Suchergebnisse

This paper presents a framework to easily build and execute parallel applications in container-based distributed computing platforms in a user-transparent way. The proposed framework is a combination of the COMP Superscalar (COMPSs) programming model and runtime, which provides a straightforward way to develop task-based parallel applications from sequential codes, and containers management platforms that ease the deployment of applications in computing environments (as Docker, Mesos or Singularity). This framework provides scientists and developers with an easy way to implement parallel distributed applications and deploy them in a one-click fashion. We have built a prototype which integrates COMPSs with different containers engines in different scenarios: i) a Docker cluster, ii) a Mesos cluster, and iii) Singularity in an HPC cluster. We have evaluated the overhead in the building phase, deployment and execution of two benchmark applications compared to a Cloud testbed based on KVM and OpenStack and to the usage of bare metal nodes. We have observed an important gain in comparison to cloud environments during the building and deployment phases. This enables better adaptation of resources with respect to the computational load. In contrast, we detected an extra overhead during the execution, which is mainly due to the multi-host Docker networking. ; This work is partly supported by the Spanish Government through Programa Severo Ochoa (SEV-2015-0493), by the Spanish Ministry of Science and Technology through TIN2015-65316 project, by the Generalitat de Catalunya under contracts 2014-SGR-1051 and 2014-SGR-1272, and by the European Union through the Horizon 2020 research and innovation program under grant 690116 (EUBra-BIGSEA Project). Results presented in this paper were obtained using the Chameleon testbed supported by the National Science Foundation. ; Peer Reviewed ; Postprint (author's final draft)

This paper presents a framework to easily build and execute parallel applications in container-based distributed computing platforms in a user-transparent way. The proposed framework is a combination of the COMP Superscalar (COMPSs) programming model and runtime, which provides a straightforward way to develop task-based parallel applications from sequential codes, and containers management platforms that ease the deployment of applications in computing environments (as Docker, Mesos or Singularity). This framework provides scientists and developers with an easy way to implement parallel distributed applications and deploy them in a one-click fashion. We have built a prototype which integrates COMPSs with different containers engines in different scenarios: i) a Docker cluster, ii) a Mesos cluster, and iii) Singularity in an HPC cluster. We have evaluated the overhead in the building phase, deployment and execution of two benchmark applications compared to a Cloud testbed based on KVM and OpenStack and to the usage of bare metal nodes. We have observed an important gain in comparison to cloud environments during the building and deployment phases. This enables better adaptation of resources with respect to the computational load. In contrast, we detected an extra overhead during the execution, which is mainly due to the multi-host Docker networking. ; This work is partly supported by the Spanish Government through Programa Severo Ochoa (SEV-2015-0493), by the Spanish Ministry of Science and Technology through TIN2015-65316 project, by the Generalitat de Catalunya under contracts 2014-SGR-1051 and 2014-SGR-1272, and by the European Union through the Horizon 2020 research and innovation program under grant 690116 (EUBra-BIGSEA Project). Results presented in this paper were obtained using the Chameleon testbed supported by the National Science Foundation. ; Peer Reviewed ; Postprint (author's final draft)

This paper presents a framework to easily build and execute parallel applications in container-based distributed computing platforms in a user transparent way. The proposed framework is a combination of the COMP Superscalar and Docker. We have built a prototype in order to evaluate how it performs by evaluating the overhead in the building, deployment and execution phases. We have observed an important gain compared with cloud environments during the building and deployment phases. In contrast, we have detected an extra overhead during the execution, which is mainly due to the multi-host Docker networking. ; This work is partly supported by the Spanish Government through contracts SEV-2015-0493, TIN2015-65316-P, by the Generalitat de Catalunya under contracts 2014-SGR-1051 and 2014-SGR-1272, and by the European Union under grants 676556 (MuG Project) and 690116 (EUBra-BIGSEA Project). Results presented in this paper were obtained using the Chameleon testbed supported by the NSF. ; Peer Reviewed ; Postprint (author's final draft)

This paper presents a framework to easily build and execute parallel applications in container-based distributed computing platforms in a user transparent way. The proposed framework is a combination of the COMP Superscalar and Docker. We have built a prototype in order to evaluate how it performs by evaluating the overhead in the building, deployment and execution phases. We have observed an important gain compared with cloud environments during the building and deployment phases. In contrast, we have detected an extra overhead during the execution, which is mainly due to the multi-host Docker networking. ; This work is partly supported by the Spanish Government through contracts SEV-2015-0493, TIN2015-65316-P, by the Generalitat de Catalunya under contracts 2014-SGR-1051 and 2014-SGR-1272, and by the European Union under grants 676556 (MuG Project) and 690116 (EUBra-BIGSEA Project). Results presented in this paper were obtained using the Chameleon testbed supported by the NSF. ; Peer Reviewed ; Postprint (author's final draft)

In this paper we analyze the performance of QUIC as a transport alternative for Internet of Things (IoT) services based on the Message Queuing Telemetry Protocol (MQTT). QUIC is a novel protocol promoted by Google, and was originally conceived to tackle the limitations of the traditional Transmission Control Protocol (TCP), specifically aiming at the reduction of the latency caused by connection establishment. QUIC use in IoT environments is not widespread, and it is therefore interesting to characterize its performance when in over such scenarios. We used an emulation-based platform, where we integrated QUIC and MQTT (using GO-based implementations) and compared their combined performance with the that exhibited by the traditional TCP/TLS approach. We used Linux containers as end devices, and the ns-3 simulator to emulate different network technologies, such as WiFi, cellular, and satellite, and varying conditions. The results evince that QUIC is indeed an appropriate protocol to guarantee robust, secure, and low latency communications over IoT scenarios. ; The authors are grateful for the funding of the Industrial Doctorates Program from the University of Cantabria (Call 2020). This work has been partially supported by the Basque Government through the Elkartek program under the DIGITAL project (grant agreement number KK-2019/00095), and by the Spanish Government (Ministerio de Economía y Competitividad, Fondo Europeo de Desarrollo Regional, FEDER) by means of the project FIERCE: Future Internet Enabled Resilient smart CitiEs (RTI2018-093475-AI00).

We study the performance of the Message Queuing Telemetry Transport Protocol (MQTT) over QUIC. QUIC has been recently proposed as a new transport protocol, and it is gaining relevance at a very fast pace, favored by the support of key players, such as Google. It overcomes some of the limitations of the more widespread alternative, TCP, especially regarding the overhead of connection establishment. However, its use for Internet of Things (IoT) scenarios is still under consideration. In this paper we integrate a GO-based implementation of the QUIC protocol with MQTT, and we compare the performance of this combination with that exhibited by the more traditional MQTT/TLS/TCP approach. We use Linux Containers and we emulate various wireless network technologies by means of the ns3 simulator. The results of an extensive measurement campaign, show that QUIC protocol can indeed yield good performances for typical IoT use cases. ; The authors are grateful for the funding of the Industrial Doctorates Program from the University of Cantabria (Call 2018). This work has been partially supported by the Basque Government through the Elkartek program under the DIGITAL project (Grant agreement no. KK-2019/00095), as well as by the Spanish Government (Ministerio de Economía y Competitividad, Fondo Europeo de Desarrollo Regional, FEDER) by means of the project FIERCE: Future Internet Enabled Resilient smart CitiEs (RTI2018-093475-AI00).

Version non-définitive - présentée le jour de la soutenance. ; Computer security is now a crucial issue. It consists in defining and enforcing a security policy. Preventive approaches, like access control, are necessary but not sufficient. Intrusion detection is also needed. We are convinced that policy-based intrusion detection is a promising approach. This kind of detection is only based on both a model of the system state evolution and a model of the security policy. In this thesis we focus on information flow policy that defines confidentiality and integrity requirements. We aim at using policy-based intrusion detection systems (IDS) to monitor a system with OS running COTS software and web applications. We propose a detection model that can monitor information flow between information containers. We define a generic IDS architecture implementing the proposed model. This architecture is based on the collaboration between several IDS monitoring information flows at different granularity levels. We present an implementation of this architecture which use both Blare, an existing OS-level detector and JBlare, a prototype we have developed in order to monitor information flows inside Java applications. We also present the results of the experiments we realized on realistic Java applications. ; La sécurité informatique est un enjeu crucial. Elle consiste en premier lieu à définir une politique de sécurité puis à mettre en œuvre cette politique. Les approches préventives comme le contrôle d'accès sont essentielles mais insuffisantes. Il est donc nécessaire de recourir à la détection d'intrusions. En particulier, l'approche de détection d'intrusions paramétrée par la politique de sécurité nous paraît prometteuse. Une telle approche s'appuie uniquement sur un modèle de l'évolution de l'état du système et sur un modèle de la politique de sécurité. Nous nous intéressons dans cette thèse aux politiques de flux d'informations permettant d'assurer la confidentialité et l'intégrité des données. Nous souhaitons utiliser une ...

Version non-définitive - présentée le jour de la soutenance. ; Computer security is now a crucial issue. It consists in defining and enforcing a security policy. Preventive approaches, like access control, are necessary but not sufficient. Intrusion detection is also needed. We are convinced that policy-based intrusion detection is a promising approach. This kind of detection is only based on both a model of the system state evolution and a model of the security policy. In this thesis we focus on information flow policy that defines confidentiality and integrity requirements. We aim at using policy-based intrusion detection systems (IDS) to monitor a system with OS running COTS software and web applications. We propose a detection model that can monitor information flow between information containers. We define a generic IDS architecture implementing the proposed model. This architecture is based on the collaboration between several IDS monitoring information flows at different granularity levels. We present an implementation of this architecture which use both Blare, an existing OS-level detector and JBlare, a prototype we have developed in order to monitor information flows inside Java applications. We also present the results of the experiments we realized on realistic Java applications. ; La sécurité informatique est un enjeu crucial. Elle consiste en premier lieu à définir une politique de sécurité puis à mettre en œuvre cette politique. Les approches préventives comme le contrôle d'accès sont essentielles mais insuffisantes. Il est donc nécessaire de recourir à la détection d'intrusions. En particulier, l'approche de détection d'intrusions paramétrée par la politique de sécurité nous paraît prometteuse. Une telle approche s'appuie uniquement sur un modèle de l'évolution de l'état du système et sur un modèle de la politique de sécurité. Nous nous intéressons dans cette thèse aux politiques de flux d'informations permettant d'assurer la confidentialité et l'intégrité des données. Nous souhaitons utiliser une approche de détection d'intrusions paramétrée par la politique de sécurité pour surveiller un système comprenant un OS et des logiciels COTS comprenant des applications web. Nous proposons un modèle de détection permettant de suivre les flux d'informations entre les conteneurs d'informations. Nous définissons une architecture générique de système de détection d'intrusions (IDS) permettant d'implémenter le modèle proposé. Cette architecture repose sur la collaboration entre plusieurs IDS effectuant le suivi des flux d'informations à différents niveaux de granularité. Nous présentons une implémentation de cette architecture reposant sur Blare, un IDS existant permettant de gérer les conteneurs d'informations de l'OS, et JBlare, une implémentation que nous avons réalisée pour suivre les flux d'informations au niveau des applications Java. Nous présentons également les résultats des expérimentations que nous avons menées en instrumentant des applications Java « réalistes ».

The direct RNA sequencing platform offered by Oxford Nanopore Technologies allows for direct measurement of RNA molecules without the need of conversion to complementary DNA, fragmentation or amplification. As such, it is virtually capable of detecting any given RNA modification present in the molecule that is being sequenced, as well as provide polyA tail length estimations at the level of individual RNA molecules. Although this technology has been publicly available since 2017, the complexity of the raw Nanopore data, together with the lack of systematic and reproducible pipelines, have greatly hindered the access of this technology to the general user. Here we address this problem by providing a fully benchmarked workflow for the analysis of direct RNA sequencing reads, termed MasterOfPores. The pipeline starts with a pre-processing module, which converts raw current intensities into multiple types of processed data including FASTQ and BAM, providing metrics of the quality of the run, quality-filtering, demultiplexing, base-calling and mapping. In a second step, the pipeline performs downstream analyses of the mapped reads, including prediction of RNA modifications and estimation of polyA tail lengths. Four direct RNA MinION sequencing runs can be fully processed and analyzed in 10 h on 100 CPUs. The pipeline can also be executed in GPU locally or in the cloud, decreasing the run time fourfold. The software is written using the NextFlow framework for parallelization and portability, and relies on Linux containers such as Docker and Singularity for achieving better reproducibility. The MasterOfPores workflow can be executed on any Unix-compatible OS on a computer, cluster or cloud without the need of installing any additional software or dependencies, and is freely available in Github (https://github.com/biocorecrg/master_of_pores). This workflow simplifies direct RNA sequencing data analyses, facilitating the study of the (epi)transcriptome at single molecule resolution. ; This work was partly supported by the Spanish Ministry of Economy, Industry and Competitiveness (MEIC) (PGC2018-098152-A-100 to EN) and by the Australian Research Council (DP180103571 to EN). LP was supported by funding from the European Union's H2020 Research and Innovation Programme under Marie Skłodowska-Curie grant agreement no. 754422

As embedded systems are more and more present in our lives, it is necessary to protect the personal data stored in such systems. Application developers can unintentionally introduce vulnerabilities that can be exploited by attackers to compromise the confidentiality or integrity of the system. One of the solutions to prevent this is to use reactive mechanisms to monitor the behavior of the system while it is running. In this thesis, we propose a generic anomaly detection approach combining hardware and software aspects, based on dynamic information flow tracking (DIFT). DIFT consists of attaching labels representing security levels to information containers, for example files, and specifying an information flow policy to describe the authorized flows. To implement such an approach, we first developed a DIFT monitor which is flexible and non-invasive for the processor, using ARM CoreSight trace components. To take into account the information flows that occur in the different layers, from the operating system to the processor instructions, we have developed different static analysis into the compiler. These analyses generate annotations, used by the DIFT monitor, that describe the dissemination of data in the system at run-time. We also developed a Linux security module to handle information flows involving files. The proposed approach can thus be used to detect different kinds of attacks. ; Les systèmes embarqués étant de plus en plus présents dans nos vies, il est nécessaire de protéger les données personnelles qui y sont stockées. En effet, les concepteurs d'applications peuvent involontairement introduire des vulnérabilités pouvant être exploitées par un attaquant pour compromettre la confidentialité ou l'intégrité du système. Un des moyens de s'en prémunir est l'utilisation d'outils réactifs permettant de surveiller le comportement du système lors de son fonctionnement. Dans le cadre de cette thèse, nous proposons une approche générique de détection d'anomalies combinant des aspects matériels et logiciels et qui repose sur le suivi de flux d'information dynamique (DIFT). Le DIFT consiste à attacher des étiquettes représentant des niveaux de sécurité à des conteneurs d'information, par exemple des fichiers, et à spécifier une politique de flux d'information permettant de décrire les flux autorisés. Pour cela, nous avons tout d'abord développé un moniteur DIFT, flexible et non invasif pour le processeur, en utilisant les composants de traces ARM CoreSight. Pour prendre en compte les flux d'information qui se produisent dans les différentes couches, du système d'exploitation aux instructions processeur, nous avons élaboré des analyses statiques dans le compilateur. Ces analyses génèrent des annotations qui décrivent la dissémination des données dans le système lors de son exécution et qui sont utilisées par le moniteur DIFT. Nous avons également développé un module de sécurité pour le noyau Linux afin de prendre en compte les flux d'information à destination ou en provenance des fichiers. L'approche proposée permet ainsi de détecter un large spectre d'attaques de natures différentes.

ABSTRACTObjectivesThe EU FP7 funded project CEPHOS-LINK investigates hospital re-admissions of patients with a psychiatric disorder in 6 European countries by using linked health care registry data. In addition to the problems of different healthcare, payment and data collection systems, coordinating quality control, data analysis, and statistical modeling of sensitive data with six partners is challenging. For this purpose we have designed a secure online data analysis tool to diminish the time necessary to get results and incremental adaptions of reports as well as decreasing the chance and effects of misunderstandings between national and linguistic boundaries.
ApproachA comprehensive study protocol clearly defining variables to be obtained and methods to be applied has been put together. The protocol is based on a thorough investigation of the different healthcare systems and related registries. It became clear that nonetheless misconceptions occur and the incremental improvements consumed vast amounts of available resources. Therefore a system which automatically creates the required reports including all tables, graphics and statistical models including data preparation based on a defined data structure has been developed. The report system is based on the statistical environment R and the document markup language LaTeX, tightly integrated with R's package "knitr".As this highly flexible solution is not straight forward to apply and implies various technical dependencies, a secure online platform hiding all technical details from the users has been developed. Utilizing state of the art software containers based on Linux and docker, a customized VPN solution, authentication and SSL encryption were put together. The web application itself is developed with R's "shiny" package and allows users to simply upload a dataset in the predefined format, interactively explore the contents, apply filters and generate the customizable, standardized report. Additionally, an offline version of the application is available for all major (desktop) operating systems.
ResultsThe new platform advances data analysis and reporting in a situation where several partners are involved in analyzing local datasets, as is the case of the CEPHOS-LINK project. Integrating new features, graphics and research topics can be managed centrally while users can update their results and reports in nearly no time.
ConclusionThe additional effort spent on developing a customized platform for quality control, data analysis and reporting has been worth the effort. Benefits include quick detection of implausible results, unifying the layout and graphics often depending on the software utilized and an established common data structure.