Existing 
detection mechanisms based on data collected at lower layers
are inadequate because the data lacks semantic information. 
On the other hand, if application layer data is used, then the
customized solutions have to be (re)developed for every
application. There is thus an increasing need to base disruption
detection on data that is semantically rich, yet generic enough so
that the strategies can be used uniformly across a range of
services. Middleware with its reusable building blocks is the key
enabler that can provide semantically rich data generically across
several services. Cyber trust challenges can thus be addressed in the
context of middleware. 


% Swapna, although this is good, our intro is becoming too big so I am
% commenting this out.
% Aniruddha, okay. 
\iffalse
\paragraph*{\bf Solution Approach}
For each service offered by the cyber infrastructure, our detection
methodology consists of the following steps: (1) the baseline
behavior defined in terms of the performance metrics of the middleware
building block(s) used to implement the service will be established
using analytical/\-simulation models of the building block(s) driven
by the workload characteristics of the service. This constitutes 
the training phase which will be completed at
design-time, prior to even the implementation of the service. 
(2) during service operation, the relevant operational data from each
building block will be logged and the log files 
generated by each building block will be analyzed 
to extract the performance metrics of the building
block. Subsequently, the performance metrics of a building block
extracted from the analysis of log files will be 
compared to the baseline performance metrics established using 
the model by applying well-known statistical analysis
techniques~\cite{johnson98} to generate an anomaly score indicating
the degree of departure of the building block from the
norm. Additionally, the anomaly scores generated from the analysis of
the building blocks at multiple layers service will be correlated using 
Bayesian networks~\cite{jensen01} to produce an overall
anomaly score which indicates the degree of departure of the service 
from the norm. Correlation among the anomaly scores at multiple
layers may also suggest remedial strategies to contain 
the disruption within a region of the cyber infrastructure
and to restore the services. 
\fi

% Swapna, I think we can either comment this whole thing out or
% substantially reduce it
%%% Related Work
% Aniruddha, I am commenting out this section completely. I think 
% the most important related research (at least from the point of view
% of this workshop) is in Intrusion detection. But we have alluded to
% that a bit in the intro. This should also reduce the number of 
% references substantitally. 
\iffalse
\section{Related Research}
\label{sec:relwork}

The collection of topics comprising detection techniques, such as
intrusion detections, middleware-based logging and analytical modeling
serve as the foundations for the proposed research on disruption
detection. Below we list related research and outline how our proposed
ideas provide innovative solutions.

\subsection*{Intrusion Detection}
Existing Intrusion Detection Systems (IDSs) are based on two general
approaches of detection, namely, anomaly 
detection~\cite{ko97,liu03,manikopoulos02,sung03,tan03,thottan03} and 
misuse detection~\cite{jiang03}.  
Anomaly detection involves specifying the normal 
behavior of users or applications. Substantial deviations from this
normal behavior can then be labeled as intrusive or at least 
suspicious. Misuse detection involves modeling of each known attack
through the construction of a signature. Incoming activities that
match a pattern in the library of attack signatures raise an alarm.
Misuse detection is thus useful for detecting known attacks and has a
low false positive rate, whereas anomaly detection is useful in the 
context of detecting unknown attacks but suffers from a high false
positive rate. Some IDSs employ both anomaly and misuse
detection to exploit the strengths of these two methods 
and are termed hybrid systems~\cite{bowen00,seleznyov02,ye03}.
Regardless of the method used for detection, an IDS can be 
alternatively classified as network-based or 
host-based depending on the source of input data. 
A network-based IDS attempts to detect intrusions by analyzing 
the traffic that is transported over the 
network~\cite{bauer01,herringshaw97,iguchi99,kayacik03,stevens03,sung03,talpade99}. A host-based IDS tries to identify intrusions by analyzing 
the activities at the hosts, mainly users and programs~\cite{butler03}. 
Host-based IDSs rely on many different data streams such 
as system call traces~\cite{chinchani02,draelos02,endler98,eskin01,jiang03,jones01,lu03,okazaki02,tan03,warrender99,zhuowei03},
resources consumed by the processes~\cite{han03}, 
file access events~\cite{han03}, network audit data
collected at a host~\cite{daniels99}, call stack information~\cite{feng03} 
and commands issued by a 
user~\cite{marin01}. A few research efforts also use 
application data~\cite{jones00,loyall00,wu03,ryutov03,vigna03,wang01,wenhui01} as another form of host data.
Some IDSs employ both network and host data for 
detection~\cite{abimbola03,yongle03,teo03}. 
A variety of techniques have been employed to perform misuse and 
anomaly detection. The reported literature review while not
exhaustive, is intended to provide an overview of the existing
research in the area of intrusion detection. Excellent surveys of 
intrusion detection techniques and 
systems are presented in ~\cite{bai03,debar99,kumar95,mukherjee94}.
Our approach differs from these since it uses data collected at higher
layers, but independent of the application.

\subsection*{Logging Capabilities in Networks and Middleware}

Protocols like the Simple Network Management Protocol
(SNMP)~\cite{Case:90} are in widespread use, which enables collecting
network statistics, such as link congestion or packet loss at a
router. These techniques are very useful to maintain a good overall
health of the network. However, the data collected by these lower
level protocols is agnostic about the traits and behavior of the
internet applications. With constant technological advances and the
resulting newer services and applications, it is not possible for
these lower level protocols to make intelligent decisions on
containment of the disruption problems, which actually need more
context-aware decisions based on rich semantic data.

Patterns-based~\cite{Vlissides:94} middleware platforms,
such as J2EE~\cite{J2EE:01}, .NET~\cite{DotNet:02} and
CORBA~\cite{CORBA:02d}, provide reusable building blocks to build
network services and applications. They provide technologies like
interceptors~\cite{Schmidt:03v} that can be used to provide
capabilities, such as data checkpointing for fault
tolerance~\cite{Narasimhan:99,Schmidt:02q} or
authentication~\cite{Schmidt:00s,OMG-SEC:98}. 
While these middleware provide solutions to some problems, such as
security or fault tolerance, there are no solutions that collect
performance data for various critical elements of the
middleware. Coarser grained solutions in this space have been offered
by middleware solutions, such as QuO~\cite{Quo:97}, which collect
coarser grained statistics, such as CPU load or network bandwidth
usage, to make run-time adaptive changes. The proposed research
requires adaptive instrumentation of middleware layers to obtain
various performance-related operational data at different levels of
granularity, which provides a rich data set. At the same time since it
is middleware based, the techniques are reusable across a wide range
of cyber services.

This project proposes to use model-driven generative technologies for
synthesizing the configuration scripts that will appropriately
configure the middleware for the desired levels of
instrumentation. Model-driven techniques are useful in alleviating
accidental complexities arising from ad hoc means to instrument
middleware. As explained in Section~\ref{sec:logging}, we propose
to use techniques, such as interceptors~\cite{Schmidt:03v} and
aspect-oriented programming~\cite{gregor:97} in conjunction with
model-driven tools to drive the middleware instrumentation.

\subsection*{Performance analysis using SRNs}
\label{model-analysis}
SRNs represent a powerful
modeling technique that is concise in its specification and whose form
is closer to a designer's intuition about what a model should look
like. Since SRN specification is
closer to a designer's intuition of system behavior, it is also easier
to transfer the results obtained from solving the models and interpret
them in terms of the entities that exist in the system being
modeled. In this section we provide an overview of SRNs, details
can be obtained elsewhere~\cite{evol-spn}.

SRNs are an extension to Generalized Stochastic 
Petri nets~\cite{evol-spn}, which are an extension to Stochastic Petri 
nets~\cite{evol-spn}. Stochastic Petri nets~\cite{evol-spn} 
extend Petri nets~\cite{peterson81} by allowing timed 
transitions that have {\em exponentially distributed} firing times. 
Generalized stochastic Petri nets (GSPNs)~\cite{evol-spn} also allow {\em
immediate} transitions which fire instantaneously. GSPNs include
an {\em inhibitor arc} which can also have a multiplicity 
associated with it. An inhibitor arc inhibits the transition 
it is connected to if the place it is connected to at its other end has a 
number of tokens equal to at least its multiplicity. The default
multiplicity is 1. A GSPN marking with at least one immediate transition
enabled is called a {\em vanishing marking}, and a marking
with no immediate transitions enabled is called a {\em tangible
marking}. Stochastic reward nets (SRNs) 
extend GSPNs further by allowing the association
of a reward rate to each tangible marking. In addition, 
SRNs allow the specification of {\em enabling (or guard)
functions} for each transition. The transition is enabled only if
the enabling function returns ``1''. SRN also allows marking dependent
arc multiplicities and enabling functions. Another feature of SRN
is the provision of priorities and probabilities to determine which
of a set of simultaneously enabled transitions will fire first.
Packages such as SPNP~\cite{spnp-new} can
automate the translation of an SRN into its equivalent Markov reward
model and solve it.

Stochastic reward nets have been extensively used for the 
performance, reliability and performability analysis of a variety of 
systems~\cite{corba-perf,avail-vax,poll-perf,man-perf,queue-perf,rel-srn}.
The work closest to the research described in this project is
reported by Ramani {\em et al.}~\cite{corba-perf}, where SRNs
are used for the performance analysis of the CORBA event
service to obtain the different performance metrics, such
as the expected queue length and the probability of message
loss. We know of no other research that provides multilayered
middleware performance models for cyber services.
\fi

