This paper proposes a new approach to fault detection for a link state routing system-property oriented analysis and detection (POD). A routing system is modeled as a set of distributed processes. A property is defined as state predicate(s) over system variables. For the link state routing protocol, the high-level overall converging property P is defined as the "synchronization" among routing information bases maintained by all processes. We decompose the routing protocol into different computation phases. For each phase, we use invariant state predicates (safety property) and the liveness property as our guide for observation and analysis. The goal of the detection algorithm is to construct a validation path based on the history to determine if the fault is natural or malicious once the stable property P is rendered invalid by faults. The contribution of this paper is twofold: first, a new detection approach is proposed that differs from traditional signature-based or profile-based intrusion detection paradigms in the sense that it utilizes the stable property as a starting point, and correlates the history and future to validate changes in the system; second, by exploring the primary concerned system properties, we show that detection effort can be conducted in a more focused and systematic fashion.

Many security mechanisms and protocols have been developed to handle security problems in various circumstances. This trend has created a heterogeneous security environment for today's global Internet. Although most security functions and modules can be managed "individually" through SNMP, very little has been researched in coordinating a set of distributed security modules to provide and manage an "end-to-end" security service. In order to support service management for network security, in this paper, we developed the ISCP protocol (inter-domain security management agent coordination protocol) to communicate security capability and policy information among the security management agents in each policy domain. ISCP is designed with good scalability, interoperability, extensibility and security. Performance evaluation using our ISCP prototype implementation is also presented.

The JiNao IDS project focuses on detecting intrusions, especially insider attacks against link state routing protocols such as OSPF. One important feature of the JiNao system is its integrated network management (INM) capability. Through SNMP and distributed programming interface (DPI), we can manage and control distributed JiNao IDS remotely, interoperate with other JiNao systems to do correlation analysis, and utilize both private MIB and OSPF MIB as a complementary way of doing intrusion detection. This paper describes the design and implementation of JiNao's INM architecture. Three OSPF insider attacks (maxseq, maxage, and seq++) have been developed to evaluate its effectiveness and detection capability.

DECIDUOUS is a security management framework for identifying the sources of network-based intrusions. The first key concept in DECIDUOUS is dynamic security associations, which efficiently and collectively provide location information for attack sources. DECIDUOUS is built on top of the IETF's IPSEC/ISAKMP infrastructure, and it does not introduce any new network protocol for source identification in a single administrative domain. It defines a collaborative protocol for inter-domain attack source identification. The second key concept in DECIDUOUS is the management information integration of the intrusion detection system (IDS) and attack source identification system (ASIS) across different protocol layers. For example, in DECIDUOUS, it is possible for a network-layer security control protocol (e.g., IPSEC) to collaborate with an application-layer intrusion detection system module (e.g., IDS for the SNMP engine). In this paper, we present the motivations, design, and prototype implementation of the DECIDUOUS framework.

The JiNao project at MCNC/NCSU focuses on detecting intrusions, especially insider attacks, against the OSPF (open shortest path first) routing protocol. This paper presents the implementation and experiments of JiNao's statistical intrusion detection module. Our implementation is based upon the algorithm developed in SRI's NIDES (next-generation intrusion detection expert system) project. Some modifications and improvements to NIDES/STAT are made for a more effective implementation in our environment. Also, three OSPF insider attacks (e.g., maxseq, maxage, and seq++ attacks) have been developed for evaluating the efficacy of detecting capability. The experiments were conducted on two different network routing testbeds. The results indicate that the proposed statistical mechanism is very effective in detecting these routing protocol attacks.

Many new network applications demand interprocess communication (IPC) services that are not supported by existing transport protocol mechanisms. Large bandwidth-delay products of high-speed networks also render some of the existing error and flow control mechanisms less efficient. In particular, new error control schemes that can provide variable degrees of error recovery according to the application's requirements are desirable. This paper presents the design, evaluation, and implementation of an application-oriented error control-scheme that is aimed at supporting efficient IPC in high-speed networking environments. Our results indicate that the proposed error control scheme allows effective control of the trade-off between the amount of error an application can tolerate and the amount of delay it has to suffer.

The paper describes an experimental key agile cryptographic system under design at MCNC. The system is compatible with ATM local- and wide-area networks. The system establishes and manages secure connections between hosts in a manner which is transparent to the end users and compatible with existing public network standards. A Cryptographic Unit supports hardware encryption and decryption at the ATM protocol layer. The system is SONET compatible and operates full duplex at the OC-12c rate (622 Mbps). Separate encryption keys are negotiated for each secure connection. Each Cryptographic Unit can manage more than 65,000 active secure connections. The Cryptographic Unit can be connected either in a security gateway mode referred to as a 'bump-in-the-fiber' or as a direct ATM host interface. Authentication and access control are implemented through a certificate-based system. The current status of the system is that hardware and software detail designs have been completed. An early version of the key management software has been completed and demonstrated. Hardware fabrication and systems integration are expected to take place over the next several months. Once completed the proof-of concept system will be used to explore issues of privacy, access control and authentication in relation to communications over emerging public networks.>

Two-layer encoding of packet video may be a useful way to minimize network resource usage while coping with potential packet loss. A two-layer codec architecture modeled after the H.261 RM8 algorithm is proposed, and is shown to be a generalization of the requantization and spectral separation encoding techniques. Experiments were performed using two ten-second video sequences to examine the efficiency of two-layer encoding algorithms. Three techniques: periodic group of blocks (GOB) replenishment, conditional macroblock replenishment, and block error thresholding, are shown to improve the efficiency of two-layer encoding. A hybrid encoding method utilizing both spectral separation and requantization is shown to provide the best results.>

This paper proposes using an explicit rate control together with a simple window control for flow control in high-speed networks with resource reservations. The design justifications, the evaluation study, and the implementation results are presented. In particular, the idea of hard ACK and soft ACK in the context of end-to-end flow control is explored through simulation and the results are discussed.>

With the advent of broadband integrated services data network (B-ISDN) technologies such as Asynchronous Transfer Mode (ATM) networks, packet-based multimedia (e.g., live audio and video, animation, and text) conferencing is becoming a viable means for achieving virtual proximity, which enables us to overcome the physical separation in space and time and to interact more effectively in our science and engineering endeavors. To bring about the reality of virtual proximity, many technical issues need to be addressed. One important issue is to develop an efficient multipoint audio and video control scheme. This paper discusses the related issues and outlines a solution.