We describe a specification-based approach to detect exploitations of vulnerabilities in security-critical programs. The approach utilizes security specifications that describe the intended behavior of programs and scans audit trails for operations that are in violation of the specifications. We developed a formal framework for specifying the security-relevant behavior of programs, on which we based the design and implementation of a real-time intrusion detection system for a distributed system. Also, we wrote security specifications for 15 Unix setuid root programs. Our system detects attacks caused by monitored programs, including security violations caused by improper synchronization in distributed programs. Our approach encompasses attacks that exploit previously unknown vulnerabilities in security-critical programs.

A memory-management model based on describing reference behavior in terms of locality-set sequences is proposed. Specialized for fixed-size buffers, this model is used to define the PSETMIN and SETMIN strategies which are proven to minimize the number of page faults in the presence and absence of prepaging, respectively. In contrast to MIN, they are also realizable for certain computations. The methodology for obtaining the locality-set sequence of a computation in advance is illustrated for relational database management systems with multiattribute-index catalogs, and the concomitant performance gains are discussed. In general, for applications that maintain their own organized collections of data, optimal locality-set management of individual computations provides an alternative to the widely used general-purpose strategies based on heuristics.>

The interactive exchange and translation of data between heterogeneuus computer systems depend not only on hardware and op ersting-system characteristics, But also on the proprietary format im- posed by the software systems maintaining it. For functionally com- parable software systems, we present a syntax-driven translation methodology based on environment grammars. Environment gram- mars are related to two-level grammars and attribute grammars, and they lend themselves to the spedflcatbn of parameterized language classes such as those formed by data in different proprietary formats. Under certain constraints they can also be parsed efiiently. We dis- cuss these constraints, demonstrate the use of the methodology for re- lational data, and present the design of a data translator for hetero- geneous relational database management systems. A prototype of this translator has been implemented and used to exchange relations be- tween remote INGRES, Framis, and Sibyl systems.

A widely used error recovery technique in database systems is the rollback and recovery technique.Former models of rollback and recovery assumed Poisson failures and fixed (or exponential) checkpointing intervals.Extending these models, we consider general failure distributions.We also allow checkpointing intervals to depend on the reprocessing time and the failure distribution.Furthermore, failures may occur during checkpointing and error recovery.After deriving a general expression for system availability, we find that system availability resulting from the well-known equidistant checkpointing strategy depends only on the mean of the failure distribution.We then introduce a failure-dependent reprocessing-independent checkpointing strategy called equicost strategy.For Weibull failure distributions, which are good approximations of actual failure distributions of computer systems, we show that the equicost strategy achieves higher system availabilty than the equidistant strategy, which is known to be optimal under Poisson failures.

A widely used error recovery technique in database systems is the rollback and recovery technique. This technique saves periodically the state of the system and records all activities on a reliable log tape. The operation of saving the system state is called checkpointing. The elapsed time between two consecutive checkpointing operations is called checkpointing interval. When the system fails, the recovery process uses the log tape and the state saved at the most recent checkpoint to bring the system to the correct state that preceded the failure. This process is called error recovery and consists of loading the most recent state and then reprocessing all the activities, stored on the log tape, that took place since the most recent checkpoint and prior to failure.

Policy function schedulers provide a flexible framework for specifying the response behavior of a system.The latter is often expressed m terms of a response function, the equihbrmm residence time of a job conditioned on its service requirement Jobs of different classes typically require different responses and thus different pohcy functmns.The relation between a set of policy functions (one per class) and the resulting set of response funcUons is derived for processor-sharing M/G/I systems and a large variety of policy function shapes.Given a set of destrable response functions, this relation may be used to solve the performance synthesis problem.Two types of class notions, one with and one without preemptmn based on externally assigned pnormes, are considered.Plots of correspondmg sets of policy and response funcUons are displayed for specific examples, and the differences caused by the two class types are discussed.

While the adoption of an implementation project for an operating systems course is certainly beneficial, non-trivial projects are inherently demanding in terms of student efforts and computer costs. This paper reports on a project which has been designed to keep the effort for an extensive simulation of a contemporary system within acceptable limits. The project involves both a hardware simulator and an operating system, and a considerable reduction of the overall effort could be achieved by enhancing the hardware with operating systems support features. The design criteria as well as the characteristics of the resulting hardware configuration and operating system are presented, and the value of the project as a teaching tool is discussed