For some reason a news article on a two-year-old result about the maximum processing speed of a reversible computer was published on the 13th, then Slashdotted. But you saw it here first!
Random bits
13 October 2009Cyberterror: menace or myth?
8 October 2009Today I went to a talk by Irving Lachow at the think tank where I used to work on whether cyberterrorism is a myth or a menace. The conclusion is probably obvious: it’s basically not a real menace. There’s lots for everyone to worry about from organized crime and certainly lots more for the government-industrial complex to worry about from nation-state threats, but cyberterrorism is a mirage, and basically everyone who doesn’t have skin in the game (and even some people who do or might–such as myself) agree. I’ve talked about similar themes here and here and here, among other entries on this blog.
Lachow mentioned that he did his research on this topic through unclassified sources, then went onto JWICS with crossed fingers–and ended up standing by his initial conclusions. Terrorists do organizational and support stuff and “influence operations” (I guess this is a subtler version of PSYOPS) using networks, but they don’t really engage in cyberterrorism. And the stuff that gets called cyberterrorism basically doesn’t deserve the name. Lachow believes, as I do, that crime, espionage, and state-level network attacks are what we really ought to be concerned with: cyberterror should be considered a “lesser included threat”–although the risks for all of these threats will only increase with time.
One theme that he brought up that I and many others have mulled over is cyberdeterrence. Basically, nobody knows how to do it. The nuclear analogies are false. But (as I’ve mentioned here) for a really big attack, one that’s worthy of a strategic offensive move by a nation-state or terrorist group, there will be a kinetic component. Attribution won’t be a problem. Old-fashioned deterrence with guns still works just fine.
Random bits
8 October 2009Terry Tao reports that Israel Gelfand died recently. He was one of the greats, his name familiar to every student of functional analysis from the GNS construction
A graded lexicographic index, part 1
6 October 2009This post is going to introduce a way to index elements of the bucketspace
This is basically equivalent to indexing the ways you can put
indistinguishable balls into
distinguishable buckets, hence the name.
Why is this useful? There are a number of pretty good reasons. For one thing, such an index is the key to providing a total ordering of that is a graded lexicographic ordering (i.e., something akin to a dictionary ordering in which words of length 1 appear first in order, then words of length 2, and so on) which can probably be used in lots of places (it seems like the sort of thing that could be a 35-40 rated exercise in Knuth depending on hints). A more specific application derives from the fact that multivariate Lagrange interpolation is about as nice as it can possibly be on
which is probably why it turned out that Carl de Boor of spline fame anticipated a lot of our early work from 2001 discussed in this post two years beforehand.

Example of Lagrange interpolation of a function on .
But the reason we’re talking about it here is that random walks on have been used as a way of describing network traffic in a past approach by DoD that we’ve drawn a lot of lessons from (the basic idea for translating network packets to random walks was similar to the approach described at the end of a previous post, except that the finite space
is used instead of the infinite root lattice
), and we seriously considered running with this framework in tandem with the one that we followed through with.
There are also some cute martingale results that derive from looking at as the configuration space of states for a classical Bose gas and looking at the energy fluctuations of the gas. In fact this line of thinking led in a very circuitous way to the development of a lattice gauge theory for random walks that we’re working on in the hope that it could lead to descriptors generalizing electric and magnetic charges, fields, etc. for dealing with correlations within network traffic–but talking about that more would take us way too far afield, especially since that stuff is still in the research stage.
Getting back on topic, pictures of the graded lex ordering obtained by projecting onto
give a little more insight. For example, with
and
, there are
elements or states, and they are ordered as
(0,0,12), (0,1,11), …, (0,12,0), [13 states]
(1,0,11), (1,1,10), …, (1,11,0), [12 states]
(2,0,10), (2,1,9), …, (2,10,0), [11 states]
…
(11,0,1), (11,1,0), [2 states]
(12,0,0). [1 state]
If we just project these points into two dimensions and literally connect the dots in order (except for joining the last point to the first one) we get a pretty clear picture of what’s going on:
State index for The pattern becomes more obvious if we add a dimension:
State index for It looks recursive, and it is. Since you can read about an essentially equivalent construction in de Boor’s 1999 paper, I won’t belabor the details, though our MATLAB code is different from his and appears to be more fully developed in many respects.
First, here’s how to produce :
function y=lookup(B,b);
% Generates a lookup table with B buckets and b balls.
P1 = pascal(max(b+1,B+1));
P = P1(1:B,:);
numstates = P(B,:);
% ith element gives number of states for B buckets and (i-1) balls
% addermat is a matrix of "row adder" vectors:
addermat = fliplr(eye(B));
%init
look = zeros(1,B);
% Put C = max(c)...the number of balls is b = C-1, so b-1 = C-2
for c = 1:b
for k = 1:B
blocksize(c,k) = nchoosek(c+k-2,c-1);
temp = blocksize(c,k);
cellblock{k} = look(1:temp,:)+repmat(addermat(k,:),[temp 1]);
end
look = cat(1,cellblock{:});
end
y = look;
Next, here’s a recursive index:
function y = stateindex(state) % B: number of buckets % b: number of balls B = length(state); b = sum(state); if min(state) < 0 | max(state) > b stateindex = 0; % basic error handling else P1 = pascal(max(b+1,B+1)); P = P1(1:B,:); PA = cat(1,zeros(1,max(b+1,B+1)),P); % addermat is a matrix of "row adder" vectors: addermat = fliplr(eye(B)); blocknum = zeros(1,b); numblocknum = zeros(1,b); substate = state; for i = 1:b blocknum(i) = max(find(fliplr(substate))); substate = substate-addermat(blocknum(i),:); numblocknum(i) = PA(blocknum(i),b+2-i); end stateindex = sum(numblocknum)+1; end y = stateindex;
Unfortunately, recursive code usually looks conceptually elegant but performs terribly. In the next post in this series I’ll discuss some more sophisticated methods for indexing states in and related algorithms that avoid this pitfall.
Random bits
5 October 2009DHS wants to hire 1000 cybersecurity experts. Too bad there aren’t that many and NSA is poaching a lot of people anyway. In my world “expert” must mean something quite different from how a lot of folks seem to interpret the word. There are not 1000 experts on any modern technical subject, there are on the order of 1-100. Once it gets past that number the nature of expertise changes–or undergoes a phase transition–and the aspects of the subject become “well known”.
DHS travel records look like this.
“There is a real sense in the Pentagon that Israel is preparing to attack Iran” and another take on the situation at Information Dissemenation
Using neutrinos for submarine communications. I recall seeing work investigating the use of neutrinos to detect nuclear submarines as well. To mix metaphors, this sort of thing has been on the Navy’s radar for a long time: a JASON report on neutrino detection dates from 1988.
Posted by eqnets
VizSec09
12 October 2009VizSec 2009 was yesterday; aside from Bill Cheswick’s keynote and participating in the poster session (the poster is available on our downloads page), I was pleasantly surprised by Joel Glanfield et al.’s OverFlow work. Like us, they have recognized that aggregating IPs (among other things) is a good thing for visualizing network traffic, particularly over time. One thing OverFlow does that we don’t is to explicitly show a representation of the aggregated connections as a graph drawing. When aggregation is done statically (even including layer 4) this seems like the sort of thing that can be very friendly to analysts, but there are occlusion issues that suggest focusing on one aggregated node at a time, especially for time series data. Anyway I look forward to seeing more of this sort of thing and fewer “yarn ball” visualizations and their ilk that too often convey little or no useful information because of a refusal to recognize one of the great lessons of physics: that successfully analyzing complex systems is largely dependent on identifying relevant spatial and time scales and then ignoring irrelevant details. When I heard people saying that analysts complain that visualizations frequently “get in the way of the data” I think I know what they meant.
One thing I was pleasantly not surprised by is that the afternoon panel seemed to repudiate the notional equation “Security + Visualization = Science”. As I’ve commented here (and there), there can be no truly scientific theory of security. Visualization doesn’t change this. The place where security and visualization can overlap with each other and with science is in the development of frameworks guided by scientific principles, both in architectural and cognitive aspects. For example, an immunology-based security visualization tool might seek to leverage some kind of corresponding visualization, like some sort of graph summarizing “antibodies” that draws from biologists’ experience.
But trying to compare different visualizations scientifically is almost surely doomed to failure outside of a “perturbative regime” where small elements of visualizations are altered and the cognitive effects are measured. For instance, comparing Wireshark and TNV might be done carefully and provide some insight, but it does not qualify as science. And it doesn’t need to. Engineering is a good thing, and so are usability studies. But while we certainly base our own framework on principles from physics, we haven’t bothered with trying to do formal usability studies, because people will make it known if or when they want minor improvements to an interface, and that’s precisely the sort of thing that falls into the “perturbative regime” anyway. I think the bottom line is that if you care about how users interact with your tool and what it can do for them, just let them have a say in the development process.