We describe a novel architecture for network defense designed for scaling to very high data rates (100 Gb/s) and very large user populations. Scaling requires both efficient attack detection algorithms as well as appropriate an execution environment. Our architecture considers the time budget of traffic data extraction and algorithmic processing, provides a suite of detection algorithms - each designed to present different and complementary views of the data-that generate many ¿traffic events,¿ and reduces false positives by correlating these traffic events into benign or malicious hypotheses.

Wireless networks of low-power sensing devices are poised to become a ubiquitous part of the computing landscape. Proposed applications of these networks range from health care to warfare. The challenge for the information security community is to develop the common security services (confidentiality, integrity, etc.) for sensor networks in a manner that meets the very strict resource constraints of these devices. This forum will describe a broad range of on-going research efforts in order to acquaint the general information security community with the issues and concerns of sensor net security.

We develop a simple formal model of the Time Warp approach to distributed computation, prove several important properties of the model, and devise some extensions to Time Warp that provide improved termination behavior. Our model consists of processes that communicate solely via message passing. One of the basic process steps is a rollback operation that includes message retraction via transmission of antimessages. In the model, we consider three problems: safety, progress, and termination. By safety, we mean that for a given system of processes, if a run of the system terminates, then the final system state of the run is identical to the final system state of a rollback-free run. We give premises that imply safety, and a counterexample that shows how safety can fail. By progress, we mean that, as a run of a system proceeds, the minimum timestamp of an unprocessed message always eventually increases. We state three axioms that imply the progress property. By termination, we mean that, if all rollback-free runs of a system terminate, then all runs terminate. The termination property is generally false in existing implementations of Time Warp systems due to the possibility of Time Warp vortices. We define additional mechanisms that can guarantee the termination property for most Time Warp applications.

Within the US Department of Defense, developers have been designing and implementing a prototype multilevel secure local area network (MLS LAN). Researchers at MITRE have been cooperating in this development by doing the security modeling. The MLS LAN has special dynamic features, such as the ability to add new security levels during normal operations and to modify label translation schemata, which distinguish it from other secure LANs. These features enhance the functionality of the LAN without compromising its security. The principal features of the MLS LAN are highlighted. Some of the design, implementation, and modeling issues are discussed.>

Turner popularized a technique of Wadsworth in which a cyclic graph rewriting rule is used to implement reduction of the fixed point combinator Y . We examine the theoretical foundation of this approach. Previous work has concentrated on proving that graph methods are, in a certain sense, sound and complete implementations of term methods. This work is inapplicable to the cyclic Y rule, which is unsound in this sense since graph normal forms can exist without corresponding term normal forms. We define and prove the correctness of combinator head reduction using the cyclic Y rule; the correctness of normal reduction is an immediate consequence. Our proof avoids the use of infinite trees to explain cyclic graphs. Instead, we show how to consider reduction with cycles as an optimization of reduction without cycles.

According to a theorem of Fischer, Lynch, and Paterson [2], there is no algorithm for binary consensus decisions in a totally asynchronous distributed system of mortal processes, i.e., processes that are subject to deaths (unannounced failstop faults).Until recently, this result seems to have been interpreted to mean that to-talIy asynchronous systems are incapable of fault-tolerant decision making, and therefore of accomplishing nontrivial tasks determinist icalIy.The primary objective of this paper is to show that the ability or inability of a totally asynchronous distributed system to make decisions despite process deaths depends largely on the kinds of decisions to be made.On the one hand, we show that a broad class of decisions-including not only consensus, but all decisions enabling a system to adapt to the loss of data known only to faulty processes-cannot be made.On the other hand, we show that some types of This work was supported by the U. S.

A strong partition cardinal is an uncountable well-ordered cardinal κ such that every partition of [κ]κ (the size κ subsets of κ) into less than κ many pieces has a homogeneous set of size κ. The existence of such cardinals is inconsistent with the axiom of choice, and our work concerning them is carried out in ZF set theory with just dependent choice (DC). The consistency of strong partition cardinals with this weaker theory remains an open question. The axiom of determinacy (AD) implies that a large number of cardinals including ℵ1 have the strong partition property. The hypothesis that AD holds in the inner model of constructible sets built over the real numbers as urelements has important consequences for descriptive set theory, and results concerning strong partition cardinals are often applied in this context. Kechris [4] and Kechris et al. [5] contain further information concerning the relationship between AD and strong partition cardinals. We assume familiarity with the basic results on strong partition cardinals as developed in Kleinberg [6], [7], [8] and Henle [2]. Recall that a strong partition cardinal κ is measurable; in fact every stationary subset of κ is measure one under some normal measure on κ. If μ is a countably additive ultrafilter extending the closed unbounded filter on κ, then the length of the ultrapower [κ]κ under the less than almost everywhere μ ordering is again a measurable cardinal. In §1 below we establish a polarized partition property on these measurable cardinals.

Let λ be an ordinal less than or equal to an infinite cardinal κ. For S ⊂ κ, [S]λ denotes the collection of all order type λ subsets of S. A set X ⊂ [κ]λ will be called Ramsey iff there exists p ∈ [κ]κ such that either [p]λ ⊂ X or [p]λ ∩ X = ∅. The set p is called homogeneous for X. The infinite Ramsey theorem implies that all subsets of [ω]n are Ramsey for n < ω. Using the axiom of choice, one can define a non-Ramsey subset of [ω]ω. In [GP], Galvin and Prikry showed that all Borel subsets of [ω]ω are Ramsey, where one topologizes [ω]ω as a subspace of Baire space. Silver [S] proved that analytic sets are Ramsey, and observed that this is best possible in ZFC. When κ > ω, the assertion that all subsets of [κ]n are Ramsey is a large cardinal hypothesis equivalent to κ being weakly compact (and strongly inaccessible). Again, is not possible in ZFC to have all subsets of [κ]ω Ramsey. The analogy to the Galvin-Prikry theorem mentioned above was established by Kleinberg, extending work by Kleinberg and Shore in [KS]. The set [κ]ω is given a topology as a subspace of κω, which has the usual product topology, κ taken as discrete. It was shown that all open subsets of [κ]ω are Ramsey iff κ is a Ramsey cardinal (that is, κ → (κ)<ω). In this note we examine the spaces [κ]λ for κ ≥ λ ≥ ω. We show that κ Ramsey implies all open subsets of [κ]λ are Ramsey for λ < κ, and that if κ is measurable, then all open subsets of [κ]κ are Ramsey. Let us remark here that we can with the same methods prove these results with “κ-Borel” in the place of “open”, where the κ-Borel sets are the smallest collection containing the opens and closed under complementation and intersections of length less than κ. Also, although here we consider just subsets of [κ]λ, it is no more difficult to show that partitions of [κ]λ into less than κ many κ-Borel sets have, under the appropriate hypothesis, size κ homogeneous sets.