Integrity of the cloud is the most important requirement for mission-critical enterprise workloads. NIST SP 800–53 states that information systems must prevent the installation of any components that have not been verified digitally with a signed certificate that is recognized and approved by the organization's information system. On a Kubernetes cluster, the admission controller can control requests for application installation, and it would be a powerful protection tool if it could control requests for Kubernetes resources based on signature verification. However, there are various technical challenges when it comes to verifying the signature for a Kubernetes resource at the admission controller because a signed resource is rewritten automatically by internal cluster work and many requests that include internal mutation without a signature are generated. In this work, we propose an approach to protect the integrity of a Kubernetes resource with signature verification at the admission controller. Our approach addresses the issue that the differences between the signed resource in the admission request and the signature message occur automatically in Kubernetes and conducts signature verification properly by using Dry Run. We also propose a profile framework to address the internal mutation request that cannot be attached to the signature. Our experimental results demonstrate that standard applications can be protected by our approach.

Enterprises adopting cloud increasingly use container orchestration systems (e.g., Kubernetes) to manage applications and their configurations at scale. In Kubernetes environment, developers use package managers (e.g., Helm) for bundling, distributing, and deploying applications. These developments in cloud native applications have introduced new challenges. One of the challenges is protecting the integrity of application packages (e.g., Helm chart) deployed in a large-scale enterprise cluster. Existing tools for verifying integrity of Helm charts are limited to verify provenance and integrity of application packages. Therefore, in this work, we propose a mechanism to verify provenance and integrity of Helm charts at the cluster-side by addressing the granularity gap to verify each resource in a chart. We demonstrate how our approach successfully enforces integrity of Helm charts and evaluate the cost of integrity enforcement with a preliminary study.

Container integrity monitoring is defined as key requirements for regulatory compliance, such as PCI-DSS, in which any unexpected changes such as file updates or program runs must be logged for later audit. Syscall monitoring provides comprehensive monitoring of such change events on container, while it suffered from large amount of false alarms unless well-defined allowlist rules are coordinated before deploying container. Defining such comprehensive allowlist is not feasible especially when managing various kinds of application workloads in large-scale enterprise cluster. We propose new approach for identifying real anomaly of syscall events effectively without relying on any predefined allowlist configuration in this paper. Our novel filtering algorithm based on the knowledge acquired autonomously from Kubernetes cluster control plane reduces 99.999 % noise effectively and distilling only abnormal events in real time. Our experiment with real applications on more than 4000 containers demonstrates its effectiveness even on large-scale cluster.

Registering altered domain names with the purpose of confusing users and conducting malicious activities is one of the most widespread types of attacks on the Web, conforming a family of techniques known as domain squatting. Detecting these domains is a difficult task, given the large a mount of combinations and the massive and heterogeneous nature of the Web. In this work, we propose a set of models to firstly learn the distributional regularities from detected squatted domains, and from that, automatically generate realistic modified domains. Our goal is to proactively guide the generation of squatted domains towards malicious domains that exists but have not been detected yet. We conducted an empirical study for both typo-squatting and combo-squatting generation approaches against strong baselines on real world data, showing their feasibility and providing insights to support for proactive defense in the context of cloud security.

In software development, bug localization is the process finding portions of source code associated to a submitted bug report. This task has been modeled as an information retrieval task at source code file, where the report is the query. In this work, we propose a model that, instead of working at file level, learns feature representations from source changes extracted from the project history at both syntactic and code change dependency perspectives to support bug localization.

We present a new framework for conducting controlled driving behavior studies based on multiuser networked 3-D virtual environments. The framework supports: 1) the simulation of multiuser immersive driving; 2) the visualization of surrounding traffic; 3) the specification and creation of reproducible traffic scenarios; and 4) the collection of meaningful driving behavior data. We use our framework to investigate the “rubbernecking” phenomenon, which refers to the slowing down of a driver due to an accident on the opposite side of the road, and its effect on the following drivers. The main contribution of the paper is the Scenario Markup Language (SML) framework, which is composed of: 1) the SML as a practical tool to specify dynamic traffic situations (e.g., an accident) and 2) the Scenario Control System to ensure the reproducibility of particular traffic situations, so that traffic engineers can obtain comparable data and draw valid conclusions. To demonstrate the effectiveness of our framework, we specified the traffic accident scenario in SML and conducted a study about the rubbernecking phenomenon. We report on the results of our study from two viewpoints: 1) the reproducibility of the traffic accident situation (i.e., state variables of interest are recreated successfully in 78% of the cases); and 2) the interactive car-following behavior of human subjects embedded in the traffic situation of the virtual environment.

We present the Scenario Markup Language (SML), a powerful language for authoring realistic traffic situations. This effort is part of a novel framework for automatically generating complex scenarios with static and dynamic elements. SML facilitates the scripting of behavioral driver studies in networked multi-user online three-dimensional (3D) virtual worlds.

We developed an augmented reality (AR) dental training simulator utilizing a haptic (force feedback) device. A number of dental procedures such as crown preparation and opening access to the pulp can be simulated with various shapes of dental drill. The system allows students to practise surgery in the correct postures as in the actual environment by combining 3D tooth and tool models upon the real-world view and displaying the result through a video see-through head mounted display (HMD). The system monitors the important features such as applied forces and tool movement that characterize the quality of the procedure. Automatic performance assessment is achieved by comparing outcome and process features of a student with the best matching expert. Moreover, we incorporated kinematic feedback and hand guidance by haptic device. The result from an initial evaluation shows that the simulator is promising for supplemental training.

The sharing of academic knowledge through printed publications has been widely and successfully utilized for more than a hundred years. However, the need to process huge amounts of data in scientific analysis and communicate its results to the scientific community has presented a big challenge for researchers in the data-intensive era. In addition to providing accurate and flexible graphical representations of data, the entire research process should ideally be made verifiable by peers. While web-based tools have been proposed to address this problem, most of them lack important features for scientific work such as real-time collaboration, powerful multimedia visualization and interaction, and environment persistency. Therefore, in this paper, we will propose the use of virtual world technology to address these issues. In particular, we will give an overview of the different methods that we have implemented in the context of multimedia interaction, which is considered the most critical factor in the development of virtual worlds as sound platforms for human-centered multimedia systems.

We have developed a virtual reality (VR) and an augmented reality (AR) dental training simulator utilizing a haptic device. The simulators utilize volumetric force feedback computation and real time modification of the volumetric data. They include a virtual mirror to facilitate indirect vision during a simulated operation. The AR environment allows students to practice surgery in correct postures by combining the 3D tooth and tool models with the real-world view and displaying the result through a video see-through head-mounted display (HMD). Preliminary results from an initial evaluation show that the system is a promising tool to supplement dental training and that there are advantages of the AR over the VR approach.