Opportunistic managed access to local in-network compute resources can improve the performance of distributed applications and reduce the dependence on shared network resources. Instead of backhauling application data to a centralized cloud data center for processing, networked services may be adaptively and continuously dispersed into shared compute resources that are closer to the source of need. While this approach has several benefits, support for mission-aware access to computation is often an afterthought, and is implemented as a brittle extension over traditional load-balancer solutions.In this work, we investigate the design of two priority-aware resource allocation strategies and two load-balancing dispatching strategies as first class citizens in an open-source dispersed computing middleware. We present a control theoretic analysis of these load-balancing primitives to identify weaknesses and strengths in our design, and recommend future directions. In parallel, we prototype two priority-aware allocation algorithms to validate our priority predictions. In initial experiments our prototype shows substantial gains in processing prioritized load. Finally, we make our source-code and experimental configurations open source.

A3 is an execution management environment that aims to make network-facing applications and services resilient against zero-day attacks. A3 recently underwent two adversarial evaluations of its defensive capabilities. In one, A3 defended an App Store used in a Capture the Flag (CTF) tournament, and in the other, a tactically relevant network service in a red team exercise. This paper describes the A3 defensive technologies evaluated, the evaluation results, and the broader lessons learned about evaluations for technologies that seek to protect critical systems from zero-day attacks.

Reliable isolation of malicious application inputs is necessary for preventing the future success of an observed novel attack after the initial incident. In this paper we describe, measure and analyze, Input-Reduction, a technique that can quickly isolate malicious external inputs that embody unforeseen and potentially novel attacks, from other benign application inputs. The Input-Reduction technique is integrated into an advanced, security-focused, and adaptive execution environment that automates diagnosis and repair. In experiments we show that Input-Reduction is highly accurate and efficient in isolating attack inputs and determining casual relations between inputs. We also measure and show that the cost incurred by key services that support reliable reproduction and fast attack isolation is reasonable in the adaptive execution environment.

We present a scalable, hierarchical control system for the dynamic resource management of a distributed real-time embedded (DRE) system. This DRE is inspired by the DARPA adaptive and reflective middleware systems (ARMS) program. The goal of the control system is to simultaneously manage multiple resources and QoS concerns using a utility-driven approach for decision making and performance evaluation. At each level of the control hierarchy there are multiple local controllers which autonomously make decisions to optimize their local utility. The controllers in the hierarchy can use different, localized resource control algorithms and the system's user can tune the operations of the local controllers. We discuss how the selections of local control algorithms affect the behavior of the overall system. The control system is designed to be easily adaptable to other multi-tiered DRE systems.

Abstract Computing systems are increasingly distributed, real‐time, and embedded (DRE) and must operate under highly unpredictable and changeable conditions. A challenging problem for DRE systems is adaptation of behavior and reconfiguration of resources to maintain the best application performance in the face of changes in system load and available resources. To provide predictable mission‐critical quality of service (QoS) end‐to‐end, QoS‐enabled middleware services and mechanisms have begun to emerge, but they lack support for applications with stringent QoS requirements in changing, dynamic environments. This paper presents two contributions to research on adaptive and reconfigurable DRE systems. First, we describe the structure and functionality of an advanced middleware platform for developing applications that apply various techniques to adapt themselves to changes in resource availability to meet real‐time QoS requirements. Second, we present results of a case study of a multimedia application for Unmanned Aerial Vehicle (UAV) video distribution we developed using this middleware platform in conjunction with QoS‐enabledoperating systems and networking protocols. We describe the design of the multimedia application using our middleware platform and report empirical results showing how adaptive behavior and end‐to‐end resource management techniques are used to reconfigure the system dynamically to meet timeliness requirements. Copyright © 2006 John Wiley & Sons, Ltd.

As computer systems become increasingly internetworked, there is a growing class of distributed realtime embedded (DRE) applications that have characteristics and present challenges beyond those of traditional embedded systems. They involve many heterogeneous nodes and links, shared and constrained resources, and are deployed in dynamic environments with changing participants. In this paper, we present a representative DRE application of medium scale that we are developing for the DARPA PCES program. This application consists of several unmanned aerial vehicles, command and control centers, and ground based combat vehicles to perform surveillance, detection, and tracking of time critical targets, an ever increasing threat in today's world. We describe the application, the scenario in which the application is being demonstrated, and issues and challenges associated with developing a DRE application of this complexity.

Distributed real-time and embedded (DRE) systems in which application requirements and environmental conditions may not be known a priori-or which may vary at run-time-can benefit from an adaptive approach to management of quality-of-service (QoS) to meet key constraints, such as end-to-end timeliness. Moreover, coordinated management of multiple QoS capabilities across multiple layers of applications and their supporting middleware can help to achieve necessary assurances of meeting these constraints. We offer two contributions to the study of adaptive DRE computing systems: (1) a case study of our integration of multiple middleware QoS management technologies to manage quality and timeliness of imagery adoptively within a representative DRE avionics system and (2) empirical results and analysis of the impact of that integration on key tradeoffs between timeliness and image quality in that system.

In this paper we present a model-based approach for designing quality of service adaptive applications. We have developed a prototype distributed QoS modeling environment (DQME) that captures important elements of dynamic QoS adaptation at the model level. This modeling environment is designed independent of and can be integrated with, specific application domains to capture their QoS features and adaptation strategies. It combines the domain-specific modeling capability of the generic modeling environment with the QoS adaptation mechanisms of the quality objects middleware framework. DQME captures both the QoS and the functional concerns of distributed real-time embedded systems, and provides clear separation of these two. Integrated code-synthesis tools facilitate code generation and model refinement. We present a signal analyzer case study to demonstrate the use of the DQME modeling tool in real world applications.

Building dependable distributed systems from commercial off-the-shelf components is of growing practical importance. For both cost and production reasons, there is interest in approaches and architectures that facilitate building such systems. The AQuA architecture is one such approach; its goal is to provide adaptive fault tolerance to CORBA applications by replicating objects. The AQuA architecture allows application programmers to request desired levels of dependability during applications' runtimes. It provides fault tolerance mechanisms to ensure that a CORBA client can always obtain reliable services, even if the CORBA server object that provides the desired services suffers from crash failures and value faults. AQuA includes a replicated dependability manager that provides dependability management by configuring the system in response to applications' requests and changes in system resources due to faults. It uses Maestro/Ensemble to provide group communication services. It contains a gateway to intercept standard CORBA IIOP messages to allow any standard CORBA application to use AQuA. It provides different types of replication schemes to forward messages reliably to the remote replicated objects. All of the replication schemes ensure strong, data consistency among replicas. This paper describes the AQuA architecture and presents, in detail, the active replication pass-first scheme. In addition, the interface to the dependability manager and the design of the dependability manager replication are also described. Finally, we describe performance measurements that were conducted for the active replication pass-first scheme, and we present results from our study of fault detection, recovery, and blocking times.

The Quality Objects (QuO) middleware is a set of extensions to standard distributed object computing middleware that is used to control and adapt the quality of service in a number of distributed application environments, from wide-area to embedded distributed applications. This paper compares and contrasts the characteristics of key use cases and the variations in QuO implementations that have emerged to support them. We present these variations in the context of several actual applications being developed using the QuO middleware.

Attack survival, which means the ability to provide some level of service despite an ongoing attack by tolerating its impact, is an important objective of security research. In this paper we present a new approach to survivability and intrusion tolerance. Our approach, which we call "survival by defense" is based on the observation that many applications can be given increased resistance to malicious attack even though the environment in which they run is untrustworthy. This paper describes the concept of "survival by defense" in general and explains the assumptions on which it depends. We will also explain the goals of survival by defense and how they can be achieved.

Recent work in opening up distributed object systems to make them suitable for applications needing quality of service control has had the side effect of increasing the complexity in setting up, configuring, and initializing such applications. Configuration of distributed applications is more complicated than that of non-distributed applications, simply because of the heterogeneous and distributed nature of the application's components. CORBA and other distributed object middleware simplifies the configuration of distributed object applications, but hides much of the information and control necessary to achieve quality of service (QoS). We describe the techniques and tools that we have developed within our Quality Objects (QuO) framework for simplifying the configuration of distributed applications with QoS attributes. We describe a QuO configuration language, as well as the specific configuration needs of particular QoS properties-real-time, security, and dependability-and the support we provide for them.

As networks and the use of communications within applications continue to grow and find more uses, so too does the demand for more control and manageability of various "system properties" through middleware. An important component supporting an integrated property architecture is the concept of an object gateway, which is a quality-of-service (QoS)-aware element transparently inserted at the transport layer between clients and objects to provide managed communication behavior for the particular property being supported. In this paper, we introduce the concept of a QoS-oriented gateway to integrate a variety of QoS enforcement and implementation mechanisms controlling the underlying distributed interactions. We discuss the functions performed by such a component in achieving the desired overall end-to-end QoS, and the design considerations underlying our current implementation. We conclude with experiences to date with two variations of the gateway: one controlling managed latency and throughput using bandwidth allocation, and one controlling dependability through the coordination of object replicas.

Distributed applications are difficult to build and maintain and are even more difficult when the applications are distributed over wide-area networks. Distributed Object Computing middleware has emerged to simplify the building of distributed applications by hiding implementation details behind functional interfaces. However, critical applications have non-functional requirements, such as real-time performance, dependability, or security, that are as important as the functional requirements, but are also hidden by the middleware. Because current distributed object middleware doesn't support these aspects of critical applications, application developers often find themselves bypassing the distributed object systems, effectively gaining little or no advantage from the middleware. We have developed Quality Objects (QuO), a framework for including Quality of Service (QoS) in distributed object applications. QuO supports the specification of QoS contracts between clients and service providers, runtime monitoring of contracts, and adaptation to changing system conditions. A crucial aspect of QuO is a suite of Quality Description Languages for describing states of QoS, system elements that need to be monitored to measure the current QoS, and notification and adaptation to trigger when the state of QoS in the system changes. This paper gives a brief overview of QuO and describes the syntax and semantics of CDL, the component of QDL for describing QoS contracts.

Dependable distributed systems are difficult to build. This is particularly true if they have dependability requirements that change during the execution of an application, and are built with commercial off-the-shelf hardware. In that case, fault tolerance must be achieved using middleware software, and mechanisms must be provided to communicate the dependability requirements of a distributed application to the system and to adapt the system's configuration to try to achieve the desired dependability. The AQuA architecture allows distributed applications to request a desired level of availability using the Quality Objects (QuO) framework and includes a dependability manager that attempts to meet requested availability levels by configuring the system in response to outside requests and changes in system resources due to faults. The AQuA architecture uses the QuO runtime to process and invoke availability requests, the Proteus dependability manager to configure the system in response to faults and availability requests, and the Ensemble protocol stack to provide group communication services. Furthermore, a CORBA interface is provided to application objects using the AQuA gateway. The gateway provides a mechanism to translate between process-level communication, as supported by Ensemble, and IIOP messages, understood by Object Request Brokers. Both active and passive replication are supported, and the replication type to use is chosen based on the performance and dependability requirements of particular distributed applications.

Users and administrators of a small computer often desire more service than it can provide. In a network environment additional services can be provided to the small computer, and in turn to the users of the small computer, by one or more other computers. An operational system for providing such “resource sharing” is described; some “fundamental principles” are abstracted from the experience gained in constructing the system; and some generalizations are suggested.