The Experts below are selected from a list of 16074 Experts worldwide ranked by ideXlab platform
Richard B Bunt - One of the best experts on this subject based on the ideXlab platform.
-
the effect of client caching on file server workloads
Hawaii International Conference on System Sciences, 1996Co-Authors: Kevin W Froese, Richard B BuntAbstract:A distributed file system provides a file service from one or more shared file servers to a community of client workstations over a network. While the Client-Server Paradigm has many advantages, it also presents new challenges to system designers concerning performance and reliability. As both client workstations and file servers become increasingly well-resourced, a number of system design decision need to be re-examined. This research concerns the caching of disk-blocks in a distributed Client-Server environment. Some recent research has suggested that various strategies for cache management may not be equally suited to the circumstances at both the client and the server. Since any caching strategy is based on assumptions concerning the characteristics of the demand, the performance of the strategy is only as good as the accuracy of this assumption. The performance of a caching strategy at a file server is strongly influenced by the presence of client caches since these caches alter the characteristics of the stream of requests that reaches the server. This paper presents the results of an investigation of the effect of client caching on the nature of the server workload as a step towards understanding the performance of caching strategies at the server. The results demonstrate that client caches alter workload characteristics in a way that leaves a profound impact on server cache performance, and suggest worthwhile directions for the future development of server caching strategies.
Homem Irvin - One of the best experts on this subject based on the ideXlab platform.
-
Advancing Automation in Digital Forensic Investigations
Stockholm : Department of Computer and Systems Sciences Stockholm University, 2018Co-Authors: Homem IrvinAbstract:Digital Forensics is used to aid traditional preventive security mechanisms when they fail to curtail sophisticated and stealthy cybercrime events. The Digital Forensic Investigation process is largely manual in nature, or at best quasi-automated, requiring a highly skilled labour force and involving a sizeable time investment. Industry standard tools are evidence-centric, automate only a few precursory tasks (E.g. Parsing and Indexing) and have limited capabilities of integration from multiple evidence sources. Furthermore, these tools are always human-driven. These challenges are exacerbated in the increasingly computerized and highly networked environment of today. Volumes of digital evidence to be collected and analyzed have increased, and so has the diversity of digital evidence sources involved in a typical case. This further handicaps digital forensics practitioners, labs and law enforcement agencies, causing delays in investigations and legal systems due to backlogs of cases. Improved efficiency of the digital investigation process is needed, in terms of increasing the speed and reducing the human effort expended. This study aims at achieving this time and effort reduction, by advancing automation within the digital forensic investigation process. Using a Design Science research approach, artifacts are designed and developed to address these practical problems. Summarily, the requirements, and architecture of a system for automating digital investigations in highly networked environments are designed. The architecture initially focuses on automation of the identification and acquisition of digital evidence, while later versions focus on full automation and self-organization of devices for all phases of the digital investigation process. Part of the remote evidence acquisition capability of this system architecture is implemented as a proof of concept. The speed and reliability of capturing digital evidence from remote mobile devices over a Client-Server Paradigm is evaluated. A method for the uniform representation and integration of multiple diverse evidence sources for enabling automated correlation, simple reasoning and querying is developed and tested. This method is aimed at automating the analysis phase of digital investigations. Machine Learning (ML)-based triage methods are developed and tested to evaluate the feasibility and performance of using such techniques to automate the identification of priority digital evidence fragments. Models from these ML methods are evaluated in identifying network protocols within DNS tunneled network traffic. A large dataset is also created for future research in ML-based triage for identifying suspicious processes for memory forensics. From an ex ante evaluation, the designed system architecture enables individual devices to participate in the entire digital investigation process, contributing their processing power towards alleviating the burden on the human analyst. Experiments show that remote evidence acquisition of mobile devices over networks is feasible, however a single-TCP-connection Paradigm scales poorly. A proof of concept experiment demonstrates the viability of the automated integration, correlation and reasoning over multiple diverse evidence sources using semantic web technologies. Experimentation also shows that ML-based triage methods can enable prioritization of certain digital evidence sources, for acquisition or analysis, with up to 95% accuracy. The artifacts developed in this study provide concrete ways to enhance automation in the digital forensic investigation process to increase the investigation speed and reduce the amount of costly human intervention needed.
-
Towards Automation in Digital Investigations : Seeking Efficiency in Digital Forensics in Mobile and Cloud Environments
Stockholm : Department of Computer and Systems Sciences Stockholm University, 2016Co-Authors: Homem IrvinAbstract:Cybercrime and related malicious activity in our increasingly digital world has become more prevalent and sophisticated, evading traditional security mechanisms. Digital forensics has been proposed to help investigate, understand and eventually mitigate such attacks. The practice of digital forensics, however, is still fraught with various challenges. Some of the most prominent of these challenges include the increasing amounts of data and the diversity of digital evidence sources appearing in digital investigations. Mobile devices and cloud infrastructures are an interesting specimen, as they inherently exhibit these challenging circumstances and are becoming more prevalent in digital investigations today. Additionally they embody further characteristics such as large volumes of data from multiple sources, dynamic sharing of resources, limited individual device capabilities and the presence of sensitive data. These combined set of circumstances make digital investigations in mobile and cloud environments particularly challenging. This is not aided by the fact that digital forensics today still involves manual, time consuming tasks within the processes of identifying evidence, performing evidence acquisition and correlating multiple diverse sources of evidence in the analysis phase. Furthermore, industry standard tools developed are largely evidence-oriented, have limited support for evidence integration and only automate certain precursory tasks, such as indexing and text searching. In this study, efficiency, in the form of reducing the time and human labour effort expended, is sought after in digital investigations in highly networked environments through the automation of certain activities in the digital forensic process. To this end requirements are outlined and an architecture designed for an automated system that performs digital forensics in highly networked mobile and cloud environments. Part of the remote evidence acquisition activity of this architecture is built and tested on several mobile devices in terms of speed and reliability. A method for integrating multiple diverse evidence sources in an automated manner, supporting correlation and automated reasoning is developed and tested. Finally the proposed architecture is reviewed and enhancements proposed in order to further automate the architecture by introducing decentralization particularly within the storage and processing functionality. This decentralization also improves machine to machine communication supporting several digital investigation processes enabled by the architecture through harnessing the properties of various peer-to-peer overlays. Remote evidence acquisition helps to improve the efficiency (time and effort involved) in digital investigations by removing the need for proximity to the evidence. Experiments show that a single TCP connection Client-Server Paradigm does not offer the required scalability and reliability for remote evidence acquisition and that a multi-TCP connection Paradigm is required. The automated integration, correlation and reasoning on multiple diverse evidence sources demonstrated in the experiments improves speed and reduces the human effort needed in the analysis phase by removing the need for time-consuming manual correlation. Finally, informed by published scientific literature, the proposed enhancements for further decentralizing the Live Evidence Information Aggregator (LEIA) architecture offer a platform for increased machine-to-machine communication thereby enabling automation and reducing the need for manual human intervention
Kevin W Froese - One of the best experts on this subject based on the ideXlab platform.
-
the effect of client caching on file server workloads
Hawaii International Conference on System Sciences, 1996Co-Authors: Kevin W Froese, Richard B BuntAbstract:A distributed file system provides a file service from one or more shared file servers to a community of client workstations over a network. While the Client-Server Paradigm has many advantages, it also presents new challenges to system designers concerning performance and reliability. As both client workstations and file servers become increasingly well-resourced, a number of system design decision need to be re-examined. This research concerns the caching of disk-blocks in a distributed Client-Server environment. Some recent research has suggested that various strategies for cache management may not be equally suited to the circumstances at both the client and the server. Since any caching strategy is based on assumptions concerning the characteristics of the demand, the performance of the strategy is only as good as the accuracy of this assumption. The performance of a caching strategy at a file server is strongly influenced by the presence of client caches since these caches alter the characteristics of the stream of requests that reaches the server. This paper presents the results of an investigation of the effect of client caching on the nature of the server workload as a step towards understanding the performance of caching strategies at the server. The results demonstrate that client caches alter workload characteristics in a way that leaves a profound impact on server cache performance, and suggest worthwhile directions for the future development of server caching strategies.
Samuel Pierre - One of the best experts on this subject based on the ideXlab platform.
-
mobile agents and their use for information retrieval a brief overview and an elaborate case study
IEEE Network, 2002Co-Authors: Roch Glitho, Edgar Olougouna, Samuel PierreAbstract:Mobile agents emerged in the mid-1990s, and have raised considerable interest in the research community. The proponents associate several benefits with their use. However, there are still very few quantitative measurements to back the claimed benefits. This article is devoted to mobile agents and their use for information retrieval. We provide a brief overview and an elaborate case study. The overview introduces the concept of mobile agent, enumerates the claimed benefits, and reviews the hindrances to widescale deployment. It also discusses the state of the art of mobile-agent-based information retrieval, including the very few quantitative studies that exist. Our case study is on information retrieval from electronic calendars for multiparty event scheduling. Many events require the participation of several parties. Prior knowledge of the date when most (if not all) targeted participants are available is often a prerequisite for scheduling them. However, identifying this date can easily turn into a nightmare, especially when the number of targeted participants is large. Nowadays, electronic agendas (e.g., MS Outlook) are stored on servers. An application can access them, retrieve information on the availability of the targeted participants, and derive the date from the information. In the case study, a mobile agent is dispatched in the network, instead of retrieving the information using the client/server Paradigm. The agent visits the servers, accesses the agendas, retrieves the information, and identifies the date. Finding a date suitable for several potential participants may require the rescheduling of some events that have been previously arranged by some participants. We propose the use of agents that act as the personal agents of the participants for the negotiation inherent to this rescheduling. The measurements we have made indicate clearly that the mobile-agent-based approach outperforms its client/server counterpart even when the latter is optimized. These results can easily be transposed to most information retrieval applications, and demonstrate, for this specific application domain, the performance benefit associated with mobile agents. We now dispatch a single agent in the network. In the future, we will dispatch several agents.
Krishnendu Chakrabarty - One of the best experts on this subject based on the ideXlab platform.
-
multiresolution data integration using mobile agents in distributed sensor networks
Systems Man and Cybernetics, 2001Co-Authors: S. S. Iyengar, Krishnendu ChakrabartyAbstract:We describe the use of the mobile agent Paradigm to design an improved infrastructure for data integration in a distributed sensor network (DSN). We use the acronym MADSN to denote the proposed mobile-agent-based DSN. Instead of moving data to processing elements for data integration, as is typical of a client/server Paradigm, MADSN moves the processing code to the data locations. This saves network bandwidth and provides an effective means for overcoming network latency, since large data transfers are avoided. Our major contributions are the use of mobile agent in DSN for distributed data integration and the evaluation of performance between DSN and MADSN approaches. We develop an enhanced multiresolution integration (MRI) algorithm where multiresolution analysis is applied at a local node before accumulating the overlap function by mobile agent. Compared to the MRI implementation in DSN, the enhanced integration algorithm saves up to 90% of the data transfer time. We develop objective functions to evaluate the performance between DSN and MADSN approaches. For a given set of network parameters, we analyze the conditions under which MADSN performs better than DSN and determine the condition under which MADSN reaches its optimum performance level.