variants at certain synchronization points and raises an alarm when a discrepancy is detected. We present a monitoring mechanism that does not need any kernel privileges to supervise the variants. Many sources of inconsistencies, including asynchronous signals and scheduling of multithreaded or multiprocess applications, can cause divergence in behavior of variants. These divergences cause false alarms. We provide solutions to remove these false alarms. Our experiments show that the multivariant execution technique is effective in detecting and preventing code injection attacks. The empirical results demonstrate that dual-variant execution has on average 17 percent performance overhead when deployed on multicore processors.

Design of a GPS backpack to track European hedgehogs Erinaceus europaeus

We report on the design and construction of a Global Positioning System (GPS) backpack to collect positional data of European hedgehogs Erinaceus europaeus. The device consisted of a microGPS unit plus a VHF transmitter to facilitate unit recovery. It was constructed to articulate when the animal rolled up and to prevent snagging on objects or nests. Backpacks were fitted to 28 hedgehogs with eight reattachments at different seasons (N = 36 samples). Units fixed hedgehog positions at high rate for an average of 5 days to address our study on spatial ecology at fine scale. We recorded the normal execution of defensive rolling behaviour, impediments on natural movements across vegetation and nest occupancy, and also changes in body mass. We could not discern any negative effect associated with the backpack for attachments up to 8 days; hence, we consider this design to be appropriate for tracking European hedgehogs over this length of time.

ReHype

With existing virtualized systems, hypervisor failures lead to overall system failure and the loss of all the work in progress of virtual machines (VMs) running on the system. We introduce ReHype, a mechanism for recovery from hypervisor failures by booting a new instance of the hypervisor while preserving the state of running VMs. VMs are stalled during the hypervisor reboot and resume normal execution once the new hypervisor instance is running. Hypervisor failures can lead to arbitrary state corruption and inconsistencies throughout the system. ReHype deals with the challenge of protecting the recovered hypervisor instance from such corrupted state and resolving inconsistencies between different parts of hypervisor state as well as between the hypervisor and VMs and between the hypervisor and the hardware. We have implemented ReHype for the Xen hypervisor. The implementation was done incrementally, using results from fault injection experiments to identify the sources of dangerous state corruption and inconsistencies. The implementation of ReHype involved only 880 LOC added or modified in Xen. The memory space overhead of ReHype is only 2.1MB for a pristine copy of the hypervisor code and static data plus a small reserved memory area. The fault injection campaigns used to evaluate the effectiveness of ReHype involved a system with multiple VMs running I/O and hypercall-intensive benchmarks. Our experimental results show that the ReHype prototype can successfully recover from over 90% of detected hypervisor failures.

Decentralised web-services orchestration with continuation-passing messaging

Traditional centralised approaches to orchestrating composite services are subject to serious limitations for orchestrating services in open web applications. Dealing with these limitations calls for decentralised approaches, which are themselves faced with a number of technical challenges, due primarily to lack of overview of dynamic process status. We present a new decentralised approach that meets some of these technical challenges. The approach is based on continuation-passing messaging. It facilitates dynamic runtime tasks like fault handling and process recovery. Our experimental results show performance advantage of the approach, both in normal executions and in case of service failures.

MiGuard : Detecting and Guarding against Malicious Iframe through API Hooking

Recently, client-side attacks through the Microsoft Internet Explorer have increased. In this paper, we present a method to detect and block malware programs resulting from successful malicious iframe attacks. This method can detect malware program execution through distinguishing API sequences of normal execution and abnormal API sequences resulting from an exploit using Win32 API hooks. We implemented MiGuard (Guard against malicious iframes) and performed experiments. The evaluation results indicate that our approach can effectively detect and block malicious iframes. We also believe that our research can help prevent threats of malicious iframes.

An Execution-flow Based Method for Detecting Cross-Site Scripting of Ajax Applications

We present an execution-flow analysis for JavaScript programs running in a web browser to prevent Cross-site Scripting (XSS) attacks. We construct finite-state automata (FSA) to model the client-side behavior of Ajax applications under normal execution. Our system is deployed in proxy mode. The proxy analyzes the execution flow of client-side JavaScript before the requested web pages arrive at the browser to prevent potentially malicious scripts, which do not conform to the FSA. We evaluate our technique against several real-world applications and the result shows that it protects against a variety of XSS attacks with an acceptable performance overhead.

Caenorhabditis elegans TLK-1 controls cytokinesis by localizing AIR-2/Aurora B to midzone microtubules

Defects in chromosome condensation, segregation or cytokinesis during mitosis disrupt genome integrity and cause organismal death or tumorigenesis. The conserved kinase AIR-2/Aurora B is required for normal execution of all these important mitotic events in Caenorhabditis elegans. TLK-1 has been recently shown to be a substrate and activator of AIR-2 in the presence of another AIR-2 activator ICP-1/INCENP, and to cooperate with AIR-2 to ensure proper mitotic chromosome segregation. However, whether TLK-1 may contribute to chromosome condensation or cytokinesis is unclear. A time-lapse microscopy analysis showed that tlk- 1 mutants are defective in chromosome condensation and cytokinesis, in addition to chromosome segregation, during mitosis. Our data indicate that TLK-1 contributes to chromosome condensation and segregation, at least in part, in a manner that is distinct from the ICP-1-mediated mechanism and does not involve loading AIR-2 or condensin proteins to mitotic chromosomes. Moreover, TLK-1 functions in cytokinesis by localizing AIR-2 to the midzone microtubules. The localization pattern of TLK-1 is different from those of ICP-1 and AIR-2, revealing differences in dynamic regulation and association of TLK-1 and ICP-1 towards AIR-2 in vivo. Interestingly, human TLK2 could functionally substitute for tlk- 1, suggesting that the mitotic roles of TLK members might be evolutionarily conserved.

A genetic‐fuzzy system for optimising agent steering

AbstractFuzzy controllers are a popular method for animated character perception and control. A drawback of fuzzy systems is that time intensive manual calibration of system parameters is required. We introduce a new Genetic‐Fuzzy System (GFS) that automates the tuning process of rules for animated character steering. An advantage of our GFS is that it is able to adapt the rules for steering behaviour during run time. We explore the parameter space of the new GFS, and discuss how the GFS can be implemented to run as a background process during normal execution of a simulation. Copyright © 2010 John Wiley & Sons, Ltd.

An uncoordinated asynchronous checkpointing model for hierarchical scientific workflows

Scientific workflow systems often operate in unreliable environments, and have accordingly incorporated different fault tolerance techniques. One of them is the checkpointing technique combined with its corresponding rollback recovery process. Different checkpointing schemes have been developed and at various levels: task- (or activity-) level and workflow-level. At workflow-level, the usually adopted approach is to establish a checkpointing frequency in the system which determines the moment at which a global workflow checkpoint – a snapshot of the whole workflow enactment state at normal execution (without failures) – has to be accomplished. We describe an alternative workflow-level checkpointing scheme and its corresponding rollback recovery process for hierarchical scientific workflows in which every workflow node in the hierarchy accomplishes its own local checkpoint autonomously and in an uncoordinated way after its enactment. In contrast to other proposals, we utilise the Reference net formalism for expressing the scheme. Reference nets are a particular type of Petri nets which can more effectively provide the abstractions to support and to express hierarchical workflows and their dynamic adaptability.

Cep55 stabilization is required for normal execution of cytokinesis

Cep55 is a mitotic phosphoprotein that plays an important role in cytokinesis, the final stage of cell division during which physical separation of the two daughter cells is accomplished. We recently demonstrated that the peptidyl-prolyl isomerase Pin1 regulates this cell cycle event by enhancing the Plk1-dependent phosphorylation of Cep55. We show here that Cep55 is stabilized post-translationally during mitosis and that siRNA-mediated knockdown of Pin1 prevents this stabilization. Consistent with this, Cep55 is unstable in Pin1 knockout mouse embryonic fibroblasts. Moreover, mutation of the Pin1 binding sites in Cep55 reduces its stability during mitosis. Mutation of the Plk1 phosphorylation site also lowers Cep55 stability, whereas overexpression of Plk1 increases Cep55 levels, in keeping with Pin1 regulating Plk1-mediated phosphorylation of Cep55. Importantly, expression of wild-type Cep55 at levels similar to that of the phosphorylation mutants only partially reverts the cytokinesis defect induced by depletion of Cep55, indicating that inadequate levels of Cep55 prevent proper execution of cytokinesis. Taken together, these data provide more insight into the regulation of the final stages of cell division. As cytokinesis defects can cause chromosomal instability, knowledge about the processes that regulate normal cytokinesis adds to our understanding of events that lead to tumorigenesis.

Special Issue: Euro‐Par 2008

AbstractPreface for the special issue on Euro‐Par 2008. Copyright © 2009 John Wiley & Sons, Ltd.

Global-to-Local Approach to Rigorously Developing Distributed System with Exception Handling

Cooperative distributed system covers a wide range of applications such as the systems for industrial controlling and business-to-business trading, which are usually safety-critical. Coordinated exception handling (CEH) refers to exception handling in the cooperative distributed systems, where exceptions raised on a peer should be dealt with by all relevant peers in a consistent manner. Some CEH algorithms have been proposed. A crucial problem in using these algorithms is how to develop the peers which are guaranteed coherent in both normal execution and exceptional execution. Straightforward testing or model checking is very expensive. In this paper, we propose an effective way to rigorously develop the systems with correct CEH behavior. Firstly, we formalize the CEH algorithm by proposing a Peer Process Language to precisely describe the distributed systems and their operational semantics. Then we dig out a set of syntactic conditions, and prove its sufficiency for system coherence. Finally, we propose a global-to-local approach, including a language describing the distributed systems from a global perspective and a projection algorithm, for developing the systems. Given a well-formed global description, a set of peers can be generated automatically. We prove the system composed of these peers satisfies the conditions, that is, it is always coherent and correct for CEH.

Open-ended category learning for language acquisition

Motivated by the need to support language-based communication between robots and their human users, as well as grounded symbolic reasoning, this paper presents a learning architecture that can be used by robotic agents for long-term and open-ended category acquisition. To be more adaptive and to improve learning performance as well as memory usage, this learning architecture includes a metacognitive processing component. Multiple object representations and multiple classifiers and classifier combinations are used. At the object level, the main similarity measure is based on a multi-resolution matching algorithm. Categories are represented as sets of known instances. In this instance-based approach, storing and forgetting rules optimise memory usage. Classifier combinations are based on majority voting and the Dempster–Shafer evidence theory. All learning computations are carried out during the normal execution of the agent, which allows continuous monitoring of the performance of the different classifiers. The measured classification successes of the individual classifiers support an attentional selection mechanism, through which classifier combinations are dynamically reconfigured and a specific classifier is chosen to predict the category of a new unseen object. A simple physical agent, incorporating these learning capabilities, is used to test the approach. A long-term experiment was carried out having in mind the open-ended nature of category learning. With the help of a human mediator, the agent incrementally learned 68 categories of real-world objects visually perceivable through an inexpensive camera. Various aspects of the approach are evaluated through systematic experiments.

Walk This Way

The neural mechanisms that decide when and where to walk are not well understood. In this issue of Neuron, Felsen and Mainen use an olfactory-guided orienting task to show that the superior colliculus is necessary in rodents for the normal execution of spatial locomotor choices.

Efficient exception handling in Java bytecode-to-C ahead-of-time compiler for embedded systems

One of the most promising approaches to Java acceleration in embedded systems is a bytecode-to-C ahead-of-time compiler (AOTC). It improves the performance of a Java virtual machine (JVM) by translating bytecode into C code, which is then compiled into machine code via an existing C compiler. One important design issue in AOTC is efficient exception handling. Since the excepting point and the exception handler may locate in different methods on a call stack, control transfer between them should be streamlined, while an exception would be an “exceptional” event, so it should not slow down normal execution paths. Previous AOTCs often employed a technique called stack cutting based on a setjmp()/longjmp() pair, which we found is involved with too much performance overheads. Also, when the AOTC and the interpreter are employed concurrently (e.g., some methods are AOTCed while other methods are interpreted), the performance of normal execution paths is affected more seriously. This paper proposes a simpler solution based on an exception check after each method call, merged with garbage collection check for reducing its overhead. Our evaluation results on SPECjvm98 on Sun's CVM indicate that our technique can improve the performance of stack cutting by more than 25%. A similar performance benefit can be noted on a hybrid execution environment of both the AOTC and the interpreter.

INFLUENCE OF SCROTAL NERVES ON THE PROSTATE GLAND FUNCTION IN MALE RATS

The prostate is a sexual gland producing decisive substances for the potency of sperms to fertilize eggs at the female reproductive tract. Its location influences several functions as those related to micturition, seminal emission and ejaculation, and has a differential role in its two regions, the dorsolateral and the ventral prostate. The two regions are organized in several alveoli surrounded by the stroma area, and each alveolus is arranged with a secretory epithelium that is in charge of the synthesis of prostatic secretions necessary for fertility. In order to accomplish its functions, the prostate is finely regulated by neural and hormonal mechanisms. Working with peripheral nerves supplying the reproductive organs in male rats, we observed that manipulation of afferent scrotal nerves in anesthetized subjects produces the expulsion of semen, and that the execution of sexual behavior by male rats includes an intense mechanical stimulation of the scrotal skin. Therefore, we hypothesized that scrotum stimulation during copulation reflexively activates the autonomic neural supply to the sexual glands in order to expel the appropriate content of semen during ejaculation. Thus, here we tested the hypothesis by analyzing the ejaculated semen parameters and the organization of the prostate gland in male rats with denervated scrotal nerves. Results show that transection of scrotal nerves did not modify neither motivation nor the normal execution of sexual behavior in male rats, but produces significant reductions in the volume of expelled semen, in the concentration of spermatozoa, and in the viability of ejaculated sperms when the semen is evaluated in the female reproductive tract immediately after male ejaculation. Also, denervated males showed a significant reduction and increase respectively in the alveolar area of the ventral and dorsolateral prostate. Thus, in addition to the endocrine regulation of sexual glands, the neural control has also a key role. Our data show that the mechanical stimulation activating scrotal nerves during copulation is important for the ejaculation of semen with the appropriate content for fertility, through the influence on prostate physiology. Whether the prostate is the only sexual gland reflexively activated, is a topic that deserves further research. (poster)

Sweeper

The vulnerabilities that plague computers cause endless grief to users. Slammer compromised millions of hosts in minutes; a hit-list worm would take under a second. Recently proposed techniques respond better than manual approaches, but require expensive instrumentation, which limits deployment. Although spreading "antibodies" (e.g. signatures) ameliorates this limitation, hosts depending on antibodies are defenseless until inoculation; to the fastest hit-list worms this delay is crucial. Additionally, most recently proposed techniques cannot provide recovery to provide continuous service after an attack. We propose a novel solution called Sweeper that provides both fast and accurate post-attack analysis and efficient recovery with low normal execution overhead . Sweeper in-novatively combines several techniques: (1) Sweeper uses lightweight monitoring techniques to detect a wide array of suspicious requests, providing a first level of defense. (2) By cleverly leveraging lightweight checkpointing, Sweeper postpones heavyweight monitoring until absolutely necessary --- after an attack is detected. Sweeper rolls back and re-executes multiple times to dynamically apply heavyweight analysis techniques via dynamic binary instrumentation. Since only the execution involved in the attack is analyzed, the analysis is efficient, yet thorough. (3) Based on the analysis results, Sweeper automatically generates low-overhead antibodies to prevent future attacks of the same vulnerability. (4) Finally, Sweeper again re-executes to perform fast recovery for continuous service. We implement Sweeper in a real system. Our experimental results with three real-world servers and four real security vulnerabilities show that Sweeper can detect an attack and generate antibodies in under 60 milliseconds. Our results also show that Sweeper imposes under 1% overhead during normal execution, clearly suitable for widespread production deployment (especially since Sweeper also allows partial deployment). Finally, we analytically show that, for a fast hit-list worm otherwise capable of infecting all vulnerable hosts in under a second, Sweeper contains the extent of infection to under 5%.