Blog: Twente Researcher Develops Self-Learning Security System for Computer Networks

Twente Researcher Develops Self-Learning Security System for Computer Networks
University of Twente (07/01/09) Bruysters, Joost

University of Twente researcher Damiano Bolzoni has developed SilentDefense, an anomaly network intrusion detection system that could lead to a new generation of network security systems. There are two types of network intrusion detection systems. The first uses a database of all known attacks to identify signatures of commonly used methods, but these systems have difficulty stopping new attack methods. The second uses anomaly detection, essentially learning how the network is normally used and searching for any deviation from the standard pattern. Bolzoni says anomaly detection is not widely used because truly effective systems are not commercially available, but he says SilentDefense will rectify this shortcoming. SilentDefense is based on self-learning algorithms, which significantly improves the accuracy of the system and reduces the odds of false positives. Bolzoni says the ideal network intrusion detection system is not one type or another but a combination of the two. However, before such a system can be created, he says a better anomaly detection system needs to be developed.

View Full Article

Blog: Metrorail Crash May Exemplify Automation Paradox

Metrorail Crash May Exemplify Automation Paradox
Washington Post (06/29/09) P. A9; Vedantam, Shankar

The fatal collision of two trains on Washington, D.C., Metro's Red Line may come to symbolize the core problem of automation, which is the relationship between humans and their automated control systems. "The better you make the automation, the more difficult it is to guard against these catastrophic failures in the future, because the automation becomes more and more powerful, and you rely on it more and more," says University of Wisconsin at Madison professor John D. Lee. As such systems become more reliable, the greater the likelihood that supervising humans will become less focused, which makes it increasingly probable that unanticipated variables will tangle up the algorithm and lead to disaster. The University of Toronto's Greg Jamieson notes that many automated systems explicitly instruct human operators to disengage, as they are designed to remove human "interference." "The problem is when individuals start to overtrust or over rely or become complacent and put too much emphasis on the automation," he says. Lee, Jamieson, and George Mason University psychologist Raja Parasuraman say there is growing agreement among experts that automated systems should be designed to augment the accuracy and performance of human operators rather than to replace them or make them complacent. A number of studies illustrate that operators can retain their alertness and skills through regular training exercises in which they switch from automated to manual control. Parasuraman has determined that "polite" feedback from a machine can enhance the machine-operator relationship to facilitate measurable safety improvements.

View Full Article - May Require Free Registration

Blog: Mozilla tackles XSS vulnerabilities with new technology

Mozilla tackles XSS vulnerabilities with new technology

Posted by Ryan Naraine June 22nd, 2009 @ 1:39 pm

Mozilla’s security engineers are working on new technology that promises to mitigate a large class of Web application vulnerabilities, especially the cross-site scripting (XSS) plague against modern Web browsers.

The project, called Content Security Policy, is designed to shut down XSS attacks by providing a mechanism for sites to explicitly tell the browser which content is legitimate. It can also help mitigate clickjacking and packet sniffing attacks.

Blog: Carnegie Mellon Develops Java Programming Tools Employing Human-Centered Design Techniques

Carnegie Mellon Develops Java Programming Tools Employing Human-Centered Design Techniques
Carnegie Mellon News (06/17/09) Spice, Byron

Carnegie Mellon University (CMU) researchers have developed Jadeite and Apatite, two tools designed to help programmers choose between the thousands of options available in the application programming interfaces (APIs) used to write Java applications. Jadeite and Apatite use human-centered design techniques to reduce the amount of time and guesswork that often is needed when working with Java APIs. Selecting APIs is a key aspect of Java programming, but it is not intuitive, says CMU professor Brad A. Myers. More than 35,000 methods are listed in 4,100 classes in the current Javadoc library of APIs, and more are being added with each Java update. Myers says working with Java APIs is a problem for developers at all levels. Jadeite (Java Documentation with Extra Information Tacked-on for Emphasis) improves usability by enhancing existing Javadoc documentation. For example, Jadeite displays the names of API classes in font sizes that correspond with how often they are used, based on Google searches, helping programmers avoid rarely used classes. Apatite (Associative Perusal of APIs That Identifies Targets Easily) allows programmers to browse APIs by association to see what packages, classes, and methods are often used with each other. Apatite also uses statistics on the popularity of each item to provide weighted opinions of the most relevant items.

View Full Article

Blog: Opera 'reinvents the Web'; Will anyone notice? Unite turns browser into a web server

Opera 'reinvents the Web'; Will anyone notice?

Larry Dignan: Opera on Tuesday unveiled technology it calls Opera Unite, which turns your plain old PC into a Web content server. Overall, the effort is quite innovative, but with Opera's browser market share, it's possible that no one will notice.

READ FULL STORY

Blog: Vanderbilt Doctors and Software Engineers Pioneer an Advanced Sepsis Detection and Management System

Vanderbilt Doctors and Software Engineers Pioneer an Advanced Sepsis Detection and Management System
VUCast (06/15/09) Salisbury, David F.

Researchers from Vanderbilt University's Medical Center and Institute for Software Integrated Systems have developed a real-time system for sepsis detection. In May, the system was tested in the medical center's intensive care unit, and this summer an automated decision support system will be added to help guide attending physicians through complex sepsis treatments. "This is an effort to use the power of informatics to move from reactive to proactive medical treatment by creating tools to support the use of evidence-based clinical guidelines," says Vanderbilt HealthTech Laboratory director Peter Miller, who is overseeing the project. Sepsis occurs when bacteria invade the body from wounds or intravenous lines, which over-stimulates the body's immune system and causes inflammatory and abnormal clotting responses. Sepsis can result in organ failure and death. The system features an automated early detection system that alerts doctors that a patient may be developing sepsis, based on temperature, heart rate, respiration rate, and white blood count. Creating the system involved developing a special modeling language specifically designed for clinical decision-making. Although the language is specific to sepsis management, the underlying technical infrastructure can be used to model almost any medical protocol, says Vanderbilt graduate student Janos Mathe.

View Full Article

Blog: Extracting Meaning From Millions of Pages

Extracting Meaning From Millions of Pages
Technology Review (06/10/09) Talbot, David

University of Washington researchers have developed an automated information extraction software engine that mines meaning out of more than 500 million Web pages, contributed by Google, by analyzing fundamental relationships between words. The project expands the scale of the TextRunner application in terms of the number of pages and the breadth of topics it can examine. "The significance of TextRunner is that it is scalable because it is unsupervised," says Google research director Peter Norvig. "It can discover and learn millions of relations, not just one at a time. With TextRunner, there is no human in the loop: It just finds relations on its own." University of Washington researcher and project leader Oren Etzioni says the prototype still has a simple interface and is meant to function as a demonstration of automated information extraction rather than as a public search tool. "This work reflects a growing trend toward the design of search tools that actively combine the pieces of information they find on the Web into a larger synthesis," notes Cornell University scientist Jon Kleinberg. The University of Washington researchers are now working on the building of inferences from natural-language queries, using TextRunner as a jumping-off point.

View Full Article