More Like this

1. Detecting Suspicious Package Updates

   https://doi.org/10.1109/ICSE-NIER.2019.00012  

   Garret, Kalil; Ferreira, Gabriel; Jia, Limin; Sunshine, Joshua; Kaestner, Christian (January 2019, Proceedings of the Proc. International Conference on Software Engineering -- New Ideas Track (ICSE-NIER))

   With an increased level of automation provided by package managers, which sometimes allow updates to be installed automatically, malicious package updates are becoming a real threat in software ecosystems. To address this issue, we propose an approach based on anomaly detection, to identify suspicious updates based on security-relevant features that attackers could use in an attack. We evaluate our approach in the context of Node.js/npm ecosystem, to show its feasibility in terms of reduced review effort and the correct identification of a confirmed malicious update attack. Although we do not expect it to be a complete solution in isolation, we believe it is an important security building block for software ecosystems. 

   more » « less
2. Secure and Reliable Network Updates

   https://doi.org/10.1145/3556542  

   Lembke, James; Ravi, Srivatsan; Roman, Pierre-Louis; Eugster, Patrick (February 2023, ACM Transactions on Privacy and Security)

   Software-defined wide area networking (SD-WAN) enables dynamic network policy control over a large distributed network via network updates . To be practical, network updates must be consistent (i.e., free of transient errors caused by updates to multiple switches), secure (i.e., only be executed when sent from valid controllers), and reliable (i.e., function despite the presence of faulty or malicious members in the control plane), while imposing only minimal overhead on controllers and switches. We present SERENE: a protocol for se cure and re liable ne twork updates for SD-WAN environments. In short: Consistency is provided through the combination of an update scheduler and a distributed transactional protocol. Security is preserved by authenticating network events and updates, the latter with an adaptive threshold cryptographic scheme. Reliability is provided by replicating the control plane and making it resilient to a dynamic adversary by using a distributed ledger as a controller failure detector. We ensure practicality by providing a mechanism for scalability through the definition of independent network domains and exploiting the parallelism of network updates both within and across domains. We formally define SERENE’s protocol and prove its safety with regards to event-linearizability. Extensive experiments show that SERENE imposes minimal switch burden and scales to large networks running multiple network applications all requiring concurrent network updates, imposing at worst a 16% overhead on short-lived flow completion and negligible overhead on anticipated normal workloads. 

   more » « less
3. Asynchronous Nonlinear Updates on Graphs

   https://doi.org/10.1109/ACSSC.2018.8645351  

   Teke, Oguzhan; Vaidyanathan, P. P. (October 2018, Asilomar Conf. Sig., Sys., and Computers)

   The notion of graph shift, introduced recently in graph signal processing, extends many classical signal processing techniques to graphs. Its practical importance follows from its localization: a single graph shift requires nodes to communicate only with their neighbors. However, communications should happen simultaneously, which requires a synchronization over the graph. In order to overcome this restriction, recent studies consider a random asynchronous variant of the graph shift, which is also suitable for autonomous networks. A graph signal under this randomized scheme is shown to converge (under mild conditions) to an eigenvector of the eigenvalue 1 of the operator even if the operator has other eigenvalues with magnitudes larger than unity. If the eigenvalue 1 does not exist, the operator can be easily normalized in theory. However, in practice, the normalization requires one to know the (dominant) eigenvalues, which may not be possible to obtain in large autonomous networks. To eliminate this limitation, this study considers the use of a nonlinearity in the updates making the scheme similar in spirit to the Hopfield neural network model. Our simulation results show that a graph signal still approaches the eigenvector of the dominant eigenvalue although the convergence is not exact. Nevertheless, approximation is sufficient to accomplish certain tasks including autonomous clustering. 

   more » « less
4. Keck Planet Finder: design updates

   https://doi.org/10.1117/12.2561783  

   Gibson, Steven R.; Howard, Andrew W.; Rider, Kodi; Roy, Arpita; Edelstein, Jerry; Kassis, Marc; Grillo, Jason; Halverson, Samuel P.; Sirk, Martin M.; Smith, Christopher; et al (December 2020, Keck Planet Finder: Design Updates)

   Evans, Christopher J.; Bryant, Julia J.; Motohara, Kentaro (Ed.)

   The Keck Planet Finder (KPF) is a fiber-fed, high-resolution, high-stability spectrometer in development at the UC Berkeley Space Sciences Laboratory for the W.M. Keck Observatory. KPF is designed to characterize exoplanets via Doppler spectroscopy with a goal of a single measurement precision of 0.3 m s-1 or better, however its resolution and stability will enable a wide variety of astrophysical pursuits. Here we provide post-preliminary design review design updates for several subsystems, including: the main spectrometer, the fabrication of the Zerodur optical bench; the data reduction pipeline; fiber agitator; fiber cable design; fiber scrambler; VPH testing results and the exposure meter. 

   more » « less
5. Updates with Multiple Service Classes

   Yates, Roy D.; Zhong, Jing; Zhang, Wuyang (July 2019, 2019 IEEE International Symposium on Information Theory (ISIT))

   A source submits status update jobs to a service fa- cility for processing and delivery to a monitor. The status updates belong to service classes with different service requirements. We model the service requirements using a hyperexponential service time model. To avoid class-specific bias in the service process, the system implements an M/G/1/1 blocking queue; new arrivals are discarded if the server is busy. Using an age-of-information (AoI) metric to characterize timeliness of the updates, a stochastic hybrid system (SHS) approach is employed to derive the overall average AoI and the average AoI for each service class. We observe that both the overall AoI and class-specific AoI share a common penalty that is a function of the second moment of the average service time and they differ chiefly because of their different arrival rates. We show that each high-probability service class has an associated age-optimal update arrival rate while low- probability service classes incur an average age that is always decreasing in the update arrival rate. 

   more » « less