Browsing by Author "Wu, Yu-Sung"

Now showing 1 - 15 of 15

Active versus Passive Malware Collection
(2014-04-01)
Lin, Ying-Dar
;
Lee, Chia-Yin
;
Wu, Yu-Sung
;
Ho, Pei-Hsiu
;
Wang, Fu-Yu
An exploration of active and passive malware honeypots reveals that the two systems yield vastly different malware collections and that peer-to-peer file sharing is an important, but often overlooked, malware source.
Application Dependency Tracing for Message Oriented Middleware
(2014)
Wu, Li-Juin
;
Li, Hong-Wei
;
Cheng, Yu-Jui
;
Wu, Yu-Sung
;
Lin, Houcheng
Software defined infrastructure greatly reduces the deployment cost of distributed applications. Many distributed applications employ message oriented middleware (MOM) for the integration of heterogeneous components and to achieve scalability and fault tolerance. The structure of a distributed application can be very complex. In addition, the asynchronous message delivery model of MOM further complicates the runtime behavior of a distributed application. To diagnose a faulty distributed application, one often needs to determine the dependences of its messages, and by extension, the dependences of its components. We propose Message Tracer to identify the message dependencies of a MOM-based distributed application. Message Tracer sniffs the network traffic of MOM and uses knowledge of message broker protocols to establish the dependencies. Message Tracer makes no assumption on the application threading model and incurs negligible performance overhead. Message Tracer correctly identified 95% of the dependencies for the common use cases and 75% of the dependencies when the system was under extreme stress.
Application Execution Time Prediction for Effective CPU Provisioning in Virtualization Environment
(2017-11-01)
Li, Hong-Wei
;
Wu, Yu-Sung
;
Chen, Yi-Yung
;
Wang, Chieh-Min
;
Huang, Yen-Nun
Provisioning of hardware resources through virtual machines (VMs) has been widely used for supporting server consolidation and infrastructure-as-a-cloud computing. We propose NICBLE to support accurate CPU resource provisioning for application workload running on VMs. While CPU is essential for any application workload, not every workload requires the same level of CPU resource. The VM tenants may also have different expectations of application performance and preferences. NICBLE models the execution of an application workload and employs a simulation-based algorithm to predict the impact on application execution time for a hypothetical VM configuration change on the number of CPUs. One may use NICBLE to reason about whether changing the number of CPUs will significantly affect the application performance. We built the NICBLE prototype on top of the Xen hypervisor [1]. NICBLE does not require modification to the guest systems. The performance overhead on the guest system is negligible. Our evaluation indicates that NICBLE is able to provide accurate prediction with an average error rate of less than 15 percent for non-adaptive application workload.
EagleEye: Towards Mandatory Security Monitoring in Virtualized Datacenter Environment
(2013)
Wu, Yu-Sung
;
Sun, Pei-Keng
;
Huang, Chun-Chi
;
Lu, Sung-Jer
;
Lai, Syu-Fang
Virtualized datacenter (VDC) has become a popular approach to large-scale system consolidation and the enabling technology for infrastructure-as-a-service cloud computing. The consolidation inevitably aggregates the security threats once faced by individual systems towards a VDC, and a VDC operator should remain vigilant of the threats at all times. We envision the need for on-demand mandatory security monitoring of critical guest systems as a means to track and deter security threats that could jeopardize the operation of a VDC. Unfortunately, existing VDC security monitoring mechanisms all require pre-installed guest components to operate. The security monitoring would either be up to the discretion of individual tenants or require costly direct management of guest systems by the VDC operator. We propose the EagleEye approach for on-demand mandatory security monitoring in VDC environment, which does not depend on pre-installed guest components. We implement a prototype on-access anti-virus monitor to demonstrate the feasibility of the EagleEye approach. We also identify challenges particular to this approach, and provide a set of solutions meant to strengthen future research in this area.
Enforcing Enterprise Mobile Application Security Policy with Plugin Framework
(2018-01-01)
Chu, Pang-Yang
;
Lu, Wei-Huan
;
Lin, Jun-Wei
;
Wu, Yu-Sung
;
資訊工程學系
The prevalent use of mobile applications in enterprise computing requires more stringent yet flexible enforcement of security policies on the mobile devices. Existing enforcement mechanisms such as mobile device management system focus on the management of device features and cannot cover the diverse security policies of enterprise applications precisely. We address the challenge by proposing a novel security policy enforcement system based on Plugin framework. The system provides fine-grained security policy enforcement at each library call site in an application. With root privilege (targeting company-owned devices), fine-grained enforcement can be applied to any application. Without root privilege (targeting BYOD devices), fine-grained enforcement can be applied to the applications installed via the enforcement system.
Exploiting Neigborhood Similarity for Virtual Machine Migration over Wide-Area Network
(2013)
Lai, Hsu-Fang
;
Wu, Yu-Sung
;
Cheng, Yu-Jui
;
資訊工程學系
;
Department of Computer Science
Conventional virtual machine (VM) migration focuses on transferring a VM's memory and CPU states across host machines. The VM's disk image has to remain accessible to both the source and destination host machines through shared storage during the migration. As a result, conventional virtual machine migration is limited to host machines on the same local area network (LAN) since sharing storage across wide-area network (WAN) is inefficient. As datacenters are being constructed around the globe, we envision the need for VM migration across datacenter boundaries. We thus propose a system aiming to achieve efficient VM migration over wide area network. The system exploits similarity in the storage data of neighboring VMs by first indexing the VM storage images and then using the index to locate storage data blocks from neighboring VMs, as opposed to pulling all data from the remote source VM across WAN. The experiment result shows that the system can achieve an average 66% reduction in the amount of data transmission and an average 59% reduction in the total migration time.
FUSION: A Unified Application Model for Virtual Mobile Infrastructure
(2017-01-01)
Wang, Chieh-Min
;
Wu, Yu-Sung
;
Chung, Hsing-Hsuan
;
資訊工程學系
;
Department of Computer Science
We proposed a unified application model for virtual mobile infrastructure called FUSION. FUSION bridges the gap between the remote VMI server and the client-side mobile device via supporting bi-directional IPC(inter-process communication) and loosely synchronized file system. FUSION classifies IPC events into two types: IPC events without accessing local resources and IPC events accessing local resource. For IPC events without accessing local resources, FUSION simply hooks the IPC events, forwards them to the remote peer and replays them in the remote environment. For complex IPC events involving with accessing files located in the local device, FUSION will analyze each individual IPC event and transmit the corresponding files to the remote peer with respect to each IPC event. Once the remote application completes its job and the user tries to disconnect with the remote peer, FUSION will synchronize those files back to the local side. The synchronization makes the file changes updated by the remote application visible to the local side. Base on our experimental results, FUSION incurs less than 1% overhead on the system. For simple IPC events without local resource access, FUSION can transmit those IPC events to the remote peer under various network conditions in less than 1200ms. For complex IPC events involving local resource access, FUSION can also serialize and transmit the files efficiently.
HIT: Hybrid-mode Information Flow Tracking with Taint Semantics Extraction and Replay
(2018-01-01)
Hung, Yu-Hsin
;
Li, Hong-Wei
;
Wu, Yu-Sung
;
Jheng, Bing-Jhong
;
Huang, Yen-Nun
Due to increasing complexity in security attacks, it is no longer sufficient to rely on generic network-level and system-level events for attack detection. We propose the hybrid-mode information flow tracking (HIT) system to reveal application-level events by integrating static information analysis (IFA) and dynamic information flow tracking (DIFT) into the applications. Preliminary results indicate the effectiveness of the approach in detecting sensitive data leakage with a modest performance overhead.
MicroApp: Architecting Web Application for Non-Uniform Trustworthiness in Cloud Computing Environment
(2014-01-01)
Hsu, Yen-Chun
;
Wu, Yu-Sung
;
Tsai, Tsung-Han
;
Chiu, Yi-Pin
;
Lin, Chih-Hung
An increasing number of web applications are now hosted in cloud infrastructures such as Amazon Web Services. Cloud infrastructures generally lack a uniform guarantee on security, reliability, performance, and cost. A privately owned cloud infrastructure may be considered more secure but less performant than a third-party public cloud infrastructure. Infrastructures that span across geographical regions may further incur complications on the trustworthiness of infrastructures due to the varying power of jurisdiction. Application developers have to be aware of the non-uniformity of infrastructure trustworthiness when deploying applications in the cloud. We propose the MicroApp architecture that help address the difficulty in dealing with the non-uniformity. MicroApp splits a web application into multiple micro applications. Each micro application encapsulates a port of the code and data with the same level of security and integrity requirement. The micro applications will then be deployed to corresponding infrastructures that satisfy the respective requirements. MicroApp provides an RPC mechanism to allow control flows across micro applications. The architecture can be transparently applied to existing web applications and allows an application to effectively adapt to the cloud environment.
Network Performance Bottleneck Detection and Maximum Network Throughput Estimation for Datacenter Applications
(2016)
Ngai, Patrick
;
Lu, Sung-Jer
;
Wu, Yu-Sung
;
Lim, Wei-Sheng
;
Lin, Tung-Yueh
For applications deployed in third-party datacenter environments to attain cost-effective performance, it requires precise provisioning of hardware resources such as assigning appropriate network bandwidth to an application. However, it is not always clear how much resource should be assigned to an application. In this work, we propose NBD (Network performance Bottleneck Detector) to detect the network bandwidth requirement of a datacenter application. NBD is fully transparent and does not require modification of applications. It correctly reports the required bandwidth of an application even when the preset network bandwidth is far below the required bandwidth. NBD employs a novel technique called network flow distortion for the estimation of application network bandwidth requirement. The evaluation results indicate that NBD is effective and only incurs mild performance overhead.
Phrase Search for Encrypted Cloud Storage
(2018-03-01)
Chen, Yen-Chung
;
Wu, Yu-Sung
;
Tzeng, Wen-Guey
;
資訊工程學系
;
Department of Computer Science
With the growth in the popularity of cloud storage service (CSS), the accumulation of private data on the cloud requires the use of data encryption to prevent leakage of sensitive information to untrusted third parties. However, as the amount of data kept on the cloud storage is increasing, the use of data encryption makes it difficult or even impossible to locate the data of interest efficiently and securely. In this paper, we present a framework for CSS to support queries in encrypted form so that the data on cloud storage can be located efficiently and securely. At the core of the framework is a novel indexing structure, called the bloom filter encrypted search tree (BFEST). The BFEST supports queries in the form of phrase keywords. Client-side encryption, using secret keys that are unknown to the cloud service provider, protects the queries and the retrieved data. We implemented a prototype by extending the hicloud S3 [13] CSS with the proposed framework. The experimental results indicate that the framework can ensure query privacy for encrypted data with an acceptable performance overhead in a practical setting.
Secure and transparent network traffic replay, redirect, and relay in a dynamic malware analysis environment
(2014-03-01)
Lin, Ying-Dar
;
Shih, Tzung-Bi
;
Wu, Yu-Sung
;
Lai, Yuan-Cheng
;
資訊工程學系
Semantic Failover in Software-Defined Networking
(2018-01-01)
Hsueh, Shu-Wen
;
Lin, Tung-Yueh
;
Lei, Weng-Ian
;
Ngai, Chi-Leung Patrick
;
Sheng, Yu-Hang
Software-defined networking (SDN) eases the management of large-scale network by providing centralized and programmable control of a network. The centralization inevitably creates a single point of failure and requires the use of redundant controllers. However, due to the need for replicating the SDN application states, existing solutions tend to assume that the controllers are of the same type. This imposes an undesirable trade-off between cost and availability as each active controller would require a dedicated standby controller of the same type. We propose semantic failover to address the issue, which allows generic failover across any types of controllers. Semantic failover models the SDN application states from the control plane messages and restores the application states by invoking the northbound API on the standby controller. It is thereby not dependent on specific types of controllers. The prototype system was tested on real-world SDN controllers, and the evaluation results have demonstrated the potentials of semantic failover for both homogenous and heterogeneous controller pairs.
Smartphone Virtualization
(2016)
Chiueh, Tzi-cker
;
Lin, Houcheng
;
Chao, Ares
;
Anthony
;
Wu, Tan-Gen
Virtualization plays a pivotal role in the success of cloud computing service models and is applied extensively in modern public and private data centers. However, its adoption on end user devices such as laptop/desktop computers and cell phones is relatively scarce, mainly because convincing use cases for client device virtualization have proven elusive so far. As smartphones emerge as the linchpin of everyday computing and communication for regular people and application download becomes a fact of life, the Bring Your Own Cloud (BYOD) problem, in which corporate employees connect their own smartphones to the corporate networks for office work, has put most enterprises in an unenvious position of making a difficult choice between corporate security and employee productivity. One effective solution to the BYOD problem is smartphone virtualization, which provides multiple virtual smartphones on a physical smartphone, and enables a user to use a highly secure but not so flexible virtual smartphone in the work environment and a less secure but more flexible virtual smartphone when outside the work environment. This paper describes the design and implementation of a comprehensive smartphone virtualization system called Brahma, which consists of a virtualized smartphone element and a virtual mobility infrastructure element, and presents the detailed evaluation results of the first Brahma prototype on a commercial smartphone.
Towards Consistent Software Defined Networking with Logic Programming
(2015)
Lui, Eric
;
Wu, Yu-Sung
;
Ngai, Patrick
;
Lin, Tung-Yueh
;
Li, Hong-Wei
Software Defined Networking (SDN) allows the construction of virtual networks on top of a datacenter network infrastructure. However, the flexibility also increases the chance of inconsistencies in the network configurations caused by component failures, software bugs, or human errors. The inconsistencies may result in service outage or security policy violation. We propose a model-based verification system to check the consistency of a virtual network. The system models the requirements as logic constraints and extracts the configuration states of a virtual network. The configuration states are checked against the logic constraints by using a SMT solver[1]. The prototype system successfully detects various inconsistencies injected to the testbed and incurs reasonable amount of overheads.