DistOS-2011W Justice - Revision history

Dbarrera: /* Case 3: Phishing */

2011-04-12T00:50:00Z

Case 3: Phishing

← Older revision		Revision as of 00:50, 12 April 2011
Line 221:		Line 221:
	===Case 3: Phishing===		===Case 3: Phishing===
	Phishing provides an interesting challenge for a justice system as the deviant act involves a website that is perfectly legal. A phishing attack occurs when a malicious site pretends to be a legitimate site, tricking users into revealing banking or personal information.		Phishing provides an interesting challenge for a justice system as the deviant act involves a website that is perfectly legal. A phishing attack occurs when a malicious site pretends to be a legitimate site, tricking users into revealing banking or personal information.

			'''Evidence collected.''' The fraudulent site URL and the legitimate site URL

	==== Solution ====		==== Solution ====
	~~Similar to the comment spam attack, once a phishing site is reported and verified by the judges, the morality rating of the hosting node is lowered.~~

			'''Local implementation'''

			*Users report phishing site.
			*Based on the morality of the host of a phishing site, it may be removed from the network.

			'''Global implementation'''

			*Same method of reporting and morality adjustment as the local implementation above.
			*Removal from the network is not really possible, but the client can read the server's morality rating upon connecting

	=Conclusion=		=Conclusion=

Dbarrera: /* Case 2: Denial of Service */

2011-04-12T00:47:51Z

Case 2: Denial of Service

← Older revision		Revision as of 00:47, 12 April 2011
Line 205:		Line 205:
	===Case 2: Denial of Service===		===Case 2: Denial of Service===
	Denial of service is the act in which a service that is normally available is accessed by a large number of hosts, or a small number of hosts with high frequency. Services under a denial of service (DoS) or distributed denial of service (DDoS) attack are no longer able to serve legitimate requests [14].		Denial of service is the act in which a service that is normally available is accessed by a large number of hosts, or a small number of hosts with high frequency. Services under a denial of service (DoS) or distributed denial of service (DDoS) attack are no longer able to serve legitimate requests [14].

			'''Evidence collected.''' ID of any host connecting to the victim server for the duration of the attack.

	==== Solution ====		==== Solution ====

Dbarrera: /* Case 2: Denial of Service */

2011-04-12T00:47:04Z

Case 2: Denial of Service

← Older revision		Revision as of 00:47, 12 April 2011
Line 207:		Line 207:

	==== Solution ====		==== Solution ====
			'''Local implementation'''

	~~In the Justice Web, the server will have to look up the~~ morality ~~rating for~~ each ~~host that~~ is ~~participating in~~ the ~~attack which~~ may ~~further increase the~~ load on the ~~server~~. ~~The global~~ implementation ~~would see the~~ morality ~~ratings of each incoming connection and~~ could ~~filter~~ (~~for~~ e.~~g.,~~ at a firewall level) ~~hosts that have a certain rating~~. ~~While Dos is generally regarded as~~ a ~~very difficult problem to solve, the~~ morality ~~rating of hosts participating~~ would be ~~lowered, possibly limiting their ability to perform an attack in the future~~.		*The morality of each user is looked up to see if the request should be managed. This may cause even greater load on the host.
			*Once it has been established that participants of the attack have an unacceptable morality rating, they are blocked from communication with the site.

			'''Global implementation'''

			*Since morality rating is passed in with communication, requests could be filtered out (i.e. at a firewall level).
			*Any incoming communication with a bad enough morality would simply be ignored.

	===Case 3: Phishing===		===Case 3: Phishing===

Dbarrera: /* Case 1: Comment Spam */

2011-04-12T00:45:22Z

Case 1: Comment Spam

← Older revision		Revision as of 00:45, 12 April 2011
Line 188:		Line 188:
	===Case 1: Comment Spam===		===Case 1: Comment Spam===
	The first deviant act we investigate is comment spam. This type of spam is typically generated by automated scripts which insert comments on blogs or other sites. Posted comments will generally contain links to other websites which attempt to sell a product or trick the user into revealing banking credentials. Although usually annoying, these comments can direct users to locations where malicious code may be downloaded, even if the original site hosting the comment was initially trusted.		The first deviant act we investigate is comment spam. This type of spam is typically generated by automated scripts which insert comments on blogs or other sites. Posted comments will generally contain links to other websites which attempt to sell a product or trick the user into revealing banking credentials. Although usually annoying, these comments can direct users to locations where malicious code may be downloaded, even if the original site hosting the comment was initially trusted.

			'''Evidence collected.''' The comment being reported as spam as well as the website hosting the comment (forum, blog, etc.) The ID of the commenter is also collected, assuming we have a unique identifier for each commenting host.

	==== Solution ====		==== Solution ====
	~~Web servers that allow open comments can adjust~~ the ~~required minimum~~ morality rating to post ~~a comment. Additionally, if comment spam is detected by another user or~~ the site ~~administrator, the message and~~ the ID of the ~~host that posted~~ the comment ~~is reported~~. ~~This results in~~ a host ~~losing~~ morality rating for ~~posting comment spam which may limit its ability to post in~~ the ~~future. In the global implementation, web servers would reject access~~ to the ~~service altogether from the first initial connection~~.		'''Local implementation'''

			*Users report comment spam
			*The morality of the offending host is adjusted if the evidence is found to incriminate the host.
			*Based on the new morality rating, the offending host may not be allowed to post to the site depending on the restrictions of the hosting server

			'''Global implementation'''

			*Same method for reporting the comment spam, and for adjusting the morality rating as the local implementation above.
			*If a host has a sufficiently low morality rating, the host site will disable the ability for the offending host to communicate with the site at all.

	===Case 2: Denial of Service===		===Case 2: Denial of Service===

Mchou2: /* Conclusion */

2011-04-11T01:49:44Z

Conclusion

← Older revision		Revision as of 01:49, 11 April 2011
Line 207:		Line 207:

	=Conclusion=		=Conclusion=
	Applying justice to a distributed system requires an understanding of how society runs in a teleologic or retributive method of punishments, as well as knowing the range between purposely and negligently participating in such an act. Discussions of punishment and intent brought up another social construct that exists in society - morality. When looking at a single computer, it is hard for us to consider that that computer had "intended" on doing something, or even that it had felt badly if we made it do a bunch or repetitive operations as a form of punishment. Even though implementing emotions and a care for self preservation is difficult for a computer, we can at least apply a morality value to each computer node, so that it may be judged by any individual that plans on communicating/interacting with that node.		Applying justice to a distributed system requires an understanding of how society runs in a teleologic or retributive method of punishments, as well as knowing the range between purposely and negligently participating in such an act. Discussions of punishment and intent brought up another social construct that exists in society - morality. When looking at a single computer, it is hard for us to consider that that computer had "intended" on doing something, or even that it had felt badly if we made it do a bunch or repetitive operations as a form of punishment. Even though implementing emotions and a care for self preservation is difficult for a computer, we can at least apply a morality value to each computer node, so that it may be judged by any individual that plans on communicating/interacting with that node. By discussing specific cases in which a justice system would take part in a distributed system, we can conceptualize a basis upon which a future implementation of justice on computers might be possible. Given the advantages and the disadvantages of implementing such a system on a local and global scale, it is evident that there requires a more in depth look into how some technical aspects, as well as the assumptions to be supported by the other factors on the internet(attribution, reputation, contracts), must be upheld in order to seek the means to fight injustice, and to turn fear against those who prey on the fearful, as malicious users do to users who do not have protection - this is what the justice web is for.

	=Resources=		=Resources=

Mchou2: /* Conclusion */

2011-04-09T18:15:18Z

Conclusion

← Older revision		Revision as of 18:15, 9 April 2011
Line 207:		Line 207:

	=Conclusion=		=Conclusion=
	Applying justice to a distributed system requires an understanding of how society runs in a teleologic or retributive method of punishments, as well as knowing the ~~difference~~ between		Applying justice to a distributed system requires an understanding of how society runs in a teleologic or retributive method of punishments, as well as knowing the range between purposely and negligently participating in such an act. Discussions of punishment and intent brought up another social construct that exists in society - morality. When looking at a single computer, it is hard for us to consider that that computer had "intended" on doing something, or even that it had felt badly if we made it do a bunch or repetitive operations as a form of punishment. Even though implementing emotions and a care for self preservation is difficult for a computer, we can at least apply a morality value to each computer node, so that it may be judged by any individual that plans on communicating/interacting with that node.

	=Resources=		=Resources=

Mchou2 at 18:04, 9 April 2011

2011-04-09T18:04:37Z

← Older revision		Revision as of 18:04, 9 April 2011
Line 204:		Line 204:
	==== Solution ====		==== Solution ====
	Similar to the comment spam attack, once a phishing site is reported and verified by the judges, the morality rating of the hosting node is lowered.		Similar to the comment spam attack, once a phishing site is reported and verified by the judges, the morality rating of the hosting node is lowered.


			=Conclusion=
			Applying justice to a distributed system requires an understanding of how society runs in a teleologic or retributive method of punishments, as well as knowing the difference between

	=Resources=		=Resources=

Dbarrera at 16:09, 5 April 2011

2011-04-05T16:09:52Z

← Older revision		Revision as of 16:09, 5 April 2011
Line 5:		Line 5:
	* David Barrera		* David Barrera

	~~Note~~: ~~research so far moved to Discussion section~~.		[[https://docs.google.com/present/edit?id=0AQJ2IGOeo68XZGhuNnJ0YjRfM2doZDg3Ymc5&hl=en&authkey=CK7Mk4YO Presentation]]

	=Abstract=		=Abstract=

Cha0s: /* Local Implementation (Justice Web) */

2011-04-05T12:51:44Z

Local Implementation (Justice Web)

← Older revision		Revision as of 12:51, 5 April 2011
Line 152:		Line 152:

	Evidence logs are required to prove the occurrence of a rule violation. The Justice Web therefore requires hosts to keep logs of recent network (e.g., packet captures) and application layer activity (e.g., web server logs). We require these logs to be digitally signed or encrypted to ensure that the computer making the claim or any other system in the chain of custody does not tamper with evidence. When evidence is received by judges, the logs are decrypted and reviewed.		Evidence logs are required to prove the occurrence of a rule violation. The Justice Web therefore requires hosts to keep logs of recent network (e.g., packet captures) and application layer activity (e.g., web server logs). We require these logs to be digitally signed or encrypted to ensure that the computer making the claim or any other system in the chain of custody does not tamper with evidence. When evidence is received by judges, the logs are decrypted and reviewed.
	The type of evidence required is varied, and is defined by the Judges of a network. For a DDoS attack, the Justice Web would be able to look at the evidence logs and determine which computers were actively involved in the attack, and which was legitimate traffic~~, as described in \\link paper here~~.		The type of evidence required is varied, and is defined by the Judges of a network. For a DDoS attack, the Justice Web would potential be able to look at the evidence logs and determine which computers were actively involved in the attack, and which was legitimate traffic through the analysis of statistical evidence[17].

	===Membership===		===Membership===

Cha0s at 12:50, 5 April 2011

2011-04-05T12:50:29Z

← Older revision		Revision as of 12:50, 5 April 2011
Line 237:		Line 237:

	[16] S. Ghemawat, H. Gobioff, and S.T. Leung, ''The Google File System'', in Proceedings of the ACM SIGOPS Operating Systems Review. 2003		[16] S. Ghemawat, H. Gobioff, and S.T. Leung, ''The Google File System'', in Proceedings of the ACM SIGOPS Operating Systems Review. 2003

			[17] S. Yu, W. Zhou, R. Doss, ''Information theory based detection against network behavior mimicking DDoS attacks'', IEEE, April 2008, [http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4489680&tag=1]. Last visited April 2011.