In this paper we describe a new approach to implementing network protocols that enables them to have high performance and high flexibility, while retaining complete conformity to existing application programming interfaces. The key insight behind our work is that an application's interface to the network is distinct and separable from its interface to the operating system. We have separated these interfaces for two protocol implementations, TCP/IP and UDP/IP, running on the Mach 3.0 operating system and UNIX server. Specifically, library code in the application's address space implements the network protocols and transfers data to and from the network, while an operating system server manages the heavyweight abstractions that applications use when manipulating the network through operations other than send and receive. On DECstation 5000/200 This research was sponsored in part by the Advanced Research Projects Agency, Information Science and Technology Office, under the title "Research...

Abstract not found

Government agencies and other organizations have begun to augment their computer security efforts because of increased threats to computer security. Incidents involving these threats, including computer viruses, malicious user activity, and vulnerabilities associated with high technology, require a skilled and rapid response before they can cause significant damage. These increased computer security efforts, described here as Computer Security Incident Response Capabilities (CSIRCs), have as a primary focus the goal of reacting quickly and efficiently to computer security incidents. CSIRC efforts provide agencies with a centralized and cost-effective approach to handling computer security incidents so that future problems can be efficiently resolved and prevented. While the risks to computer security have increased, agencies have also become more dependent on computers. Many systems in widespread use today do not contain safeguards to guarantee protection from these threats. Additionally, as systems become more complex, they are more prone to vulnerabilities that can increase the risk of malicious exploitation. Due to greater availability of computers, users are often de facto system managers, however many have neither

Lately, many approaches have been developed to discover computer abuse. Some of them use data mining techniques to discover anomalous behavior in audit trail, considering this behavior as an intrusive one. This paper discusses a temporal knowledge representation of users' behavior that is used by data mining tools to construct behavior patterns. These are used to decide whether current behavior follows a certain normal pattern or differs from all known users' behavior patterns. The representation uses Allen's temporal interval algebra to describe the temporal relations between events caused by the user. Also we discuss how our representation is used to help in the concept drift when the set of training samples is reduced by removing old data which is no more used for classification.

Computer viruses pose an increasing risk to computer data integrity. They cause loss of valuable data and cost an enormous amount in wasted effort in restoration/duplication of lost and damaged data. Each month many new viruses are reported. As the problem of viruses increases, we need tools to detect them and to eradicate them from our systems. This paper describes a virus detection tool: a generic virus scanner in C ++ with no inherent limitations on the file systems, file types, or host architectures that can be scanned. The tool is completely general and is structured in such a way that it can easily be augmented to recognize viruses across different system platforms with varied file types. The implementation defines an abstract C ++ class, VirInfo, which encapsulates virus features common to all scannable viruses. Subclasses of this abstract class may be used to define viruses that infect different machines and operating systems. The generality of the mechanism allows it to be used for other forms of scanning as well.

This paper describes the ffPYXIS, a versatile name server for distributed environments, which maps object names into ids (independently of their location). This server dynamically supports global or local name spaces, according to system requirements. The server incorporates an authentication engine that, after checking a request, supplies the client with an authentication key. Such a key can be adopted by other servers as a security criterion for further communications with clients. At this time, an operating version of ffPYXIS is available. This version acts as the file name server for the PYXIS distributed file system (Frohlich, 1994), which uses the server authentication capability to validate requests to all other component servers. In that environment, the name server is in charge of supporting a distributed hierarchic naming space visible to the users as a directory tree. Keywords: name server, message authentication, distributed operating system, distributed file system. 1 Int...

96> W Password is not stored in the system l When a user enters the password, system computes F(password); A match provides proof of identity l Inherent vulnerabilities W Easy to guess or snoop W No control on sharing l Practical vulnerabilities W Visible in the clear in distributed and networked systems W Susceptible to replay attacks if encrypted naively 6 Choice of Passwords l Suppose passwords can be from 1 to 8 characters in length l Possible choices for passwords = 26 1 + 26 2 + ... + 26 8 - 26 9 - 1 - 5 *10 12 l At the rate of 1 password per millisecond, it will take on the order of 150 years to test all passwords l However, we don't need to try all possible passwords, only many probable passwords<F6.4

Generally, he who occupies the field of battle first and awaits his enemy is at ease. ⎯ Sun Tzu Many companies connect to the Internet, guarded by "firewalls " designed to prevent unauthorized access to their private networks. Despite this general goal, firewalls span a continuum between ease of use and security. This paper describes some of the considerations and tradeoffs in designing firewalls. A vocabulary for firewalls and their components is offered, to provide a common ground for discussion. Why a Firewall? Against those skilled in the attack, an enemy does not know where to defend. Against the experts in defence, the enemy does not know where to attack. ⎯ Sun Tzu The rationale for installing a firewall is almost always to protect a private network against intrusion. In most cases, the purpose of the firewall is to prevent unauthorized users from accessing computing resources on a private network, and often to prevent unnoticed and unauthorized export of proprietary information. In some cases export of information is not considered important, but for many corporations that are connecting this is a major though possibly unreasoning concern. Many organizations

As networking technologies evolve and business needs change, traditionally isolated and secure communication networks are giving way to more open computing environments. Security, network and systems administrators must therefore concern themselves not only with firewall and boundary security, but also with individual system security. Security administration in a large open network is a challenging assignment and requires a combination of auditing, assessment and compliance mechanisms. For very large networks, automation is another variable which is critical to consider in this equation. There are several tools available to assess the security of networks and systems; however, there are few freely available solutions for addressing the problems that these analysis tools detect. This paper describes the changing network security paradigm and discusses what tools are available for identifying security vulnerabilities in an open network environment. It goes on to state the problem that we faced at Sun and describes the suite of tools that we have designed and implemented as a solution, focusing on the automation of system security assessment and compliance. Finally, SunSWAT, the Sun Security Weakness Attack Tool, is

Networked electronic publication is a relatively new development that has already begun to change the way in which medical information is exchanged. Electronic publications can present ideas that would be impossible in printed text, using multimedia components such as sound and movies. Physicians who use the World Wide Web (WWW) on a regular basis may recognize the value of electronic publication and decide to become information providers. Nearly anyone with a computer and modem can create a WWW resource on a Web server at a hospital or on a commercial hosting service. Medical publication on the Internet demands a high level of quality control because the information will be available to anyone who cares to look. Creating a peer-review system for electronic information may, therefore, help to enhance academic recognition of Internet medical resources. Resources containing medical information must be continually available and protected from system failures and unauthorized access. As Internet technology matures and these problems are solved, electronic publication may become the predominant method of communication between medical professionals.