Vulnerability remediation is a critical task in operational software and network security management. In this article, an effective vulnerability management strategy, called VULCON (VULnerability CONtrol), is developed and evaluated. The strategy is based on two fundamental performance metrics: (1) time-to-vulnerability remediation (TVR) and (2) total vulnerability exposure (TVE). VULCON takes as input real vulnerability scan reports, metadata about the discovered vulnerabilities, asset criticality, and personnel resources. VULCON uses a mixed-integer multiobjective optimization algorithm to prioritize vulnerabilities for patching, such that the above performance metrics are optimized subject to the given resource constraints. VULCON has been tested on multiple months of real scan data from a cyber-security operations center (CSOC). Results indicate an overall TVE reduction of 8.97% when VULCON optimizes a realistic security analyst workforce’s effort. Additionally, VULCON demonstrates that it can determine monthly resources required to maintain a target TVE score. As such, VULCON provides valuable operational guidance for improving vulnerability response processes in CSOCs.

The second ACM workshop on cloud data management is held in Denver, Colorado, USA on October 12, 2015 and co-located with the ACM 22nd Conference on Computer and Communications Security (CCS). The main idea of moving-target defense (MTD) is to impose an asymmetric disadvantage on attackers by making systems dynamic and therefore harder to explore and predict. This workshop seeks to bring together researchers from academia, government, and industry to report on the latest research efforts on moving-target defense, and to have productive discussion and constructive debate on this topic. We have constructed an exciting program of 12 referred papers and two invited keynote talks that will give participants a comprehensive view of emerging research.

Discusses the purpose, scope and articles that will appear in the IEEE Transactions on Computational Social Systems.

The Baum-Welch algorithm together with its derivatives and variations has been the main technique for learning hidden Markov models (HMMs) from observational data. We present an HMM learning algorithm based on the nonnegative matrix factorization (NMF) of higher order Markovian statistics that is structurally different from the Baum-Welch and its associated approaches. The described algorithm supports estimation of the number of recurrent states of an HMM and iterates the NMF algorithm to improve the learned HMM parameters. Numerical examples are provided as well.

In this paper, we explore new models for explaining trends in high frequency market data. Market depth information such as volume at different price levels is used to develop more robust prediction models than typical ones learned on aggregate trade data. The latter ignore many of the evolving interactions of the agent based network. In light of this, two learned models incorporating various levels of price depth information are compared with a naive trading strategy. We explore the added value of using market maker network data. The study finds that on average, using information from multiple price levels gives better trend prediction results.

In this article, we formalize the concept of tracking in a sensor network and develop a quantitative theory of trackability of weak models that investigates the rate of growth of the number of consistent tracks given a temporal sequence of observations made by the sensor network. The phenomenon being tracked is modelled by a nondeterministic finite automaton (a weak model) and the sensor network is modelled by an observer capable of detecting events related, typically ambiguously, to the states of the underlying automaton. Formally, an input string of symbols (the sensor network observations) that is presented to a nondeterministic finite automaton, M , (the weak model) determines a set of state sequences (the tracks or hypotheses) that are capable of generating the input string. We study the growth of the size of this candidate set of tracks as a function of the length of the input string. One key result is that for a given automaton and sensor coverage, the worst-case rate of growth is either polynomial or exponential in the number of observations, indicating a kind of phase transition in tracking accuracy. These results have applications to various tracking problems of recent interest involving tracking phenomena using noisy observations of hidden states such as: sensor networks, computer network security, autonomic computing and dynamic social network analysis.

Autonomic computing generally refers to future information processing and networking technologies that are capable of self-awareness for the purposes of self-optimization, self-healing and self-protection. This paper is an overview of the goals, motivations and current status of this technical area, with specific focus on the technical and deployment challenges. Our conclusion is that, while the imperative to develop autonomic computing capabilities is indisputable, the technical and business obstacles are extremely significant. Those obstacles are not being coherently or adequately addressed by the R&D and business communities

Ontologies are developed to describe data semantics on the Semantic Web. Given the distributed nature and scale of the Semantic Web, a large number of ontologies with different terminologies and structures will be created to describe the same concepts and domains. Without semantic mapping, information fluidity within the Web could be blocked at the boundaries of these ontologies. Therefore, ontology mapping is needed to translate datasets represented by disparate ontologies. We believe that over time communities will incrementally build an ontology mapping between select ontologies based on their own communication interests. How will these interest-driven mapping activities eventually change semantic interoperability and information fluidity across the Web? This paper proposes metrics to quantify information fluidity and builds an analytical model with "small-world" graph theory to analyze the growth of the Semantic Web. Further with this model, we analyze how information fluidity can evolve by "market-driven" semantic mapping activities occurring across the Web. Our results can be useful in evaluating mapping efforts needed for large-scale heterogeneous information systems. One conclusion, based on this model, is that the development of decentralized ontology mappings can lead to significant information fluidity within the Semantic Web.

Nonparametric versions of hidden Markov models, what we call weak models, are robust for process detection and easy to construct, as the assumption of knowing precise probabilities in HMMs is weakened to {0,1}-values of reachabilities. Weak models are shown to be equivalent to DFAs/ NFAs. The concept of minimal unifilar weak model (/spl mu/-WM) is introduced. The spectral radius of the transition matrix of /spl mu/-WM determines the growth rate of acceptable observation sequences. An absolute weak model distance is defined for model clustering purpose, while a relative distance is a measure of how fast the performance of detection gets improved as more observations arrive. Convergence of the distance measures is proved.

Hidden Markov models (HMMs) are currently employed in a wide variety of applications, including speech recognition, target tracking, and protein sequence analysis. The Viterbi algorithm is perhaps the best known method for tracking the hidden states of a process from a sequence of observations. An important problem when tracking a process with an HMM is estimating the uncertainty present in the solution. In this correspondence, an algorithm for computing at runtime the entropy of the possible hidden state sequences that may have produced a certain sequence of observations is introduced. The brute-force computation of this quantity requires a number of calculations exponential in the length of the observation sequence. This algorithm, however, is based on a trellis structure resembling that of the Viterbi algorithm, and permits the efficient computation of the entropy with a complexity linear in the number of observations.

In this paper we investigate a problem arising in decentralized registration of sensors. The application we consider involves a heterogeneous collection of sensors - some sensors have on-board global positioning system (GPS) capabilities while others do not. All sensors have wireless communications capability but the wireless communication has limited effective range. Sensors can communicate only with other sensors that are within a fixed distance of each other. Sensors with GPS capability are self-registering. Sensors without GPS capability are less expensive and smaller but they must compute estimates of their location using estimates of the distances between themselves and other sensors within their radio range. GPS-less sensors may be several radio hops away from GPS-capable sensors so registration must be inferred transitively. Our approach to solving this registration problem involves minimizing a global potential or penalty function by using only local information, determined by the radio range, available to each sensor. The algorithm we derive is a special case of a more general methodology we have developed called "emergence engineering".

In this paper we examine the role of very simple and noisy sensors for the tracking problem. We propose a binary sensor model, where each sensor's value is converted reliably to one bit of information only: whether the object is moving toward the sensor or away from the sensor. We show that a network of binary sensors has geometric properties that can be used to develop a solution for tracking with binary sensors and present resulting algorithms and simulation experiments. We develop a particle filtering style algorithm for target tracking using such minimalist sensors. We present an analysis of a fundamental tracking limitation under this sensor model, and show how this limitation can be overcome through the use of a single bit of proximity information at each sensor node. Our extensive simulations show low error that decreases with sensor density.

In order to achieve interoperability among heterogeneous systems, markup languages such as XML and DAML are being used to describe distributed systems and data. The ability to successfully interoperate based on semantic markup depends on the ability to create, use and manage shared ontologies of concepts and their interrelationships. Specifically, communicating systems in a networked environment have to achieve a certain level of semantic agreement for them to understand and process exchanged data. A challenging question is how deep the semantic agreement has to be in order to satisfy the communication needs in an environment. Additionally, what is the markup complexity resulting from pursuing that depth of semantic agreement? This paper introduces the concept of semantic depth and markup complexity and proposes models to measure the markup complexity. Furthermore, it is shown that markup complexity can be reduced by employing hierarchical ontologies after partitioning the domain into smaller sub-domains.

Abstract D'Agents is a general‐purpose mobile‐agent system that has been used in several information‐retrieval applications. In this paper, we first examine one such application, operational support for military field personnel, where D'Agents greatly simplifies the task of providing efficient, application‐specific access to remote information resources. After describing the application, we discuss the key differences between D'Agents and most other mobile‐agent systems, notably its support for strong mobility and multiple agent languages. Finally, we derive a small, simple application that is representative of many information‐retrieval tasks, including those in the example application, and use this application to compare the scalability of mobile agents and traditional client/server approaches. The results confirm and quantify the usefulness of mobile code, and perhaps more importantly, confirm that intuition about when to use mobile code is usually correct. Although significant additional experiments are required to fully characterize the complex mobile‐agent performance space, the results presented here help to answer the basic question of when mobile agents should be considered at all, particularly for information‐retrieval applications. Copyright © 2002 John Wiley & Sons, Ltd.

We carry out a detailed analysis of a fuzzy version of Reid's classical multiple hypothesis tracking (MHT) algorithm. Our fuzzy version is based on well-known fuzzy feedback systems, but the fact that the system we describe is specialized for likelihood discrimination makes this study particularly novel. We discuss several techniques for rule activation. One of them, namely the sum-product, seems particularly useful for likelihood management and its linearity makes it tractable for further analysis. Our analysis is performed in two stages: 1) we demonstrate that, with appropriately chosen rules, our system can discriminate the correct hypothesis; and 2) the steady-state behavior with a constant input is characterized analytically. This enables us to establish the optimality of the sum-product method and it also gives a simple procedure to predict the system's behavior as a function of the rule base. We believe this fact can be used to devise a simple procedure for fine-tuning the rule base according to the system designer's needs. The application driving our fuzzy MHT implementation and analysis is the tracking of natural language text-based messages. This application is used as an example throughout the paper.

Wireless networks are an ideal environment for mobile agents, because their mobility allows them to move across an unreliable link to reside on a wired host, next to or closer to the resources they need to use. Furthermore, client-specific data transformations can be moved across the wireless link, and run on a wired gateway server, with the goal of reducing bandwidth demands. In this paper we examine the tradeoffs faced when deciding whether to use mobile agents to support a data-filtering application, in which numerous wireless clients filter information from a large data stream arriving across the wired network. We develop an analytical model and use parameters from our own experiments to explore the model's implications.

Recent experiments and analysis suggest that there are about 800 million publicly-indexable Web pages. However, unlike books in a traditional library, Web pages continue to change even after they are initially published by their authors and indexed by search engines. This paper describes preliminary data on and statistical analysis of the frequency and nature of Web page modifications. Using empirical models and a novel analytic metric of `up-to-dateness', we estimate the rate at which Web search engines must re-index the Web to remain current.

In order to be efficient and robust, distributed computing applications must accommodate new data sources and alter their computational structure automatically. We demonstrate the utility of mobile agents for addressing such challenges in a distributed, real-time application. We describe our implementation of a distributed information fusion system based on Bayesian networks using the D'Agent mobile agent system. The Bayesian networks infer identity for clusters of vehicles using information from distributed sensors and databases.

The gossip problem involves communicating a unique item from each node in a graph to every other node. This paper studies the minimum time required to do this under the weakest model of parallel communication, which allows each node to participate in just one communication at a time as either sender or receiver. A number of topologies are studied, including the omplete graph, grids, hypercubes, and rings. Definitive new optimal time algorithms are derived for complete graphs, rings, regular grids, and toroidal grids that significantly extend existing results. In particular, an open problem about minimum time gossiping in complete graphs is settled. Specifically, for a graph with N nodes, at least $\log _\rho N$ communication steps, where the logarithm is in the base of the golden ratio $\rho $, are required by any algorithm under the weakest model of communication. This bound, which is approximately $1.44\log _2 N$, can be realized for some networks and so the result is optimal.

The workload of the NSF supercomputer center at the University of Illinois is decomposed into its major constituent programs, and performance characteristics of those programs are described in detail.The resulting data is compared with similar data obtained from standard benchmarks showing that applications level programs are clearly distinct from kernel and algorithm benchmarks.The workload decomposition shows that overidl utilization is quite high but is heavily influenced by a small number of sophisticated users with large allocations who run highly efficient programs.Some high level profifing data leads to an analysis of the benefits of inliniug subroutines.A number of other preliminary results are also described.This effort, called the Supercomputer Applications Database (SAD) Project, is the first detailed workload analysis of a US national supercomputer center.

An improvement to visualization systems that provides a graphics window into an application displaying program data at run-time through an easy-to-use graphical interface is discussed. With little or no instrumentation of the application the user will be able to dynamically select data for graphical display as the program executes on a remote computer system. The data to be displayed and the type of display to be used are chosen interactively while the application is executing. Any data display can be enabled and disabled at any time; it is not necessary to specify the data or graphics technique before compilation as with conventional graphics tools. An architecture for such a remote visualization system is proposed, and an implementation, called Vista, is described. Designed primarily for scientific visualization, Vista or offers an environment for more effective debugging and program development.>

In the past three years, the Perfect BenchmarkTM Suite has evolved from a supercomputer performance evaluation plan, presented by Kuck and Sameh at the 1987 International Conference on Supercomputing, to a vigorous international activity. This paper surveys the current state of this supercomputer performance evaluation effort with particular focus on the adopted methodology. While there has been considerable success in achieving the goals of the plan, some issues remain unresolved, and new questions have surfaced.

The subject matter of this paper concerns the round-off error propagation in order n2algorithms for solving problems involving Toeplitz matrices. Since linear predictive techniques owe much of their appeal to the computational efficiency of Durbin's, Levinson's, and Trench's algorithms, it is important to understand the accuracy of these methods. In what appears to be the first analysis of its kind, we derive bounds on the errors due to round-off and discuss their merits and tightness. In particular, it is shown that these errors enjoy certain stability properties and do not grow as quickly as may be feared. Simulations are presented to illustrate the results.