Regulated compliance has become a business liabil-ity given the constant changes to the IT environments driven by the new Cloud normal enabling daily upgrades, and by the new programs related to cybersecurity. To keep pace with the changes, enterprises and auditor agencies shifted from annual audit to continuous compliance. Critical enablers of continuous compliance are standardization and automation. To achieve this, we need to treat everything as code, from the compliance artifacts to the policies and their results. Currently, Compliance as Code (CaC) is utilized to represent compliance artifacts and processes, while Policy as Code (PaC) is employed to express the logic of validating the actual state of the systems against the desired state. Although there is emerging technology for codifying compliance and policy, there are challenges that hinder the compliance digitization transformation towards continuous compliance. The first challenge is how to migrate from document-based operations to the program-based operations. The second challenge arises from the disconnect between CaC and the varied native interfaces of existing PaC solutions. Lastly, there is a concern regarding the reliability of results from end-to-end automation when replacing human-in-the-loop overseeing and guaranteeing the integrity with fully automated process. To address these challenges, we have developed a GitOps-based secure pipeline framework, seamlessly integrating compliance authoring with CaC while ensuring the secure integration of Compliance as Code and Policy as Code, protecting data integrity and preserving data traceability. In this paper, we present the details of the framework which enables end-to-end automation of compliance processes while supporting integration with various Policy Validation Points (PVPs), and showcase the evaluation of our implemented solution's reliability by testing risks such as unintentional modification of policies.

Automation of cybersecurity processes has become crucial with large scale deployment of sensitive workloads in regulated on-prem, private, and public cloud environments. Regulatory and standards bodies such as Payment Card Industry (PCI), Federal Financial Institutions Examination Council (FFIEC), International Organization for Standardization (ISO), and others govern the minimal set of cybersecurity controls that an organization must implement. To meet such requirements while maintaining business agility, organizations need to modernize from manual document based compliance management to automated processes for continuous compliance. This modernized process is called compliance-as-code. In this paper, we present an architecture for compliance-as-code based on a standardized framework. We identify several design choices and our rationale behind those. Specifically, we introduce a system for manipulating compliance information in a standardized manner and a data interchange protocol for inter-operable communication of compliance information. We demonstrate the scalability of our approach and briefly describe deployment and experimental results in real world settings.

Webscale services dealing with sensitive content are increasingly being deployed in public and hybrid cloud environments. At the same time, the impact of security breaches have also increased manifold averaging at USD 3.86M per data breach. To tackle such increasing risks, regulations and security frameworks are defined that an organization must comply with. Most of these frameworks are published in natural language text that run into hundreds of pages resulting into thousands of requirements and controls. When these frameworks undergo revisions, understanding the changes, and interpreting their impact consumes huge amount of time, effort and resources. In this paper, we propose a change management system that supports SMEs with AI-assisted automation of this extremely manual and time consuming activity. Specifically, we introduce the concept of live crosswalks – a framework that models complex relationships among security and compliance documents along with associated operations to manage the change. It uses natural language processing (NLP) and algorithmic techniques to transform the current document-driven, highly manual process into a data-driven interactive intelligent system. We present the overall design and demonstrate its efficacy over several hundreds of diversified controls through experimental evaluation.

Data privacy, security and compliance concerns prevent many enterprises from migrating their critical applications to public cloud infrastructure. To address this, cloud providers offer specialized clouds for heavily regulated industries, which implement prescribed security standards. A critical step in the migration process is to ensure that the customer's security requirements are fully met by the cloud provider. With a few hundreds of services in a typical cloud provider's infrastructure, this becomes a non-trivial task. Few tens to hundreds of security checks exposed by each applicable service need to be matched with several hundreds to thousands of security controls from the customer. Mapping customer's controls to cloud provider's control set is done manually by experts, a process that often takes months to complete, and needs to be repeated with every new customer. Moreover, these mappings have to be re-evaluated following regulatory or business changes, as well as cloud infrastructure upgrades. We present an AI-assisted system for mapping security controls, which drastically reduces the number of candidates a human expert needs to consider, allowing substantial speed-up of the mapping process. We empirically compare several controls mapping models, and show that hierarchical classification using fine-tuned Transformer networks works best. Overall, our empirical results demonstrate that the system performs well on real-world data.

Mobile browsing habits are characteristically different from browsing on traditional devices. Mobile users often look for information snippets instead of complete web pages. Also, mobile devices are often constrained in terms of resource availability, such as battery, data plan limits and network bandwidth. Under such constraints, partial-loading of a web page, by loading the most relevant content snippets early, can satisfy the user and consume less resources. Mobile content adaptation middleware has traditionally focused on user factors, such as user feedbacks and user context. We believe that the content creator, with complete knowledge of the importance of each item in the web page, is well-suited to guide the adaptation process. Combining user choice, and ratings assigned by the content creator to different web page elements (items), enables delivering the most relevant items in an ordered manner in response to a page request. We present ScoDA, a cooperative content adaptation middleware framework, under resource constraints. We evaluate the effectiveness of page loading using ScoDA, on simulated complex web pages as well as real web pages.

There is tremendous interest in exploiting smartphones as a “community of sensors”. It is envisioned that this community-driven smartphone sensor network has unprecedented potential to sense heterogeneous phenomena ranging from sound pollution to urban social dynamics. However, designing smartphone-resident middleware for opportunistic and objectiveoriented sensing of these phenomena is an open challenge. In this paper, we propose USense, a novel utility-driven smartphone middleware for executing community-driven sensing tasks. USense is different from other mobile phone sensing frameworks in the following ways: it is (i) Application aware, i.e., it adapts its operation based on demands of the application (ii) User aware, i.e., it incorporates preferences, policies as well as behavioral history of the user carrying the phone, and (iii) Situation aware, i.e. it considers resource dynamics on the phone at any given point. We argue that these three aspects are essentially decoupled in nature and combining them effectively is the key towards designing a re-usable and scalable middleware. Based on an extensible model for `Sensing Moments', USense first allows application developers to easily create sensing tasks. Secondly, we propose a unified device middleware to simultaneously execute the sensing tasks at the right moments across multiple applications. We have implemented USense on the Android platform, and demonstrate its effectiveness through real-life data traces.

With rapid advancement in the capabilities of mobile phones, there has been a tremendous increase in the development and use of mobile applications in recent times. Surprisingly, Telecom operators have not been prominent players in the success of mobile applications and the corresponding mobile Application Stores. We argue that, to offset this going forward, Telecom operators can utilize some of their core strengths to create differentiated Application Stores that will help them compete effectively with their competitors. More specifically, Telecom operators have access to unique data which is not available elsewhere, this can be used to give new insights on their customers and offer them relevant mobile applications. In this paper, we present techniques on how applications can be promoted effectively from a Telecom Application Store utilizing the users' location, their Telecom profiles as well as their social relationships derived from their calling patterns. Moreover, we provide a bidding platform that gives control to developers for highlighting their application by placing bids on multiple Telecom parameters.

Web services composition environment is highly dynamic with new services being deployed, existing ones becoming unavailable or their QoS and other non-functional properties (cost, availability, etc.) changing dynamically. However, current approaches for web services composition and execution, such as WS-BPEL, can neither tailor the execution automatically as per the required QoS nor can they adapt to the highly dynamic environment. Though there have been some recent efforts in this direction they are piecemeal and insufficient. They either do not take user's non-functional requirements (NFRs) into consideration for adaptation, or there is no standard way of specifying these requirements for a BPEL process. In this paper, we propose an integrated approach for dynamically adapting web service compositions based on NFRs. We first give a specification for representing NFRs for each partner service of a BPEL process, and then describe a system that dynamically adapts the BPEL process based on these requirements by selecting suitable services at runtime. The selected services only need to be semantically equivalent and the system automatically takes care of the syntactical differences between their interfaces. We integrated our system in an existing BPEL engine using aspect oriented approach and demonstrate via experiments that it has very little performance overhead even at high loads.

Stream computing research is moving from terascale to petascale levels. It aims to rapidly analyze data as it streams in from many sources and make decisions with high speed and accuracy in fields as diverse as security surveillance and financial services including stock trading. We specifically consider real-time text indexing and search with high input data rates (10 GB/s or more) along with small index age-off (expiry) time. This makes it necessary to have maximal indexing rates for large volumes of data as well as minimal latency for indexing (time between start of indexing for a document and its availability for search) while maintaining very-low search response time. In addition, future massively parallel architectures with storage class memories will enable high speed in-memory real-time indexing, where index can be completely stored in a high capacity storage class memory. In this paper, we present the design of distributed data-structures and distributed real-time text indexing algorithm for parallel systems having large (thousands to hundred thousand) number of cores/processors, while simultaneously providing acceptable search performance [1]. The inherent trade-offs involved in index space, indexing throughput and search response time make this problem particularly challenging. Our algorithm uses group-based index construction and leverages novel index data structures that reduce load imbalance and make text indexing and merge process more scalable and efficient. We show analytically that the asymptotic parallel time complexity of our distributed indexing algorithm, is at least ?(log(P)) factor better than typical indexing approaches, where P is the number of indexing nodes in a group. We further demonstrate the performance and scalability of our distributed indexing algorithm, on an MPP architecture (Blue Gene/L) using actual IBM intranet data. We achieved high indexing throughput of around 312 GB/min on an 8 K node Blue Gene/L machine. In comparison with parallel indexing implemented using typical approaches like CLucene, this is 3?-7? better. To the best of our knowledge, this is the first published result on indexing throughput at such a large scale, with sustained search performance. We further show that our approach is scalable to 128 K nodes, giving an estimated indexing throughput of 5 T B/min. We also achieved indexing latency that is around 10? better than typical indexing approaches.

Management applications such as accounting, intrusion detection, resource provisioning, etc. utilize various metrics to derive information needed for decision making. However, each such application is typically custom built to encode the data manipulation logic specific to the management task at hand. These custom solutions are non-reusable, non-shareable and become increasingly complex and hard to manage as they evolve to meet ever changing needs of the environment. We present metric service, a customizable engine that can be shared and configured to perform data manipulation operations for a wide variety of management applications. It allows application specific manipulation of raw metrics to be performed in the middleware itself and also enables integration of data from heterogeneous systems that may be geographically distributed. We also introduce MS-Policy, an XML based policy specification language that forms the core model of the proposed engine. It allows the data integration and manipulation logic, for a particular management task, to be specified in terms of metrics collection, aggregation and composition. We describe our prototype implementation and report the results of performance experiments

The demand for quickly delivering new applications is increasingly becoming a business imperative today. Application development is often done in an ad hoc manner, without standard frameworks or libraries, thus resulting in poor reuse of software assets. Web services have received much interest in industry due to their potential in facilitating seamless business-to-business or enterprise application integration. A web services composition tool can help automate the process, from creating business process functionality, to developing executable workflows, to deploying them on an execution environment. However, we find that the main approaches taken thus far to standardize and compose web services are piecemeal and insufficient. The business world has adopted a (distributed) programming approach in which web service instances are described using WSDL, composed into flows with a language like BPEL and invoked with the SOAP protocol. Academia has propounded the AI approach of formally representing web service capabilities in ontologies, and reasoning about their composition using goal-oriented inferencing techniques from planning. We present the first integrated work in composing web services end to end from specification to deployment by synergistically combining the strengths of the above approaches. We describe a prototype service creation environment along with a use-case scenario, and demonstrate how it can significantly speed up the time-to-market for new services.

This paper proposes extensions to DMTF's CIM Metrics model and introduces a new CIM schema for representing metering and accounting information. Usage accounting is an essential component infrastructure. It is needed for purposes such as resource provisioning, capacity planning, auditing, and for charging the customers. Though some efforts are underway in this direction, currently there is no standard defined which allows metrics and usage accounting information to be specified in a way that is uniform across management applications. This paper attempts to achieve that by formalizing the concepts involved, through an information model that is independent of the actual metrics used. The proposed information model enriches the CIM Metrics schema with the notions of composite metrics and monitoring records. Further, new classes have been defined to formalize the representation of metering and accounting information. We also describe some applications of the proposed information model.

Microprocessor performance has been improved by increasing the capacity of on-chip caches. However, the performance gain comes at the price of static energy consumption due to subthreshold leakage current in cache memory arrays. This paper compares three techniques for reducing static energy consumption in on-chip level-1 and level-2 caches. One technique employs low-leakage transistors in the memory cell. Another technique, power supply switching, can be used to turn off memory cells and discard their contents. A third alternative is dynamic threshold modulation, which places memory cells in a standby state that preserves cell contents. In our experiments, we explore the energy and performance tradeoffs of these techniques. We also investigate the sensitivity of microprocessor performance and energy consumption to additional cache latency caused by leakage-reduction techniques.

Finding the right set of target customers for a given product is an important problem in business-to-consumer (B2C) e-commerce. We propose an approach to solve this problem based on product attributes. Our approach is based on the assumption that the interest of a customer in a product depends on the customer's interest towards its attributes. We use a collection of membership estimators to compute the degree to which a customer might be interested in a product. Each estimator is based on a particular product attribute, and takes into consideration purchase information about other products that are similar to the given one from the point of view of the attribute. Thus, each estimator generates a membership value for each customer in the target customer set based on a specific attribute. We then use these memberships and other customer information to predict the target customers. Our experimental results show a significant improvement in prediction accuracy when the proposed approach is used.

In this paper we propose a protocol for load sharing among a cluster of heterogeneous Unix workstations. Our protocol called the distributed process management protocol (DPMP), not only enables load sharing using nonpreemptive process migration but also seamlessly integrates the processes running on a network of machines. Remote processes can be accessed (for signalling, for example), in the same way as local processes making process migration highly transparent to the users and the applications. DPMP also has built in mechanisms to detect and recover from node and network failures. DPMP can be implemented at either the kernel or the user level. We also describe an implementation of DPMP within the Linux kernel. Preliminary performance studies show that the performance gains obtained by using DPMP are substantial.

Microprocessor performance has been improved by increasing the capacity of on-chip caches. However, the performance gain comes at the price of increased static energy consumption due to sub-threshold leakage current. This paper compares three techniques for reducing static energy consumption in on-chip level-1 and level-2 caches. One technique employs low-leakage transistors in the memory cell. Another technique, power supply switching can be used to turn off the memory cells and discard their contents. A third alternative is dynamic threshold modulation, which places the memory cells in a standby state that preserves cell contents. In our experiments, we explore the energy/performance trade-offs of these techniques and find that the dynamic threshold modulation achieves the best results for level-1 caches, improving the energy-delay product by 2% in a level-1 instruction cache and 7% in a level-1 data cache. Low-leakage transistors perform best for the level-2 cache as they reduce the static energy by up to 98% and improve the energy-delay product by more than a factor of 50.

The doubling microprocessor performance every three years has been the result of two factors: more transistors per chip and superlinear scaling of the processor dock with technology generation. Our results show that, due to both diminishing improvements in clock rates and poor wire scaling as semiconductor devices shrink, the achievable performance growth of conventional microarchitectures will slow substantially. In this paper, we describe technology-driven models for wire capacitance wire delay, and microarchitectural component delay. Using the results of these models, we measure the simulated performance-estimating both clock rate and IPC-of an aggressive out-of-order microarchitecture as it is scaled from a 250 nm technology to a 35 nm technology. We perform this analysis for three clock scaling targets and two microarchitecture scaling strategies: pipeline scaling and capacity scaling. We find that no scaling strategy permits annual performance improvements of better than 12.5% which is far worse than the annual 50-60% to which we have grown accustomed.