william yurcik

Followers

Following

Public Views

Roshan Chitrakar

Nepal College of Information Technology

Lev Manovich

Graduate Center of the City University of New York

Ute Günkel-Maschek

Universität Heidelberg

amir manian

University of Tehran

PALIMOTE JUSTICE

RIVERS STATE POLYTECHNIC

Y. Adam Prasetyo

Telkom University

Μιχαλης Σπηλιωτης

Democritus University of Thrace

Eslam Elsamahy

Beirut Arab University

Christopher Crick

Oklahoma State University

Sergio Fagherazzi

Boston University

Interests

Uploads

Papers by william yurcik

Reputation and Dispute in eBay Transactions

International Journal of Electronic Commerce, 2005

How computers really work

Proceedings of the 2002 workshop on Computer architecture education Held in conjunction with the 29th International Symposium on Computer Architecture - WCAE '02, 2002

) 1 7s e §) 1¦ B5 g! 9g h¦ ©( B {$ a §D y¦ B| A(

Download

A Survey and Comparison of Human Monitoring of Complex Networks

Networks of different types are essential infrastructures for society. Networks such as transport... more Networks of different types are essential infrastructures for society. Networks such as transportation networks and the electric power grid are becoming increasingly large and complex which create special challenges for human operators who must monitor these networks for safe operation. It is important to understand how human operators monitor these networks and the challenges they face in the monitoring task. In order to do this, we conducted a survey of how human operators monitor various networks-water distribution networks, electric power grid, air traffic control, and nuclear power plant networks. From our survey in these specific extensively-studied networks, we are able to generalize the challenges of operators monitoring networks. The hope is that these results will provide human factors engineers with a better understanding so they can cater to the needs of the human operators when designing new interfaces for network monitoring tasks.

Download

On integrating human-in-the-loop supervision into critical infrastructure process control systems

ABSTRACT

Ethical hacking: the security justification redux

IEEE 2002 International Symposium on Technology and Society (ISTAS'02). Social Implications of Information and Communication Technology. Proceedings (Cat. No.02CH37293)

Security of computers connected to the Internet is bad and becoming worse. One reaction to this s... more Security of computers connected to the Internet is bad and becoming worse. One reaction to this state of affairs is a behavior termed "Ethical Hacking" which attempts to proactively increase security protection by identifying and subsequently encouraging the patching of known security vulnerabilities on systems owned by other parties. Ethical hackers may beta test unreleased software, stress test released software, and scan networks of computers for vulnerabilities. Previous work has emphasized ethical hacking as an altruistic behavior but we find ethical hackers act rationally, in self-interest, to secure systems that are within their own community (sometimes for pay) -networked systems are only as secure as the weakest system within perimeter defenses.

Download

Sharing computer network logs for security and privacy: a motivation for new methodologies of anonymization

Workshop of the 1st International Conference on Security and Privacy for Emerging Areas in Communication Networks, 2005.

Logs are one of the most fundamental resources to any security professional. It is widely recogni... more Logs are one of the most fundamental resources to any security professional. It is widely recognized by the government and industry that it is both beneficial and desirable to share logs for the purpose of security research. However, the sharing is not happening or not to the degree or magnitude that is desired. Organizations are reluctant to share logs because of the risk of exposing sensitive information to potential attackers. We believe this reluctance remains high because current anonymization techniques are weak and one-size-fits-all-or better put, one size tries to fit all. We must develop standards and make anonymization available at varying levels, striking a balance between privacy and utility. Organizations have different needs and trust other organizations to different degrees. They must be able to map multiple anonymization levels with defined risks to the trust levels they share with (would-be) receivers. It is not until there are industry standards for multiple levels of anonymization that we will be able to move forward and achieve the goal of widespread sharing of logs for security researchers.

Download

Log correlation for intrusion detection: a proof of concept

19th Annual Computer Security Applications Conference, 2003. Proceedings.

Intrusion detection is an important part of networkedsystems security protection. Although commer... more Intrusion detection is an important part of networkedsystems security protection. Although commercial products exist, finding intrusions has proven to be a difficult task with limitations under current techniques. Therefore, improved techniques are needed. We argue the need for correlating data among different logs to improve intrusion detection systems accuracy. We show how different attacks are reflected in different logs and argue that some attacks are not evident when a single log is analyzed. We present experimental results using anomaly detection for the virus Yaha. Through the use of data mining tools (RIPPER) and correlation among logs we improve the effectiveness of an intrusion detection system while reducing false positives.

Download

Searching for open windows and unlocked doors: port scanning in large-scale commodity clusters

CCGrid 2005. IEEE International Symposium on Cluster Computing and the Grid, 2005., 2005

Current methods for monitoring the security of largescale commodity clusters tend to treat these ... more Current methods for monitoring the security of largescale commodity clusters tend to treat these clusters as nothing more than collections of independent nodes. As such, the techniques used to secure these clusters have, for the most part, been adaptations of techniques developed for securing and monitoring enterprise computing environments. We have previously proposed the idea of monitoring the security-state of large-scale commodity clusters by examining their emergent properties, that is, properties that are only visible when one ceases to look at a cluster as a collection of disparate nodes and begins to look at the properties of the cluster as a whole. We show that by correlating the open network ports observed on cluster nodes with other emergent properties-such as active processes and the contents of important system files-security analysts can make insightful observations that can greatly restrict the actions that an attacker can carry out undetected.

Download

Byzantine Anomaly Testing for Charm++: Providing Fault Tolerance and Survivability for Charm++ Empowered Clusters

Sixth IEEE International Symposium on Cluster Computing and the Grid (CCGRID'06), 2006

Recently shifts in high-performance computing have increased the use of clusters built around che... more Recently shifts in high-performance computing have increased the use of clusters built around cheap commodity processors. A typical cluster consists of individual nodes, containing one or several processors, connected together with a highbandwidth, low-latency interconnect. There are many benefits to using clusters for computation, but also some drawbacks, including a tendency to exhibit low Mean Time To Failure (MTTF) due to the sheer number of components involved. Recently, a number of fault-tolerance techniques have been proposed and developed to mitigate the inherent unreliability of clusters. These techniques, however, fail to address the issue of detecting non-obvious faults, particularly Byzantine faults. At present, effectively detecting Byzantine faults is an open problem. We describe the operation of ByzwATCh, a module for run-time detecting Byzantine hardware errors as part of the Charm++ parallel programming framework.

Download

Tool update

Proceedings of the 3rd international workshop on Visualization for computer security, 2006

ABSTRACT This paper highlights major enhancements made to the security visualization tool -- VisF... more

<title>A survey and comparison of multi-ring techniques for scalable battlespace group communications</title>

Defense Transformation and Network-Centric Systems, 2005

Ring-based network overlays have attractive characteristics for group communications such as inhe... more Ring-based network overlays have attractive characteristics for group communications such as inherent reliability and single fault-tolerance. However, ring networks also generally have longer paths and thus higher delay and delay jitter. In order to provide scalability as the number of group members grows, large single rings may be broken into smaller multi-rings interconnected together at the same level or interconnected in a multi-level hierarchy of rings. In this paper we consider different approaches to providing scalable battlespace group communications using multi-ring techniques -classifying the techniques according to the primary military requirements of security and survivability. For multi-rings at the same level, an optimal number of rings to cover the group members may be approximated and these rings may then be interconnected at end systems or bridged via network devices. For hierarchical rings the number of levels and the number of rings per level may both be approximated. These results are dependent on application QoS demands and the underlying network infrastructure in terms of topology (dense versus sparse) and link bandwidths (bottleneck capacities). Network-centric warfare is not simply a combination of communication, intelligence, and signals, but rather warfare that leverages off a common network to support different purposes. While group communications based on a single virtual ring overlay may satisfy the most important requirements for survivability and security, scalability may force redesign. Thus comparing the characteristics of different multi-ring techniques provides an insight into which battlespace applications may be supported via virtual rings.

Download

Network intrusion detection cognitive task analysis: Textual and visual tool usage and recommendations

PsycEXTRA Dataset

A task analysis is conducted for the complex task of network security engineers, intrusion detect... more A task analysis is conducted for the complex task of network security engineers, intrusion detection (ID) of computer networks. ID helps engineers protect network from harmful attacks and can be broken down into the following phases: pre-processing information, monitoring the network, analyzing attacks, and responding to attacks. Different cognitive loads are placed on the engineer at each phase. Engineers also need to integrate information from a variety of tools and resources, which adds additional cognitive workload. Visualization tools have been developed to alleviate these workloads but they have had limited success. To address this problem, we make two recommendations: (1) these tools should be designed for use across the phases of ID; this reduces the number of resources used therefore reducing the workload of integrating information across sources, and (2) visualization tools should allow concurrent use of textual tools and resources that provide detailed information and a powerful interface.

A virtual private network deployment framework

Proceedings 25th Annual IEEE Conference on Local Computer Networks. LCN 2000, 2000

Applications. There is a broad spectrum of VPN options available with each having its own strengt... more Applications. There is a broad spectrum of VPN options available with each having its own strengths, weaknesses, and vulnerabilities. It is anticipated that no single VPN solution will supplant others but instead a diversity of choices will continue to emerge thus increasing the value of an advanced planning framework.

Download

A survivability framework for connection-oriented group communications

Proceedings. 2000 Pacific Rim International Symposium on Dependable Computing

This paper presents a framework for providing survivability to group communications where part of... more This paper presents a framework for providing survivability to group communications where part of the underlying trafsic layer infrastructure is connectionoriented. The framework is multi-layered to express the virtual overlays inherent to networked systems, describes survivability issues unique to group communications, and outlines tradeoffs between restoration techniques that can be extended from circuit-switched communications. The conclusion is disjoint dedicated backup route sets to provide survivability for connection-oriented group communications is preferable but more research needs to be done on coordination between layers ana! scalable techniques within the survivability framework presented.

Download

A survey and comparison of peer-to-peer group communication systems suitable for network-centric warfare

SPIE Proceedings, 2005

In this paper we describe state-of-the-art peer-to-peer systems and analyze them according to mul... more In this paper we describe state-of-the-art peer-to-peer systems and analyze them according to multiple characteristics highlighting (1) scalability, (2) security and (3) fault tolerance. Peer-to-Peer systems are inherently scalable since they create fully decentralized environments across the Internet while simultaneously reducing complexity because each server handles a local set of clients. Peer-to-peer system security has depended primarily on user trust -the fact that any peer can contact any other peer in the system introduces issues of insider attacks from malicious users or external attacks through the Internet. Lastly, while peer-to-peer systems are evolving in response to peer unreliability, fault tolerance/survivability for general-purpose military group communications may require additional middleware. Comparing these characteristics across different peer-to-peer systems is a step towards understanding which system may be appropriate for military group communications and where further research is needed. A secondary result of our comparison is an attempt to move towards common terminology and models between peer-to-peer, application-layer multicast, IP layer multicast, and distributed systems approaches for group communications.

Download

VRing: a case for building application-layer multicast rings (rather than trees)

The IEEE Computer Society's 12th Annual International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems, 2004. (MASCOTS 2004). Proceedings.

This paper presents the design, analysis and performance evaluation of VRing, a novel application... more This paper presents the design, analysis and performance evaluation of VRing, a novel application-layer multicast (ALM) protocol that establishes a virtual ring as an overlay network among the multicast group members in a self-organizing and distributed manner. In order to reduce the routing delay of the ring overlay network, we propose to form a spare ring overlay structure that improves connectivity among group members. The design of the spare ring is justified by proposing, and analytically studying the performance of, a data delivery and duplicate suppression mechanism that makes use of both the original ring and the spare ring for forwarding data packets. We conduct simulations of both VRing and a hierarchical ALM protocol, NICE, using the J-Sim network simulator. Simulation results show that although VRing has a higher path stretch and a higher link stress than NICE, it provides less control overhead, consumes less bandwidth, and provides lower average node degree than NICE. Furthermore, VRing achieves a higher average data delivery ratio in the presence of failures than NICE. The performance improvement is especially pronounced for larger multicast groups.

Download

Teaching computer organization/architecture with limited resources using simulators

ACM SIGCSE Bulletin, 2002

As the complexity and variety of computer system hardware increases, its suitability as a pedagog... more As the complexity and variety of computer system hardware increases, its suitability as a pedagogical tool in computer organization/architecture courses diminishes. As a consequence, many instructors are turning to simulators as teaching aids, often using valuable teaching/research time to construct them. Many of these simulators have been made freely available on the Internet, providing a useful and time-saving resource for other instructors. However, finding the right simulator for a particular course or topic can itself be a time-consuming process. The goal of this paper is to provide an easy-to-use survey of free and Internet-accessible computer system simulators as a resource for all instructors of computer organization and computer architecture courses.

Download

Visualization Tools for Security Administrators

Lecture Notes in Computer Science, 2004

System Administrators are users too! While the focus of human-computer interaction in security ha... more System Administrators are users too! While the focus of human-computer interaction in security has to this point in time been on end-users, an important class of users who manage networked systems should not be ignored. In fact, system administrators may have more effect on security than individual users since they manage larger systems on behalf of users. End-users have become dependent upon the availability of services such as network-attached storage, authentication servers, web servers, and email gateways. These Internet-scale services often have thousands of hardware and software components and require considerable amounts of human effort to plan, configure, install, upgrade, monitor, troubleshoot, and sunset. The complexity of managing these services is alarming in that a recent survey of three Internet site showed that 51% of all failures are caused by operator errors [1].

FABS: file and block surveillance system for determining anomalous disk accesses

Proceedings from the Sixth Annual IEEE Systems, Man and Cybernetics (SMC) Information Assurance Workshop, 2005.

Despite increasingly sophisticated security measures, attackers have continued to find ways to ga... more Despite increasingly sophisticated security measures, attackers have continued to find ways to gain access to stored data with impacts including data disclosure, modification, or deletion. There currently exist no tools independent of the operating system to monitor storage status. The authors introduced FABS as a comprehensive tool to monitor storage for anomalous accesses. A scalable GUI prototype, VisFlowConnect-SS, which represents

A survey and comparison of end-system overlay multicast solutions suitable for network-centric warfare

SPIE Proceedings, 2004

Multicasting at the IP layer has not been widely adopted due to a combination of technical and no... more Multicasting at the IP layer has not been widely adopted due to a combination of technical and non-technical issues. End-system multicast (also called application-layer multicast) is an attractive alternative to IP layer multicast for reasons of user management (set-up and control) and attack avoidance. Sessions can be established on demand such that there are no static points of failure to target in advance. In end-system multicast, an overlay network is built on top of available network services and packets are multicasted at the application layer. The overlay is organized such that each end host participating in a multicast communication re-sends multicasted messages to some of its peers, but not all of them. Thus end-system multicast allows users to manage multicast sessions under varying network conditions without being dependent on specific network conditions or specific network equipment maintaining multicast state information. In this paper we describe a variety of proposed end-system multicast solutions and classify them according to characteristics such as overlay building technique, management, and scalability. Comparing these characteristics across different end-system multicast solutions is a step toward understanding which solutions are appropriate for different battlespace requirements and where further research is needed.

Download

Reputation and Dispute in eBay Transactions

International Journal of Electronic Commerce, 2005

How computers really work

Proceedings of the 2002 workshop on Computer architecture education Held in conjunction with the 29th International Symposium on Computer Architecture - WCAE '02, 2002

) 1 7s e §) 1¦ B5 g! 9g h¦ ©( B {$ a §D y¦ B| A(

Download

A Survey and Comparison of Human Monitoring of Complex Networks

Download

On integrating human-in-the-loop supervision into critical infrastructure process control systems

ABSTRACT

Ethical hacking: the security justification redux

IEEE 2002 International Symposium on Technology and Society (ISTAS'02). Social Implications of Information and Communication Technology. Proceedings (Cat. No.02CH37293)

Download

Sharing computer network logs for security and privacy: a motivation for new methodologies of anonymization

Workshop of the 1st International Conference on Security and Privacy for Emerging Areas in Communication Networks, 2005.

Download

Log correlation for intrusion detection: a proof of concept

19th Annual Computer Security Applications Conference, 2003. Proceedings.

Download

Searching for open windows and unlocked doors: port scanning in large-scale commodity clusters

CCGrid 2005. IEEE International Symposium on Cluster Computing and the Grid, 2005., 2005

Download

Byzantine Anomaly Testing for Charm++: Providing Fault Tolerance and Survivability for Charm++ Empowered Clusters

Sixth IEEE International Symposium on Cluster Computing and the Grid (CCGRID'06), 2006

Download

Tool update

Proceedings of the 3rd international workshop on Visualization for computer security, 2006

ABSTRACT This paper highlights major enhancements made to the security visualization tool -- VisF... more

<title>A survey and comparison of multi-ring techniques for scalable battlespace group communications</title>

Defense Transformation and Network-Centric Systems, 2005

Download

Network intrusion detection cognitive task analysis: Textual and visual tool usage and recommendations

PsycEXTRA Dataset

A virtual private network deployment framework

Proceedings 25th Annual IEEE Conference on Local Computer Networks. LCN 2000, 2000

Download

A survivability framework for connection-oriented group communications

Proceedings. 2000 Pacific Rim International Symposium on Dependable Computing

Download

A survey and comparison of peer-to-peer group communication systems suitable for network-centric warfare

SPIE Proceedings, 2005

Download

VRing: a case for building application-layer multicast rings (rather than trees)

The IEEE Computer Society's 12th Annual International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunications Systems, 2004. (MASCOTS 2004). Proceedings.

Download

Teaching computer organization/architecture with limited resources using simulators

ACM SIGCSE Bulletin, 2002

Download

Visualization Tools for Security Administrators

Lecture Notes in Computer Science, 2004

FABS: file and block surveillance system for determining anomalous disk accesses

Proceedings from the Sixth Annual IEEE Systems, Man and Cybernetics (SMC) Information Assurance Workshop, 2005.

A survey and comparison of end-system overlay multicast solutions suitable for network-centric warfare

SPIE Proceedings, 2004

Download

william yurcik

Related Authors

Uploads

Papers by william yurcik

Log In