Security information and event management (SIEM)

• Security information and event management

Security Information and Event Management (SIEM) solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM (security event manager).
SIEM technology provides real-time analysis of security alerts generated by network hardware and applications.
SIEM solutions come as software, appliances or managed services, and are also used to log security data and generate reports for compliance purposes
http://en.wikipedia.org/wiki/Security_information_and_event_management

• Security event manager

A security event manager (SEM) is a computerized tool used on enterprise data networks to centralize the storage and interpretation of logs, or events, generated by other software running on the network


Many systems and applications which run on a computer network generate events which are kept in event logs. These logs are essentially lists of activities that occurred, with records of new events being appended to the end of the logs as they occur. Protocols, such as Syslog and SNMP, can be used to transport these events, as they occur, to logging software that is not on the same host on which the events are generated


http://en.wikipedia.org/wiki/Security_event_manager

• Security information management

Security information management (SIM) is the industry-specific term in computer security referring to the collection of data (typically log files; e.g. eventlogs) into a central repository for trend analysis

Most famous editors and solutions in the SIM/SEM Marketplace


    Alcatel-Lucent OA Safeguard
    Araknos Akab2
    BlackStratus Netforensics
    Cisco Cisco Security Manager
    Correlog Correlog Solution Suite
    CS Prelude/Vigilo
    EMC2 RSA Security
    HP ArcSight
    LogLogic Enterprise Virtual Appliance (formerly Exaprotect)
    LogRhythm SIEM 2.0 Security Intelligence
    NetIQ Security Manager
    NitroSecurity McAfee Enterprise Security Manager
    Novell Sentinel
    Q1 Labs Qradar (an IBM Company)
    SenSage Advanced SIEM and Log Management
    Splunk Splunk
    Symantec Security Information Manager
    TrustWave Intellitactics Security Manager for SIEM

http://en.wikipedia.org/wiki/Security_information_management

• OSSIM, the Open Source SIEM

OSSIM is the most widely used SIEM offering, thanks in no small part to the open source community that has promoted its use. OSSIM provides all of the capabilities that a security professional needs from a SIEM offering, event collection, normalization, correlation, and incident response - but it also does far more. Not simply satisfied with integrating data from existing security tools, OSSIM is built on the Unified Security Management platform which provides a common framework for the deployment, configuration, and management of your security tools
http://communities.alienvault.com/

• OSSIM

Open Source Security Information Management (OSSIM) provides a Security Information and Event Management (SIEM) solution. It is a one-stop solution and integrated the open source software’s NTOP, Mrtg, Snort, OpenVAS, and Nmap. OSSIM is a cost-effective solution in the area of monitoring network health and security of network/hosts compared to other propriety products.

OSSIM, AlienVault’s Open Source Security Information and Event Management (SIEM) product, provides you with a feature-rich open source SIEM complete with event collection, normalization, and correlation.
https://www.alienvault.com/products/ossim

• Security Information and Event Management (SIEM) solutions

Security Information and Event Management (SIEM) solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM (security event manager)

SIEM technology provides real-time analysis of security alerts generated by network hardware and applications

http://en.wikipedia.org/wiki/Security_information_and_event_management

• Eyes on Glass: End to End Monitoring

Organizations’ IT Infrastructure will function best when a continuous set of “eyes” are closely analyzing its health and availability; and proactively identifying the issues that keep the business up and running.
What plays a pivotal role in defining an overall IT monitoring strategy is ensuring a healthy data center along with end user experience coverage.
https://www.zensar.com/blogs/2015/12/eyes-on-glass-end-to-end-monitoring/

• Next Generation SOC

The Techniques, Tactics and Procedures – The Cyber Kill Chain
real-time “eyes on glass” monitoring
http://www.itip.ph/uploads/events_files/IBM_SOC.pAp%E0%9C%90%9C%8C%81P%EC%3C%BFi%B3Y9%06a%D2%94%01%FF*Z%E3T%89R425%5B,%0C%C3%B2,%07%BD%8Ae%19%86%B1X%CC&%93%8C)%1F%CE%D7%9C%18%14%8B%EA%F4z%03F%A5i%23%CE%04%AD%25%B3%D04EQ%06%05S%5Bs)%8AH%91)B%D5cW%25

• WHAT IS A MSSP (MANAGED SECURITY SERVICES PROVIDER?

A managed security service provider (MSSP) is an IT service provider that provides an organization with information security, cybersecurity monitoring and management, which may include policy development, security operation center, compliance services, incident response service, Virtual CISO, risk management program, vulnerability testing, penetration testing, security training and awareness, virus and spam blocking, intrusion detection, firewalls and virtual private network (VPN) management

MSSP technology offerings may include deploying, configuring, and/or managing the following technologies:

Intrusion prevention systems (IPS)
Web content filtering
Anti-virus (AV),
Anti-spam
Firewalls (UTMs, NGFWs, etc.)
VPN
Vulnerability scanning
Patch management
Data loss prevention (DLP)
Threat intelligence
Identity access management (IAM)
Privileged access management (PAM)

MSSP services may include:

Risk assessments and gap analysis
Policy development and risk management
Solution scoping
Solution/tool research and requisition
Solution implementation
Management of security systems
Configuration management
Security updates
Reporting, auditing, and compliance
Training and education

“Traditionally, MSSPs have been overwhelmingly focused on the perimeter,” assesses Keve. “And, while MSSP offerings are evolving, even today, few MSSP’s tackle IAM.
Another differentiation between MSPs versus MSSPs is NOCs versus SOCs. MSPs frequently establish their own network operation center (NOC) from which they monitor and administrate over customer operations, MSSPs on the other hand typically establish a security operations center (SOC), which is responsible for protecting the infrastructure (networks, applications, databases, servers, etc.).


https://cybersecop.com/news/2018/10/4/what-is-an-mssp-managed-security-services-provider

• Managed Security Services (MSS) and Eyes on Glass in the Real World

“Eyes on Glass” is a common saying when it comes to reviewing SIEM logs and managed services but is often misunderstood.
Technically “eyes on glass” requires a high degree of skill and capabilities to interact directly with unique client technologies, something not commonly included with managed services.

SIEM vs. MSSP
A Security Information and Event Management (SIEM) solution is designed to collect log data and provide real-time analysis towards alerting of events that require security management (e.g. virus infection or brute force attack attempt). A Managed Security Service Provider (MSSP) provides security monitoring and management which may include review, research, and response to alerts and data collected from a SIEM.
The MSSP does not actually have access to the “eyes on glass” endpoint product at this point, just the alert or log data that is sent to them from the client endpoint product and SIEM.
Scale and Efficiency
True “eyes on glass” is not a scalable service
It is far more efficient to configure logs to submit as much data as possible than have an employee or service provider perform “eyes on glass” investigations on one or more devices or software services used within an organization.

“Eyes on Glass” is sometimes required to dive deeper into a threat as one researches and responds to an incident. For daily operations the most cost-effective monitoring solution is to properly configure and tune detailed alerts sent to a SIEM and MSSP solution enabling research and response.
https://www.optiv.com/blog/managed-security-services-mss-and-eyes-glass-real-world

• What is Managed Detection and Response? Definition, Benefits, How to Choose a Vendor, and More

Managed detection and response is a service that arose from the need for organizations, who lack the resources, to be more cognizant of risks and improve their ability to detect and respond to threats.

MDR is more focused on threat detection, rather than compliance.
The services are delivered using the provider's own set of tools and technologies,
Managed detection and response relies heavily on security event management and advanced analytics.

Managed Detection and Response vs. Managed Security Services
    Coverage. Managed security services can work with different types of event logs and contexts. The customer decides which of their security data is sent to the MSSP. With managed detection and response services, they only work with event logs that their own tools provide.
    Compliance reporting. If you need compliance reporting, go for a managed security service, as managed detection and response services rarely do compliance reports.
    The human touch. One of the upsides of managed detection and response offerings is that you get more human interaction with analysts. Managed security services rely on portals and e-mail rather than direct communication.
    Incident response. With managed detection and response, you only need a separate retainer if you want on-site incident response. Remote incident response is usually included in what you pay for the basic service. This is not true for many managed security services, where you need separate retainers for both onsite and remote incident response.

https://digitalguardian.com/blog/what-managed-detection-and-response-definition-benefits-how-choose-vendor-and-more

• Managed Detection and Response

managed service detects and responds to threats with complete root-cause and kill chain visibility to deliver more effective security.
https://www.ibm.com/security/services/managed-detection-response

• Managed Detection and Response

Managed detection and response (MDR) is an outsourced service that provides organizations with threat hunting services and responds to threats once they are discovered. It also involves a human element: Security providers provide their MDR customers access to their pool of security researchers and engineers, who are responsible for monitoring networks, analyzing incidents, and responding to security cases.

What challenges can MDR address?
While training and setting up dedicated security teams that can do full-time threat hunting may be feasible for larger organizations that can afford it, most companies will find it a difficult proposition given their resource limitations.

MDR integrates EDR tools in its security implementation, making them an integral part of the detection, analysis, and response roles.
Many of these alerts cannot be readily identified as malicious, and have to be checked on an individual basis. In addition, security teams need to correlate these threats, since correlation can reveal whether seemingly insignificant indicators all add up as part of a larger attack. This can overwhelm smaller security teams, and take away precious time and resources from their other tasks.

MDR aims to address this problem not only by detecting threats but also by analyzing all the factors and indicators involved in an alert.
One of the most important skills that security professionals need is the ability to contextualize and analyze indicators of compromise in order to better position the company against future attacks. Security technologies may have the ability to block threats, but digging deeper into the hows, whys, and whats of incidents requires a human touch.

MDR is designed to solve the problem of an organization’s cybersecurity skills gap. It tackles the issue of more advanced threats that an in-house IT team cannot completely address, ideally at a cost that is less than what the company will need to spend to build its own specialized security team. MDR can also offer the organization access to tools that it may not normally have access to

How do MDR providers compare with MSSPs?
In contrast with MDR providers, which can detect lateral movement within a network, MSSPs typically work with perimeter-based technology as well as rule-based detections to identify threats. Also, the kinds of threats that MSSPs deal with are known threats, such as vulnerability exploits, reoccurring malware, and high-volume attacks.
MSSPs have security professionals who perform log management, monitoring, and analysis, but often not at a very in-depth level.
In essence, MSSPs are able to manage an organization’s security but typically only at the perimeter level, and their analysis does not involve extensive forensics, threat research, and analytics.

In terms of service, MSSPs usually communicate via email or phone, with security professionals as a secondary access, while MDR providers carry out 24/7 continuous monitoring, which may not be offered by some MSSPs.
However, MSSPs still provide value to organizations. For example, managing firewalls and other day-to-day security needs of an organization’s network is a task that is more apt for an MSSP than an MDR provider, which offers a more specialized service.
Accordingly, MSSPs and MDR providers can work in conjunction with each other — with MDR providers focusing on the proactive detection and behavioral analysis of more advanced threats and giving remediation recommendations for organizations once the threats are discovered.

How does Trend Micro’s MDR work?
Trend Micro’s MDR provides a wide array of security services, including alert monitoring, alert prioritization, investigation, and threat hunting. It uses artificial intelligence models and applies them to endpoint, network, and server data in order to correlate and prioritize advanced threats. By investigating prioritized alerts, Trend Micro threat researchers can then work with organizations to provide a detailed remediation plan.

https://www.trendmicro.com/vinfo/us/security/definition/managed-detection-and-response

• What is Real User Monitoring? How It Works, Examples, Best Practices, and More

Real User Monitoring is a type of performance monitoring that captures and analyzes each transaction by users of a website or application. It’s also known as real user measurement, real user metrics, end-user experience monitoring, or simply RUM.
It’s used to gauge user experience, including key metrics like load time and transaction paths, and it’s an important component of application performance management (APM).

Real User Monitoring vs. Synthetic Monitoring
Real User Monitoring is a form of passive web monitoring.We say “passive” because it relies on services that constantly observe the system in the background, tracking availability, functionality, and responsiveness

By contrast, Synthetic Monitoring is active web monitoring. In synthetic monitoring, behavioral scripts are deployed in a browser to simulate the path an end-user takes through a website. In addition, this active monitoring permits webmasters to test the application before launch. That makes it an essential tool for sites with a high volume of traffic. Unlike synthetic monitoring, RUM never rests.

Examples of RUM
Constant monitoring of a blog in the background to see when and where page load times increase
An end-user portal like a bank software system may use it to spot intermittent issues, like login failures that only occur under specific, rare conditions.
An app developer may use it to highlight failures in different platforms that don’t show up during pre-deployment testing.

Benefits of RUM
    Measure service level targets easily. It offers real-world measurement of key targets by tracking actual visits and delivering top-level data on actual use cases.
    Easily identify problems and better prioritize issues. It can replay user sessions and track transaction paths to surface hidden problems.
    Determine hitches at the network and page level. Problems at the lower levels of a website can hide like needles in a haystack. It can spotlight these problems even when they’re intermittent in nature or based on rare conditions.

Best Practices for RUM
Assess the Current Speed of the Website. F
Improve Mobile Testing Strategy.
Relate Performance to the Business.
https://stackify.com/what-is-real-user-monitoring/

• SIEM Analyzes security alerts in real-time

SIEMs do three things:

One: Collect, normalize, and store log events and alerts from the organization’s network and

security devices, servers, databases, applications, and endpoints in a secure, central location

Investigators had determined that logging in to every system to

check for relevant log events was increasingly impossible. Also, if your logs were not secure,

you had no guarantee that an attacker hadn’t just deleted the entries to hide their activities

Two: Run advanced analytics on the data, both in real-time and across historical data, to

Identify potential security incidents that should be investigated by a human

The potential

incidents are prioritized by risk, severity, and impact.

these security analytics have

grown from employing Simple cross-correlation rules to monitoring for User-behavioral

anomalies, watching for known Indicators of Compromise IoC, and applying sophisticated

Machine learning models

Three: Prove that all of the security controls under the purview of the SIEM are in place and

effective

SIEM has evolved from an information platform, to a threat

intelligence center, to a fully integrated and automated center for security and network

operations. 

https://training.fortinet.com/pluginfile.php/1625608/mod_scorm/content/1/story_content/external_files/NSE%202%20SIEM%20Script_EN.pdf

How to execute .class file using servlets

How to execute .class file using servlets

1. If  class in CLASSPATH
it should be in WEB-INF/classes folder or
packaged in jar file located in WEB-INF/lib folder or
in CLASSPATH of your Servlet Container.
Then you can easy create an instance of this class via new operator and call any method.

2. If  class not in CLASSPATH
for example, you receive this class file via HTTP upload or
on runtime you want to change the class com.pack.MyClass with com.pack.MyClass from another location/jar
then you can use dynamic class loading.

http://www.linkedin.com/groups/Hai-How-execute-class-file-70526.S.223081071?view=&gid=70526&type=member&item=223081071&trk=eml-anet_dig-b_nd-pst_ttle-cn

How to Create a Java Executable Jar File

 How to Create a Java Executable Jar File
 http://www.dreamincode.net/forums/topic/243325-how-to-create-a-java-executable-jar-file/

 Creating a jar File in Eclipse
 http://www.cs.utexas.edu/~scottm/cs307/handouts/Eclipse%20Help/jarInEclipse.htm

GATEWAY

• INTERNETWORKING TECHNOLOGIES

GATEWAY:
•A device that connects networks is called a gateway.
•Gateways provide a communication path so that data can be exchanged between networks.
•Operate at the transport layer and higher
•Protocol converter
•Much more complex than a router
• May provide protocol conversion
• For connecting internetworks
• Keeps sophisticated routing tables
• Operates well in a heterogeneous environment
• Large buffer space
• Can control traffic flow

https://docs.google.com/viewer?a=v&q=cache:LjXw9KjlhF0J:cis.bentley.edu/jgorgone/cs340/C/pdf/interconnect.pdf+&hl=en&pid=bl&srcid=ADGEESjZqjU_tOK_VtQTUbzl0TzFo_EhxOOV6eD6iVGX0Wt42lxE6ngbsUOUUgsAvPH3LWMWgpH_ZvYLQePeLpCLtBIXe0WkBR7Ki9ftSF_n6_naqPZiwx6z8qPvxQU10M9_uxDzf0R2&sig=AHIEtbThB3Z1YQPB6TqRCTV6qnawZ57q_A

• Gateways: 

Connecting Networks Above the Network Layer

• Gateways connect dissimilar networks; networks that do not share a common physical, data link, or network layer protocol
– A gateway can connect two or more networks above the network layer of the OSI model
• A gateway reconciles differences between the networks it connects and serves as a protocol converter
• In some instances, a complete network or WAN service may serve as a gateway between two networks

https://docs.google.com/viewer?a=v&q=cache:FLDLvVwOJ1EJ:userfs.cec.wustl.edu/~t82531a/ch13_PPT.ppt+&hl=en&pid=bl&srcid=ADGEESiBldY75YIEUdwJ28pXtAA6S2Af16t4BTX83TkDY1n6XYYaaWivSCMNx8g25CWZGwkIA787Gn9GGqlCz_MYkxH-8b4YG8p5mJgB1V2Cx7eBk_l4LmmMYToJH_AHG23cWW-hAYLS&sig=AHIEtbT8Im2bqnZx0WUn49jKJdTFQ_fkaw

Deterministic Finite Automata

• Deterministic Finite Automata

Given a state and a symbol, the next state is “determined”.

https://docs.google.com/viewer?a=v&q=cache:CnIhJXltnSAJ:https://courses.engr.illinois.edu/cs373/Lectures/lec02.pdf+&hl=en&pid=bl&srcid=ADGEESjbVJuZkjvw9Vd7-Y04m6eLDfdt4-VC42o7uvlP5oGFE27s4amdz8Y6r-9WYq_qKxPKb5Gxl9WaJfb_ROTM0Dm6FB-Y9NUJui9m1-RqfrGXepW3uSweDtZsOPMgMcb2IANtChfg&sig=AHIEtbSRmjiyMVyP4Z5BzzLEMIJqWvyluQ

State-transition diagrams

State-transition diagrams
In a state diagram the starting state is denoted by a circle with an “incoming arrow” and an accepting state is denoted by a double circle.

https://docs.google.com/viewer?a=v&q=cache:pNTot0ra-aEJ:research.cs.queensu.ca/home/cisc223/2013w/moni/m2.pdf+&hl=en&pid=bl&srcid=ADGEEShE2PTVOg4vQrI6-WKlf50OAXw9Ou0UOkpS1N8fYFoQ_ZkrFwZvgLTUtxEHw100kM0_wDaTh3INeyKzmdmnimFdm-riP6xMwpSvhy0-nPWf2Pq-MKnRLTIN9sK4u7kKwhjkxWW6&sig=AHIEtbSfQzHH1GN-LDYM6wqKV5mFdBSo8Q

Graphs

• Directed Graph

The ordered pairs in E represent the direction of the edge, i.e., (tail, head) tail is source vertex and head is the target vertex

Undirected Graph

The pairs in E are unordered pairs, i.e., there is no tail or head and there is no direction to the edge, e.g., (u, v) ∈ E is really the same edge as (v, u)

http://homepages.ius.edu/rwisman/C455/html/notes/AppendixB4/GraphBasics.htm

• Kinds of Graphs

Various flavors of graphs have the following specializations and particulars about how they are usually drawn.
Undirected Graphs.

In an undirected graph, the order of the vertices in the pairs in the Edge set doesn't matter. Thus, if we view the sample graph above we could have written the Edge set as {(4,6),(4,5),(3,4),(3,2),(2,5)),(1,2)),(1,5)}. Undirected graphs usually are drawn with straight lines between the vertices.
The adjacency relation is symetric in an undirected graph, so if u ~ v then it is also the case that v ~ u.

Directed Graphs.

In a directed graph the order of the vertices in the pairs in the edge set matters. Thus u is adjacent to v only if the pair (u,v) is in the Edge set. For directed graphs we usually use arrows for the arcs between vertices. An arrow from u to v is drawn only if (u,v) is in the Edge set. The directed graph below

http://web.cecs.pdx.edu/~sheard/course/Cs163/Doc/Graphs.html

• 4.1  Undirected Graphs

Graphs
A graph is a set of vertices and a collection of edges that each connect a pair of vertices


Glossary.
Here are some definitions that we use.

    A self-loop is an edge that connects a vertex to itself.
    Two edges are parallel if they connect the same pair of vertices.
    When an edge connects two vertices, we say that the vertices are adjacent to one another and that the edge is incident on both vertices.
    The degree of a vertex is the number of edges incident on it.
    A subgraph is a subset of a graph's edges (and associated vertices) that constitutes a graph.
    A path in a graph is a sequence of vertices connected by edges. A simple path is one with no repeated vertices.
    A cycle is a path (with at least one edge) whose first and last vertices are the same. A simple cycle is a cycle with no repeated edges or vertices (except the requisite repetition of the first and last vertices).
    The length of a path or a cycle is its number of edges.
    We say that one vertex is connected to another if there exists a path that contains both of them.
    A graph is connected if there is a path from every vertex to every other vertex.
    A graph that is not connected consists of a set of connected components, which are maximal connected subgraphs.
    An acyclic graph is a graph with no cycles.
    A tree is an acyclic connected graph.
    A forest is a disjoint set of trees.
    A spanning tree of a connected graph is a subgraph that contains all of that graph's vertices and is a single tree. A spanning forest of a graph is the union of the spanning trees of its connected components.
    A bipartite graph is a graph whose vertices we can divide into two sets such that all edges connect a vertex in one set with a vertex in the other set.

http://algs4.cs.princeton.edu/41undirected/

IPv4 vs IPv6

• What is IP?

IP (short for Internet Protocol) specifies the technical format of packets and the addressing scheme for computers to communicate over a network.

• What is TCP?

Transmission Control Protocol (TCP), which establishes a virtual connection between a destination and a source.




IP by itself can be compared to something like the postal system. It allows you to address a package and drop it in the system, but there's no direct link between you and the recipient. TCP/IP, on the other hand, establishes a connection between two hosts so that they can send messages back and forth for a period of time.


IPv4 and a new version called IPv6. IPv6 is an evolutionary upgrade to the Internet Protocol. IPv6 will coexist with the older IPv4 for some time.

• The Difference Between IPv6 and IPv4 IP Addresses

An IP address is binary numbers but can be stored as text for human readers. For example, a 32-bit numeric address (IPv4) is written in decimal as four numbers separated by periods. Each number can be zero to 255. For example, 1.160.10.240 could be an IP address.
Addresses are 32 bits (4 bytes) in length.


IPv6 addresses are 128-bit IP address written in hexadecimal and separated by colons. An example IPv6 address could be written like this: 3ffe:1900:4545:3:200:f8ff:fe21:67cf
Addresses are 128 bits (16 bytes) in length


1.Simplified header format.Even though the IPv6 header contains two 128 bit addresses (source and destination IP address) the whole header has a fixed length of 40 bytes only. This allows for faster processing.

2.Address extended to 128 bits.

3.A lot of the new IPv6 functionality is built into ICMPv6 such as Neighbor Discovery, Autoconfiguration, Multicast Listener Discovery, Path MTU Discovery.

4.Enhanced Security and QoS Features.

• Why are we running out of IPv4 addresses?

IPv4 uses 32 bits for its Internet addresses. That means it can support 2^32 IP addresses in total — around 4.29 billion. That may seem like a lot, but all 4.29 billion IP addresses have now been assigned to various institutions, leading to the crisis we face today.

How does IPv6 solve this problem?
As previously stated, IPv6 utilizes 128-bit Internet addresses. Therefore, it can support 2^128 Internet addresses — 340,282,366,920,938,000,000,000,000,000,000,000,000 of them to be exact. That's a lot of addresses, so many that it requires a hexadecimal system to display the addresses. In other words, there are more than enough IPv6 addresses to keep the Internet operational for a very, very long time.

http://mashable.com/2011/02/03/ipv4-ipv6-guide/

• The Need for IPv6

IPv4 vs IPv6

Address space
End-to-End Connectivity
Ease of configuration
Security concerns
QoS

https://docs.google.com/viewer?a=v&q=cache:R-ZDXo1midMJ:www.uwplatt.edu/csse/courses/prev/csse411-materials/f09/Keith%2520Wichman%2520-%2520Seminar%2520IPv6.ppt+&hl=en&pid=bl&srcid=ADGEEShmTC41diPwxG8iBpS8R7UYKZyIkcmDhE1qnq7YM8LntEOcpXclld9StzSiXzzPmGkW-5Y1pNxHIgpn-2k1_150YFKCH0d_8yjReQA8rxuf6SyxI91hN3_ahIy9eYa12fjo1IHL&sig=AHIEtbSJ3HSo7oSDinoEY7_B1JQo3rRtnA

• 6in4

6in4 is an Internet transition mechanism for migrating from Internet Protocol version 4 (IPv4) to IPv6.
6in4 uses tunneling to encapsulate IPv6 traffic over explicitly-configured IPv4 links as defined in RFC 4213
6in4 traffic is sent over the IPv4 Internet inside IPv4 packets whose IP headers have the IP protocol number set to 41.
This protocol number is specifically designated for IPv6 encapsulation.

The 6in4 protocol has no security features, thus one can easily inject IPv6 packets by spoofing the source IPv4 address of a tunnel endpoint and sending it to the other endpoint. This problem can partially be solved by implementing network ingress filtering or with IPsec. Another solution is to use a secure protocol such as AYIYA or other tunneling methods that compute digital signatures for each packet thus facilitating verification of packet authenticity.

The mentioned packet injection loophole of 6in4 was exploited for a research benefit in a method called IPv6 Tunnel Discovery which allowed the researchers to discover operating IPv6 tunnels around the world.

http://en.wikipedia.org/wiki/6in4

• IPv6 transition mechanisms

IPv6 transition mechanisms are technologies that facilitate the transitioning of the Internet from its initial (and current) IPv4 infrastructure to the successor addressing and routing system of Internet Protocol Version 6 (IPv6). As IPv4 and IPv6 networks are not directly interoperable, these technologies are designed to permit hosts on either network to participate in networking with the other network.

Dual IP stack implementation
Dual-stack (or native dual-stack) refers to side-by-side implementation of IPv4 and IPv6. That is, both protocols run on the same network infrastructure, and there's no need to encapsulate IPv6 inside IPv4 (using tunneling) or vice-versa. Dual-stack is defined in RFC 4213

Tunneling
Many current internet users do not have IPv6 dual-stack support, and thus cannot reach IPv6 sites directly. Instead, they must use IPv4 infrastructure to carry IPv6 packets. This is done using a technique known as tunneling, which encapsulates IPv6 packets within IPv4, in effect using IPv4 as a link layer for IPv6

Automatic tunneling
Automatic tunneling refers to a technique by which the routing infrastructure automatically determines the tunnel endpoints

Configured and automated tunneling (6in4)
6in4 tunneling requires the tunnel endpoints to be explicitly configured, either by an administrator manually or the operating system's configuration mechanisms, or by an automatic service known as a tunnel broker

Proxying and translation for IPv6-only hosts
It is likely that hosts newly added to the Internet might only have IPv6 connectivity. For these clients to have backward-compatible connectivity to existing IPv4-only resources, suitable IPv6 transition mechanisms must be deployed.
One form of address translation is the use of a dual-stack application-layer proxy server, for example a web proxy.


http://en.wikipedia.org/wiki/IPv6_transition_mechanisms

• IPv6 tunnel discovery

Our work aims to develop non-invasive methods for discovering, and collecting information about, IPv6-in-IPv4 tunnels in the Internet at large. This can be useful for diagnostic and troubleshooting purposes, and also provides insight on the evolution and the present structure of the IPv6 Internet.
http://www.dia.uniroma3.it/~compunet/tunneldiscovery/

• IPv6 probable side-effects

4G implements over VoIP which requires IPv6
hard-coded IP addresses in software

• here are now two kinds 

of companies: those that have been hacked and those that don’t know they’ve been hacked

Cyber Attack Deterrence by Punishment
a legal foundation for the cyber attack, defense, and deterrence strategies is needed as soon as possible.

Improved Security?
a better network protocol is needed, both for size and for security.
IPv6 offers clear security upgrades over IPv4.
First, IPv6 is much more cryptography-friendly. A mechanism called IP Security (IPSec) is built directly into the protocol’s “code
stack.” IPSec should reduce Internet users’ vulnerability to spoofing, illicit traffic sniffing and Man-in-the-Middle (MITM) attacks.
IPv6 also offers end-to-end connectivity, which is afforded by the incredibly high number of IP addresses available. Since it is possible, in theory, to give anything anIP address, any two points on the Internet may communicate directly with each other.
For example, the astronomical number of IP addresses may mean that attackers will no longer be able to randomly “scan” the Internet to find their victims.

IPv6 Answers Some Questions, Creates Others
Hackers have already demonstrated that IPv6 is not invulnerable to many traditional, IPv4 attack methods, including DoS packetcrafting, and MITM attacks. Vulnerabilities in software (operating systems, network services, web applications) will continue to exist, no matter which protocol they use
And perhaps most crucially, although IPSec is available, it is not required

The need for cyber defense exercises (CDX) is clear.
virtual battlefield
A robust CDX requires a team-oriented approach.
There are friendly forces (Blue), hostile forces (Red), technical infrastructure (Green), and game management (White).

https://ccdcoe.org/uploads/2018/10/2011_Proceedings_0-1.pdf

IPv4 Overview

32 bit Addressing scheme

Host address, e.g., 192.168.1.1
Network address, e.g., 192.168.1.0/24 or 192.168.1.0 255.255.255.0
Host address is the first address in subnetwork, e.g. 192.168.1.0
Broadcast address is the last address in the subnetwork, e.g.,
192.168.1.255

https://docs.google.com/viewer?a=v&q=cache:Y82N8QpXaeIJ:www.cs.uiuc.edu/class/sp06/cs498sh/slides/IPv4Overview.ppt+&hl=en&pid=bl&srcid=ADGEESgmQcetW2sJG5eWGYcTIg6gkApH6E1F2mAvHYudduRHgQdMLlReBGRs4tndXJCm0YcjGemTR-OeC_dFZQxHrEm0owLdJ8pEdu0FokyMEA3mV_6dqhdLgSgNnXqz_XM-8Qzsnbb7&sig=AHIEtbS6L-4snD1VW6ypI18PPCij8ccnHg

Digital System Design

Digital System Design
Combinational Logic Building Blocks

Multiplexers
Called n-to-1 multiplexer

Decoders
Called n-to-2n decoder

Demultiplexers
Called 1-to-n demultiplexer

Encoders
Called 2n-to-n encoder

https://docs.google.com/viewer?a=v&q=cache:b0jai5RJPFIJ:ece.gmu.edu/coursewebpages/ECE/ECE545/F10/viewgraphs/ECE545_lecture1_digital_logic_review.ppt+&hl=en&pid=bl&srcid=ADGEESjjerAWeVXZpjaIvzRlh4Jpa1-TafvQr9CpnnN55BUVTvcvTKSYJlBgic2e_hhQlR2-SjmbQdiEgsFerWL3xYQGwdvWKJxAhZLr-KOjsIZurtH8tglVPDfnfJLvrs-7JjtgQLBi&sig=AHIEtbSu7bzXI9GzheG6Chub1-b5V0e-5w

Absorption

• Absorption:

A) x + xy = x
B) x (x+y) = x



AXIOMS AND BASIC THEOREMS
Absorption x+x·y =x   x · (x + y) = x



A Boolean function that is expressed in algebraic form can be simpli-
fied using the axioms and theorems of Boolean algebra

⊳ Example 1: OR form of the Absorption Theorem

x + x · y = x · 1 + x · y = x · (1 + y) = x · 1 = x

⊳ Example 2:

x+x·y =x+x·y+x·y
=x·x+x·y+x·x+x·y
= (x + x) · (x + y) = 1 · (x + y)
=x+y

⊳ Example 3:

x · (x + y) = x · x + x · y = x + x · y = x



https://docs.google.com/viewer?a=v&q=cache:vvf4G4lWnnAJ:www.utdallas.edu/~cantrell/ee2310/boole.pdf+&hl=en&pid=bl&srcid=ADGEESj4MkhQetdjm9j72t0ctUL72kuNtjfsvEj1V1PBxgT-7MA4H8LUy8dbKmiyKynFtuvNt55_e2cse30bftRNM54OKhpZQIhpSeaCnAdFDOCR5gK5ryrCifFWMzSZAdx0eTf3B3UT&sig=AHIEtbTv69hjBdYNTZXQUWraukrH9OMagg

• (Absorption 1) x∧(x∨y) = x

(Absorption 2) x∨(x∧y) = x
http://en.wikipedia.org/wiki/Boolean_algebra

• Redundancy laws

The following laws will be proved with the basic laws. Counter-intuitively, it is sometimes necessary to complicate the formula before simplifying it.

Absorption

x + x · y = x
Proof:
x + x · y
= x · 1 + x · y
= x · (1 + y)
= x · 1
= x
x · (x + y) = x
Proof:
x · (x + y)
= (x + 0) · (x + y)
= x + (0 · y)
= x + 0
= x

http://nayuki.eigenstate.org/page/boolean-algebra-laws

Memory Management Techniques

• Memory Management Techniques

Fixed Partitioning
Divide memory into partitions at boot time, partition sizes may be equal or unequal but don’t change
Simple but has internal fragmentation

Dynamic Partitioning
Create partitions as programs loaded
Avoids internal fragmentation, but must deal with external fragmentation

Simple Paging
Divide memory into equal-size pages, load program into available pages
No external fragmentation, small amount of internal fragmentation

Simple Segmentation
Divide program into segments
No internal fragmentation, some external fragmentation

Virtual-Memory Paging
Paging, but not all pages need to be in memory at one time
Allows large virtual memory space
More multiprogramming, overhead

Virtual Memory Segmentation
Like simple segmentation, but not all segments need to be in memory at one time
Easy to share modules
More multiprogramming, overhead

https://docs.google.com/viewer?a=v&q=cache:8YjAHQb0WsgJ:students.cs.byu.edu/~cs345ta/slides/CS345%252007%2520-%2520Memory%2520Management.pptx+&hl=en&pid=bl&srcid=ADGEESgCkTvJun68Ifb56wDcyg5UIaf98eTH0IFvm9gsE6oAsmLlrKs_jsXrQzrgkqv1Ot5F69czi0QyAJFsyuJQb5HvJvmCunq0OVRK4Ua-_fltzaC4tgbr0TTHAKLB0EQS006encTP&sig=AHIEtbTBAEIAgB8FL91wo4AidAi3f1_Pqg

• Memory Management Techniques

http://www.cse.buffalo.edu/~bina/cse421/spring00/LEC78MemMgt/sld007.htm

• Memory Management 

Various techniques
Fixed partitions – easy to use, but internal fragmentation
Variable partitions – more efficient, but external fragmentation
Paging – use small, fixed size chunks, efficient for OS
Segmentation – manage in chunks from user’s perspective
Combine paging and segmentation to get benefits of both
https://docs.google.com/viewer?a=v&q=cache:DJU4mo7E0BEJ:cseweb.ucsd.edu/classes/fa05/cse120/lectures/120-l10.pdf+&hl=en&pid=bl&srcid=ADGEEShm17EKOhrz3fSiENcf4xqvERf9xpIdIbRzjSP1G5bePoGXLBQZXDWEwlOyZJT8fVV1Wg-umGfL58MZ5K3e6ctlgpfs2In8Tl1s34lWlXfFmJQ0oXH3bC0FlOiH5nSNTk_5c5os&sig=AHIEtbRZmbCW31WfvVYnEIJH-PasAsVMZQ

Binary Search Tree

• Binary Search Trees

• Binary Search Tree Property: The value

stored at a node is greater than the value
stored at its left child and less than the value
stored at its right child
Thus, the value stored at the root of a
subtree is greater than any value in its left
subtree and less than any value in its right
subtree!!


https://docs.google.com/viewer?a=v&q=cache:0Gua_CCn2fYJ:www.cse.unr.edu/~bebis/CS308/PowerPoint/BinarySearchTrees.ppt+&hl=en&pid=bl&srcid=ADGEESgb6XpuTDtC7ykBB3X6TzalNiMPwH4--Dw7oFhsmlz0CKzQYY0pUm1GQH6TnPqGIPWKxJRJmNvlYGyFcVmC2g7csdTN0I6vGHdlpByaLEwFrhxl_vyLNRe2ZBUWxWrbz0he_XGB&sig=AHIEtbSmEUZfU7Uxcaopi5Qoxy10g9wXTg

• Binary Search Tree (§9.1)

A binary search tree is a binary tree storing
keys (or key-element pairs) satisfying the
following property:

Property - given a node with a value X, all the
values of nodes in the left subtree are smaller
than X and all the values of the nodes in the
right subtree are larger than X


https://docs.google.com/viewer?a=v&q=cache:yzHYvCMpV3gJ:www.cs.ucr.edu/cs14/cs14_06win/slides/BinarySearchTrees.pdf+&hl=en&pid=bl&srcid=ADGEESi5_segPdHcDjHa1xfkg_8v2ZjE0Hqp9XTQ0a_oZRS6uzr5xRhdK4dliH6Gs7WKNFQ_B6060x0vw3hGz2MfYC894jagI6gLupiucS66wDOEvcM90mhFIMDPqhp5Bsypzejh7ChF&sig=AHIEtbRXU98VmMnMNIqIlg-F1PZ592hnaA

• Binary Search Trees

A binary search tree is a binary tree with a
special property called the BST-property,
which is given as follows:
⋆ For all nodes x and y, if y belongs to the
left subtree of x, then the key at y is less
than the key at x, and if y belongs to the
right subtree of x, then the key at y is
greater than the key at x.

https://docs.google.com/viewer?a=v&q=cache:VpSPd7v8DmQJ:www.cs.rochester.edu/~gildea/csc282/slides/C12-bst.pdf+&hl=en&pid=bl&srcid=ADGEESjjCepXiYWSyJn_c4qbmrlXw_TN7ScZWuGxkvSiLVSk4SNtl25Vu4j11wdfVnC9a18nXNn2Zu2bkeTI9RY_D9cuNlJqXjH-WAWXTXg6wOYex_KjJBGKSdwHPEdXkbufnmMFzBPK&sig=AHIEtbRCO8kKe5kt_fj8F68UIbr_iLrt-w

• What is a binary search tree?

A binary search tree is a binary tree with the following properties:
The data stored at each node has a distinguished key which is unique in the tree and belongs to a total order. (That is, for any two non-equal keys, x,y either x < y or y < x.)
The key of any node is greater than all keys occurring in its left subtree and less than all keys occurring in its right subtree.

http://pages.cs.wisc.edu/~siff/CS367/Notes/bsts.html

• Binary Search Trees

http://www.youtube.com/watch?v=9z8nyD5J-qE&feature=relmfu

Postfix to Infix

• Problem 3: Postfix to Infix

A popular example of using a stack in data structure courses is to convert an infix expression (e.g. 2 * 5 + 3) to postfix (2 5 * 3 +).
The reverse process is slightly harder, particularly because a given postfix expression can convert to multiple infix expressions due to parentheses
http://www.eecis.udel.edu/~breech/contest.inet.fall.03/problems/toinfix.html

• Postfix to Infix Notation 

http://www.youtube.com/watch?v=OlRENYiiIiw

• Converting Postfix Expressions to Infix

    The postfix expression is scanned from left to right.
    If a token is a number, the token is pushed onto the stack.
    If a token is an operator, the top two infix subexpressions are popped from the stack and a new infix expression is constructed by combining these subexpressions with the operator in a normal infix manner. The resulting expression is then pushed onto the stack. Initially, we will place each subexpression in parentheses to ensure the proper order of evaluation in the final expression.


http://www.codeproject.com/Articles/405361/Converting-Postfix-Expressions-to-Infix

Heapsort

• Heapsort

Heapsort is a sorting algorithm that maintains the O(n lg n) run time (like mergesort) but operates in place (like insertion sort). This sorting algorithm is based on a data structure known as a heap (which is also one way to implement a priority queue).

Heaps
A heap is simply an array viewed as a nearly complete binary tree (meaning a subsequent level is not started until the previous level is completely filled).

Heap values
We define the following values for an array A viewed as a heap
A.length - size of the array
A.heapsize - number of elements in the heap (note A.heapsize ≤ A.length)
height - height of the heap binary tree = Θ(lg n)


Heap operations
A[i] - value at node (element) i
LEFT(i) - index of left child node = 2i
RIGHT(i) - index of right child node = 2i + 1
PARENT(i) - index of parent node = i / 2


Max-heaps
We define a max-heap as a heap that satisfies the property that A[PARENT(i)] ≥ A[i] for all i, i.e. the value of every parent is greater than both children.
Thus for a max-heap, the largest value is stored at the root

Min-heaps
Similarly we define a min-heap as a heap that satisfies the property that A[PARENT(i)] ≤ A[i] for all i, i.e. the value of every parent is less than both children.
Thus for a min-heap, the smallest value is stored at the root.
http://faculty.ycp.edu/~dbabcock/PastCourses/cs360/lecture/lecture07.html

performance

• Örn: Bir compiler tasarımcısı bir makina için, iki kod serisinden birini seçecektir. Donanım üreticisi aşağıdaki bilgileri vermiştir :

Bu durumda:
a) Hangi kod serisi daha çok instruction işler ?
b) Hangisi daha hızlıdır?
c) Her bir kod serisi için gerekli olan CPI nedir?

Mikroişlemciler ve Mikrobilgisayarlar

http://members.comu.edu.tr/boraugurlu/courses/bm307/content/week6/hafta6.pdf

• CS1104: Computer Organisation Part I

Tutorial #5: Performance
Answers

2. There are four classes of instructions (A, B, C and D) in a certain instruction set.
Consider two different implementations, M1 and M2, of the same instruction set.

M1 has a clock rate of 500MHz. The average number of cycles for each instruction class on M1 is as follows:

https://docs.google.com/viewer?a=v&q=cache:B5F5-radnE0J:www.comp.nus.edu.sg/~cs1104/tut/tut05ans.pdf+&hl=en&pid=bl&srcid=ADGEESjiDPIdoyTFji71goG9ZMRRYDjuTcLTbs0bvW7RSBGueKjOvxDglHwgpJSLk1pfCW9iPaEOV2B9yovoYuYdUMIP3P0ipr2A9kcsVMzVHi-6tEhAfbmpgGoDOpgtzLXUEbTLM6bO&sig=AHIEtbSCQ8B0dEGekvhBfsWwP8OYuFMeRw

• What's Chapter 2 about?

What do we mean by the performance of a computer and why are we concerned with it?
What's the best way to compare the performance of two machines?
What are benchmarks?  How useful are they
http://inside.mines.edu/~crader/cs341/Chapter2.html

• Compiler Variations, MIPS & Performance:

An Example
• For a machine with instruction classes:

https://docs.google.com/viewer?a=v&q=cache:LXwykXBYjBoJ:meseec.ce.rit.edu/eecc550-spring2003/550-3-17-2003.ppt+&hl=en&pid=bl&srcid=ADGEEShRFdIZLl0XQN0O9UkR84xHX0MXzKFJbSkME97bIF8r9uFgyl8nrv_0j-JRWq7WBmx6apdDnmCj1pRdkhUJ3eabqlLnQatqGgltdX_00KWHokpesMbZxxPTjSJEtGJCM8b7dC0K&sig=AHIEtbQVDGqAUA3S4ProsElRoDzR5WdjOA

• # of Instructions Example

A compiler designer is trying to decide between two
code sequences for a particular machine. Based on
the hardware implementation, there are three different
classes of instructions: Class A, Class B, and Class
C, and they require one, two, and three cycles
(respectively).

The first code sequence has 5 instructions:
2 of A, 1 of B, and 2 of C
The second sequence has 6 instructions:
4 of A, 1 of B, and 1 of C.

Which sequence will be faster? How much?
What is the CPI for each sequence?
https://docs.google.com/viewer?a=v&q=cache:9YKby6YrxkUJ:www.es.ele.tue.nl/~heco/courses/ProcDesign/pd-4.ppt+&hl=en&pid=bl&srcid=ADGEESj_XS6S784JbrciFW-RgYTxkdQ8wpf2P20T09zfvr49KQIj98UacvRv8WJ2koWLdybu3hO2VMd2TFRqFd1j1BlyD2RC1ydI3Mzv1KtIfOj__OWIqL2bQemv_fXXyVu1NY2wD-Fh&sig=AHIEtbTiBQ7UJHkSblmvP7I9qz_MWDwdOA

Moore's law

Moore's law
Moore's law is the observation that over the history of computing hardware, the number of transistors on integrated circuits doubles approximately every two years.

The law is named after Intel co-founder Gordon E. Moore, who described the trend in his 1965 paper.
The paper noted that the number of components in integrated circuits had doubled every year from the invention of the integrated circuit in 1958 until 1965 and predicted that the trend would continue "for at least ten years".
His prediction has proven to be uncannily accurate, in part because the law is now used in the semiconductor industry to guide long-term planning and to set targets for research and development.
http://en.wikipedia.org/wiki/Moore's_law