Latest NICTA Publications

seL4: from General Purpose to a Proof of Information Flow Enforcement

Sun, 19 May 2013 00:00:00 +0000

Authors: Toby Murray, Daniel Matichuk, Matthew Brassil, Peter Gammie, Timothy Bourke, Sean Seefried, Corey Lewis, Xin Gao, Gerwin Klein

Abstract: In contrast to testing, mathematical reasoning and formal verificationcan show the absence of whole classes of security vulnerabilities. Wepresent the, to our knowledge, first complete, formal, machine-checkedverification of information flow security for the implementation of ageneral-purpose microkernel; namely seL4. Unlike previous proofs ofinformation flow security for operating system kernels, ours appliesto the actual 8,830 lines of C code that implement seL4, andso rules out the possibility of invalidation by implementation errorsin this code. We assume correctness of compiler, assembly code,hardware, and boot code. We prove everything else. This proof isstrong evidence of seL4's utility as a separation kernel, anddescribes precisely how the general purpose kernel should beconfigured to enforce isolation and mandatory information flowcontrol. We describe the information flow security statement we proved(a variant of intransitive noninterference), including the assumptionson which it rests, as well as the modifications that had to be made toseL4 to ensure it was enforced. We discuss the practical limitationsand implications of this result, including covert channels not coveredby the formal proof.

IEEE Symposium on Security and Privacy-May 2013

Formal Specifications Better Than Function Points for Code Sizing

Sat, 18 May 2013 00:00:00 +0000

Authors: Mark Staples, Rafal Kolanski, Gerwin Klein, Corey Lewis, June Andronick, Toby Murray, Ross Jeffery, Len Bass

Abstract: Size and effort estimation is a significant challenge for the management of large-scale formal verification projects. We report on an initial study of relationships between the sizes of artefacts from the development of seL4, a formally-verified embedded systems microkernel. For each API function we first determined its COSMIC Function Point (CFP) count (based on the seL4 user manual), then sliced the formal specifications and source code, and performed a normalised line count on these artefact slices. We found strong and significant relationships between the sizes of the artefact slices, but no significant relationships between them and the CFP counts. Our finding that CFP is poorly correlated with lines of code is based on just one system, but is largely consistent with prior literature. We find CFP is also poorly correlated with the size of formal specifications. Nonetheless, lines of formal specification correlate with lines of source code, and this may provide a basis for size prediction in future formal verification projects. In future work we will investigate proof sizing.

International Conference on Software Engineering (ICSE)-May 2013

Building High Assurance Secure Applications using Security Patterns for Capability-based Platforms

Sat, 18 May 2013 00:00:00 +0000

Authors: Paul Rimba

Abstract: Building high assurance secure applications requires the proper use of security mechanisms and assurances provided by the underlying secure platform. However, applications are often built using security patterns and best practices that are agnostic with respect to the intricate specifics of the different underlying platforms. This independence from the underlying platform leaves a gap between security patterns and underlying secure platforms. In this PhD research abstract, we propose a novel approach to bridge this gap. Specifically, we propose reusable platform-specific designs for security patterns using platform-specific design strategies and primitives. The focus is on single-machine systems that can be formally verified to provide desired system-wide security properties. We also discuss assumptions and levels of assurance for these reusable designs and their use in the verification of application designs.

International Conference on Software Engineering (ICSE)-May 2013

Explaining Time-Table-Edge-Finding Propagation for the Cumulative Resource Constraint

Sat, 18 May 2013 00:00:00 +0000

Authors: Andreas Schutt, Thibaut Feydy, Peter Stuckey

Abstract: Cumulative resource constraints can model scarce resources in scheduling problems or a dimension in packing and cutting problems. In order to efficiently solve such problems with a constraint programming solver, it is important to have strong and fast propagators for cumulative resource constraints. Time-table-edge-finding propagators are a recent development in cumulative propagators, that combine the current resource profile (time-table) during the edge-finding propagation. The current state of the art for solving scheduling and cutting problems involving cumulative constraints are lazy clause generation solvers, i.e., constraint programming solvers incorporating nogood learning, have proved to be excellent at solving scheduling and cutting problems. For such solvers, concise and accurate explanations of the reasons for propagation are essential for strong nogood learning. In this paper, we develop a time-table-edge-finding propagator for cumulative that explains its propagations. We give results using this propagator in a lazy clause generation system on resource-constrained project scheduling problems from various standard benchmark suites. On the standard benchmark suite PSPLib, we are able to improve the lower bound of about 60% of the remaining open instances, and close 6 open instances.

International Conference on Integration of Artificial Intelligence and Operations Research Techniques in Constraint Programming for Combinatorial Optimization Problems (CPAIOR)-May 2013

A Lagrangian Relaxation Based Forward-backward Improvement Heuristic for Maximising the Net Present Value of Resource-Constrained Projects

Sat, 18 May 2013 00:00:00 +0000

Authors: Hanyu Gu, Andreas Schutt, Peter Stuckey

Abstract: In this paper we propose a forward-backward improvement heuristic for the variant of resource-constrained project scheduling problem aiming to maximise the net present value of a project. It relies on the Lagrangian relaxation method to generate an initial set of schedules which are then improved by the iterative forward/backward scheduling technique. It greatly improves the performance of the Lagrangian relaxation based heuristics in the literature and is a strong competitor to the best meta-heuristics. We also embed this heuristic into a state-of-the-art CP solver. Experimentation carried out on a comprehensive set of test data indicates we compare favorably with the state of the art.

International Conference on Integration of Artificial Intelligence and Operations Research Techniques in Constraint Programming for Combinatorial Optimization Problems (CPAIOR)-May 2013

Eliciting Operations Requirements for Applications

Sat, 18 May 2013 00:00:00 +0000

Authors: Len Bass, Ross Jeffery, Hiroshi Wada, Ingo Weber, Liming Zhu

Abstract: The Devops community advocates communication between the operations staff and the development staff as a means of ensuring that the developers understand the issues associated with operations. This paper argues that“communication” is too vague and that there are a variety of specific and well known sources that developers can examine to determine requirements to support the installation and operations of an application product. These sources include standards, process descriptions, studies about sources offailure in configuration and upgrade, and models that include both product and process.

International Workshop on Release Engineering 2013-May 2013

Deployment of a Wireless Mesh Network for Traffic Control

Fri, 17 May 2013 00:00:00 +0000

Authors: Kun-chan Lan, Zhe Wang, Mahbub Hassan, Tim Moors, Rodney Berriman, Lavy Libman, Max Ott, Bjorn Landfeldt, Zainab Zaidi, Ching-Ming Chou

Abstract: Wireless mesh networks (WMN) have attracted considerable interest in recent years as a convenient, new technology. However, the suitability of WMN for mission-critical infrastructure applications remains by and large unknown, as protocols typically employed in WMN are, for the most part, not designed for real-time communications. In this chapter, the authors describe a wireless mesh network architecture to solve the communication needs of the traffic control system in Sydney. This system, known as SCATS and used in over 100 cities around the world— from individual traffic light controllers to regional computers and the central TMC —places stringent requirements on the reliability and latency of the data exchanges. The authors discuss experience in the deployment of an initial testbed consisting of 7 mesh nodes placed at intersections with traffic lights, and share the results and insights learned from measurements and initial trials in the process.

Developments in Wireless Network Prototyping, Design, and Deployment: Future Generations-June 2012

Combining MEDLINE and publisher data to create parallel corpora for the automatic translation of biomedical text

Thu, 16 May 2013 00:00:00 +0000

Authors: Antonio Jimeno Yepes,Élise Prieur-Gaston, Aurélie Névéol

Abstract: BackgroundMost institutional and research information in the biomedical domain is available asEnglish text. Even in countries where English is an official language, such as theUnited States, language can be a barrier for accessing biomedical information. Recentprogress in machine translation suggests that these techniques could be used to maketext in English accessible to speakers of other languages. However, the lack ofadequate specialized corpus to train statistical models in the biomedical domainprevents quality automatic translations from being available.ResultsWe show how a large-size parallel corpus can be automatically obtained for thebiomedical domain using the MEDLINE database. The corpus generated in this workcomprises article titles obtained from MEDLINE and abstract text obtainedautomatically from journal websites, substantially extending the corpora used inprevious work. After assessing the quality of the corpus for two language pairs(English/French and English/Spanish) we use the Moses package to train a statisticalmachine translation model that outperforms previous models for automatic translationof biomedical text.ConclusionsWe have built translation data sets in the biomedical which can be easily extended toother languages available from MEDLINE. These sets can be successfully applied totrain statistical machine translation models. While further progress should be made byincorporating out-of-domain corpora and domain specific lexicons, we believe thatthis work paves the way for improved automatic translation in the biomedical domain.

BMC Bioinformatics-April 2013

A New Genetic Algorithm for Simplified Protein Structure Prediction

Wed, 15 May 2013 00:00:00 +0000

Authors: Mahmood Abdur Rashid, M.A.Hakim Newton, Nghia Pham, Abdul Sattar, Md tamjidul Hoque

Abstract: In simplified protein structure prediction, genetic algorithms have not been applied to 3-dimensional face-centred cubic lattice. In this paper, we present a new genetic algorithm for protein structure prediction problem using face-centred cubic lattice and hydrophobic-polar energy model. Our algorithm uses i) an exhaustive generation approach to diversify the search; ii) a novel hydrophobic core-directed macro move to intensify the search; and iii) a random-walk strategy to recover from stagnation. On a set of standard benchmark proteins, our algorithm significantly outperforms the state-of-the-art algorithms for similar models.

Australasian Joint Conference on Artificial Intelligence (AI)-December 2012

Phylogenetic and molecular epidemiological studies reveal evidence of multiple past recombination events between infectious laryngotracheitis viruses

Wed, 15 May 2013 00:00:00 +0000

Authors: , Sang-Won Lee, Joanne Devlin, Amir Noormohammadi, Glenn Browning, Nino Ficorilli, Carol Hartley, Philip Markham

Abstract: In contrast to the RNA viruses, the genome of large DNA viruses such as herpesviruses have been considered to be relatively stable. Intra-specific recombination has been proposed as an important, but underestimated, driving force in herpesvirus evolution. Recently, two distinct field strains of infectious laryngotracheitis virus (ILTV) have been shown to have arisen from independent recombination events between different commercial ILTV vaccines. In this study we sequenced the genomes of additional ILTV strains and also utilized other recently updated complete genome sequences of ILTV to confirm the existence of a number of ILTV recombinants in nature. Multiple recombination events were detected in the unique long and repeat regions of the genome, but not in the unique short region. Most recombinants contained a pair of crossover points between two distinct lineages of ILTV, corresponding to the European origin and the Australian origin vaccine strains of ILTV. These results suggest that there are two distinct genotypic lineages of ILTV and that these commonly recombine in the field.

PLOS ONE-February 2013

Towards sender-based TFRC

Tue, 14 May 2013 00:00:00 +0000

Authors: Guillaume Jourjon, Emmanuel Lochin, Patrick Senac

Abstract: Pervasive communications are increasingly sent over mobile devices and personal digital assistants. This trend has been observed during the last football world cup where cellular phones service providers have measured a significant increase in multimedia traffic. To better carry multimedia traffic, the IETF standardized a new TCP Friendly Rate Control (TFRC) protocol. However, the current receiver-based TFRC design is not well suited to resource limited end systems. We propose a scheme to shift resource allocation and computation to the sender. This sender based approach led us to develop a new algorithm for loss notification and loss rate computation. We demonstrate the gain obtained in terms of memory requirements and CPU processing compared to the current design. Moreover this shifting solves security issues raised by classical TFRC implementations. We have implemented this new sender-based TFRC, named TFRClight, and conducted measurements under real world conditions.

IEEE International Conference on Communications 2007 (IEEE ICC 2007)-June 2007

Symmetric and Asymmetric Asynchronous Interaction

Tue, 14 May 2013 00:00:00 +0000

Authors: Robert van Glabbeek, Ursula Goltz, Jens-Wolfhard Schicke

Abstract: We investigate classes of systems based on different interaction patternswith the aim of achieving distributability. As our system model we use Petrinets. In Petri nets, an inherent concept of simultaneity is built in, sincewhen a transition has more than one preplace, it can be crucial that tokensare removed instantaneously. When modelling a system which is intended to beimplemented in a distributed way by a Petri net, this built-in concept ofsynchronous interaction may be problematic. To investigate the problem weassume that removing tokens from places can no longer be considered asinstantaneous. We model this by inserting silent (unobservable) transitionsbetween transitions and their preplaces. We investigate three differentpatterns for modelling this type of asynchronous interaction.Fullysymmetric asynchrony assumes that every removal of a token from a place istime consuming. Forsymmetric asynchrony, tokens are only removedslowly in case of backward branched transitions, hence where the concept ofsimultaneous removal actually occurs. Finally we consider a more intricatepattern by allowing to remove tokens from preplaces of backward branchedtransitions asynchronously in sequence (asymmetric asynchrony).We investigate the effect of these different transformations of instantaneous interaction into asynchronous interaction patterns by comparing the behaviours of nets before and after insertion of the silent transitions. We exhibit for which classes of Petri nets we obtain equivalent behaviour with respect to failures equivalence. It turns out that the resulting hierarchy of Petri net classes can be described by semi-structural properties. In case of fully symmetric asynchrony and symmetric asynchrony, we obtain precise characterisations; for asymmetric asynchrony we obtain lower and upper bounds. We briefly comment on possible applications of our results to Message Sequence Charts.

First Interaction and Concurrency Experience (ICE'08): Synchronous and Asynchronous Interactions in Concurrent Distributed Systems-July 2008

Symmetric and Asymmetric Asynchronous Interaction

Tue, 14 May 2013 00:00:00 +0000

Authors: Robert van Glabbeek, Ursula Goltz, Jens-Wolfhard Schicke

Abstract: We investigate classes of systems based on different interaction patterns with the aim of achieving distributability. As our system model we use Petri nets. In Petri nets, an inherent concept of simultaneity is built in, since when a transition has more than one preplace, it can be crucial that tokens are removed instantaneously. When modelling a system which is intended to be implemented in a distributed way by a Petri net, this built-in concept of synchronous interaction may be problematic. To investigate the problem we assume that removing tokens from places can no longer be considered as instantaneous. We model this by inserting silent (unobservable) transitions between transitions and their preplaces. We investigate three different patterns for modelling this type of asynchronous interaction. Full asynchrony assumes that every removal of a token from a place is time consuming. For symmetric asynchrony, tokens are only removed slowly in case of backward branched transitions, hence where the concept of simultaneous removal actually occurs. Finally we consider a more intricate pattern by allowing to remove tokens from preplaces of backward branched transitions asynchronously in sequence (asymmetric asynchrony).We investigate the effect of these different transformations of instantaneous interaction into asynchronous interaction patterns by comparing the behaviours of nets before and after insertion of the silent transitions. We exhibit for which classes of Petri nets we obtain equivalent behaviour withrespect to failures equivalence. It turns out that the resulting hierarchy of Petri net classes can be described by semi-structural properties. In case of fully symmetric asynchrony and symmetric asynchrony, we obtain precise characterisations; for asymmetric asynchrony we obtain lower and upper bounds. We briefly comment on possible applications of our results to Message Sequence Charts.

Electronic Notes in Theoretical Computer Science-July 2009

An Initial Evaluation of Requirements Dependency Types in Change Propagation Analysis

Tue, 14 May 2013 00:00:00 +0000

Authors: Juan Li, Liming Zhu, Ross Jeffery, Jenny Liu, He (Jason) Zhang, Qing Wang, He (Jason) Zhang

Abstract: Change propagation analysis helps predict the parts of the software that may be affected if a change is made. Existing research on change propagation focuses on design and code level changes. However, as software evolves, the requirements that drive these changes also have intricate dependencies. Understanding the effect of these requirement dependencies on change prorogation is useful but not trivial. More than twenty requirements dependency types have been identified in the literature, however there still lacks an evaluation of the applicability of these dependency types in requirements and change propagation analysis. We conducted a case study in a real-world industry project to investigate whether requirements have dependencies and whether these dependencies are useful for change propagation analysis. Moreover we provide a group of specific dependency types for change propagation analysis based on our empirical findings. This case study evaluates two representative dependency models covering twenty five types of dependencies. Our initial evaluation has found that five dependency types are particularly useful in change propagation analysis and practitioners with different backgrounds have various viewpoints on change propagation. Thus change impact analysis should involve a wide range of stakeholders including project managers, requirements engineers, designers and developers. Our case study provides insights into requirements dependencies and their effects on change propagation analysis for both research and practice.

International Conference on Evaluation and Assessment in Software Engineering (EASE)-May 2012

A Portal to Support Rigorous Experimental Methodology in Networking Research

Tue, 14 May 2013 00:00:00 +0000

Authors: Guillaume Jourjon, Thierry Rakotoarivelo, Max Ott

Abstract: Whilst dealing with topics that are more and more influenced by physical properties of the underlying media, the networking community still lacks a culture of strong and rigorous results verification. Indeed, as opposed to most of the science and engineering fields there are very few benchmarks to test protocols against. Furthermore, in most publications the authors do not give the community access to the raw results and network configurations they used. Therefore it is impossible to accurately reproduce their experiments. We propose to solve this problem by extending the state of the art experimental tool OMF with a public portal. This portal, while providing the experimenter with access to experimental resources, also provides the community with a system for exhaustive experiment description and result verification. The col- lection of both the measurement set and the experiment’s description is done in a transparent manner for the experimenter, who can then decide to publish them via the portal once the research is mature enough.

7th International ICST Conference on Testbeds and Research Infrastructures for the Development of Networks and Communities (Tridentcom)-April 2011

Applying a Selection Method to Choose Quality Attribute Techniques

Tue, 14 May 2013 00:00:00 +0000

Authors: Yin Kia Chiam, Mark Staples, Xin Ye, Liming Zhu

Abstract: Context: Software products have requirements on various software quality attributes such as safety or performance. Development teams use various specific techniques to achieve these quality requirements. We call these Quality Attribute Techniques (QAT). QATs are used to identify, analyse and control potential product quality problems. Although QATs are widely used in practice, there is no systematic approach to represent, select, and integrate them in existing approaches to software process modelling and tailoring.Objective: This research aims to provide a systematic approach to better select and integrate QATs into tailored software process models for projects developing products with specific product quality requirements.Method: A selection method is developed to support the choice of appropriate techniques for any quality attribute, across the lifecycle. The selection method is based on three perspectives: 1) risk management; 2) process integration; and 3) cost/benefit using Analytic Hierarchy Process (AHP). Literature-based evaluation is used to validate and improve the initial framework. An industry case study is used to validate the feasibility and effectiveness of applying the framework and selection method.Results: The case study demonstrates that the selection method provides a more methodological and effective approach to choose QATs for projects that target a specific quality attribute, compared to the ad hoc selection performed by development teams.Conclusion: The selection method can be used to systematically choose QATs for projects to target specific product qualities throughout lifecycle.

Information and Software Technology-February 2013

Statistical Model Checking of Wireless Mesh Routing Protocols

Tue, 14 May 2013 00:00:00 +0000

Authors: Peter Höfner, Annabelle McIver

Abstract: Several case studies indicate that model checking is limited in the analysis of mesh networks: state space explosion restricts applicability to at most 10 node networks, and quantitative reasoning, often sufficient for network evaluation, is not possible. Both deficiencies can be overcome to some extent by the use of statistical model checkers, such as SMC-Uppaal. In this paper we illustrate this by a quantitative analysis of two well-known routing protocols for wireless mesh networks, namely AODV and DYMO. Moreover, we push the limits and show that this technology is capable of analysing networks of up to 100 nodes.

5th NASA Formal Methods Symposium NFM 2013)-May 2013

Reconciling Bitter Rivals: Towards Privacy-Aware and Bandwidth Efficient Mobile Ads Delivery Networks

Tue, 14 May 2013 00:00:00 +0000

Authors: Aruna Seneviratne, Kanchana Thilakarathna, Suranga Seneviratne, Mohamed Ali Kaafar, Prasant Mohapatra

Abstract: The use of free mobile services and applications (commonly referred as apps) are becoming increasingly popular. Such services and apps are generally monetized by means of third party advertising. The app developers and ad networks which provide the advertisements to be displayed within apps use every means to maximize their revenue, most often at the expense of the end user. These means of maximizing revenue impact the user in three ways: 1) Through the loss of privacy and control over their data; 2) through the increase in monetary cost due to communications overheads introduced by ad traffic; and 3) by the increase of battery usage. The introduction of rich media advertisements will have even greater implications with respect to the aforementioned bandwidth and battery consumption concerns. In this paper, we propose a novel architecture, called MASTAds, that combines the concepts of opportunistic networks, network intermediaries and predictive regularity of human behavior which enable both cost and energy-efficient ads delivery. In addition, MASTAds allows ad networks to obtain only the necessary information to provide targeted advertisements and high Ads revenues, whilst still preserving the user privacy.

The Fifth International Conference on COMmunication Systems and NETworkS (COMSNETS)-January 2013

On the Physical Layer Security in Large Scale Cellular Networks

Tue, 14 May 2013 00:00:00 +0000

Authors: He Wang, Xiangyun Zhou, Mark Reed

Abstract: This paper studies the information-theoretic secrecy performance in large-scale cellular networks based on a stochastic geometry framework. The locations of both base stations and the mobile users are modeled as independent two-dimensional Poisson point processes. We consider a key feature of the cellular network, namely, information exchange between base stations, and characterize its impact on the achievable secrecy rate of an arbitrary downlink transmission with a certain portion of the mobile users acting as potential eavesdroppers. In particular, analytical results are presented under diverse assumptions on the availability of eavesdroppers' location information at the serving base station, which captures the benefit from the exchange of mobile users' location information between base stations.

IEEE Wireless Communications and Networking Conference (WCNC)-May 2013

Evaluating User-centric Multihomed Flow Management for Mobile Devices in Simulated Heterogeneous Networks

Mon, 13 May 2013 00:00:00 +0000

Authors: Xi Li, Olivier Mehani, Roksana Boreli, Ramón Agüero, Yasir Zaki, Umar Toseef

Abstract: We propose to implement approaches to solve the multihomed flow managementproblem in the OPNET simulator. We formulate various decision methods asbinary integer programming problems and use them (with the CPLEX solver) todrive the network selection and flow distribution in the simulated scenarios. Weevaluate the behaviour of application flows depending on the decision method inuse. This allows us to more accurately evaluate these approaches' potential whenapplied to real network scenarios, were adaptation loops in protocols andalgorithms in the network stack may alter the expected performance.

MONAMI 2012, 4th International Conference on Mobile Networks and Management-September 2012