Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

From Scarcity to Overload: Finding “Good Enough” Public Information in Myanmar’s Transition Information Symposium Summary Report

The Myanmar Book Aid Preservation Foundation (MBAPF) and Enlightened Research Myanmar (EMR) held an Information Symposium titled, From Scarcity to Overload: Finding “Good Enough” Public Information in Myanmar’s Transition in Yangon, Myanmar on January 28-29, 2016. The Symposium was co-sponsored by the University of Washington’s Henry M. Jackson School of International Studies (JSIS) and the Technology & Social Change Group (TASCHA) of the University’s Information School with support from the United States Agency for International Development (USAID), Microsoft, the Bill & Melinda Gates Foundation, and the Asia Foundation. The Information Symposium was held as part of a larger project supported by USAID, Microsoft, the Bill & Melinda Gates Foundation, and the Tableau Foundation implemented by the University of Washington’s JSIS and TASCHA, along with Myanmar partners, MBAPF and EMR. This project, Information Strategies for Societies in Transition, was developed largely because of the staggering challenges Myanmar is facing as it seeks to “catch-up” in the world’s most economically competitive region.

Forests as landscapes of social inequality: tropical forest cover and land distribution among shifting cultivators

Can social inequality be seen imprinted in a forest landscape? We studied the relationship between land holding, land use, and inequality in a peasant community in the Peruvian Amazon where farmers practice swidden-fallow cultivation. Longitudinal data on land holding, land use, and land cover were gathered through field-level surveys (n = 316) and household interviews (n = 51) in 1994/1995 and 2007. Forest cover change between 1965 and 2007 was documented through interpretation of air photos and satellite imagery. We introduce the concept of “land use inequality” to capture differences across households in the distribution of forest fallowing and orchard raising as key land uses that affect household welfare and the sustainability of swidden-fallow agriculture. We find that land holding, land use, and forest cover distribution are correlated and that the forest today reflects social inequality a decade prior. Although initially land-poor households may catch up in terms of land holdings, their use and land cover remain impoverished. Differential land use investment through time links social inequality and forest cover. Implications are discussed for the study of forests as landscapes of inequality, the relationship between social inequality and forest composition, and the forest-poverty nexus.

Effects of age and body mass on development of diving capabilities of gray seal pups: costs and benefits of the postweaning fast

Development of adequate diving capabilities is crucial for survival of seal pups and may depend on age and body size. We tracked the diving behavior of 20 gray seal pups during their first 3 mo at sea using satellite relay data loggers. We employed quantile analysis to track upper limits of dive duration and percentage time spent diving, and lower limits of surface intervals. When pups first left the breeding colony, extreme (ninety-fifth percentile) dive duration and percentage time spent diving were positively correlated with age, but not mass, at departure. Extreme dive durations and percentage time spent diving peaked at [Formula: see text] d of age at values comparable with those of adults, but were not sustained. Greater peaks in extreme percentage time spent diving occurred in pups that had higher initial values, were older at their peak, and were heavier at departure. Pups that were smaller and less capable divers when they left the colony improved extreme dive durations and percentage time spent diving more rapidly, once they were at sea. Minimum survival time correlated positively with departure mass. Pups that were heavier at weaning thus benefitted from being both larger and older at departure, but smaller pups faced a trade-off. While age at departure had a positive effect on early dive performance, departure mass impacted on peak percentage time spent diving and longer-term survival. We speculate that once small pups have attained a minimum degree of physiological development to support diving, they would benefit by leaving the colony when younger but larger to maximize limited fuel reserves, rather than undergoing further maturation on land away from potential food resources, because poor divers may be able to "catch up" once at sea.

Resting energy expenditure, macronutrient utilization, and body composition in term infants after corrective surgery of major congenital anomalies: a case-study

Introduction - Knowledge on the metabolic changes and nutritional needs during the postsurgical anabolic phase in infants is scarce. This analysis explores the associations of resting energy expenditure (REE) and macronutrient utilization with body composition of full-term infants, during catch-up growth after corrective surgery of major congenital anomalies. Methods - A cohort of full-term appropriate for-gestational-age neonates subjected to corrective surgery of major congenital anomalies were recruited after gaining weight for at least one week. REE and macronutrient utilization, measured by respiratory quotient (RQ), were assessed by indirect calorimetry using the Deltatrac II Metabolic Monitor ®. Body composition, expressed as fat-free mass (FFM), fat mass (FM) and adiposity defined as percentage of FM (% FM), was measured by air displacement plethysmography using the Pea Pod ®. Results - Four infants were included at 3 to 5 postnatal weeks. Recommended energy and macronutrient intakes for healthy term infants were provided. Through the study, the median (min-max) REE (Kcal/Kg FFM/d) was 70.8 (60.6-96.1) and RQ was 0.99 (0.72-1.20). Steady increases in both body weight and FFM were associated with initial decrease in FM and adiposity followed by their increase. Low RQ preceded decrease in adiposity. Conclusion - The marked adiposity depletion, not expected during steady weight gain in the postsurgical period, prompts us to report this finding. The subsequent adiposity catch-up was associated with relatively high REE and RQ, suggesting preferential oxidation of carbohydrates and preservation of lipids for fat storage.

Intercepting Cyclic Dinucleotide Signaling with Small Molecules

Bacterial infections, especially the ones that are caused by multidrug-resistant strains, are becoming increasingly difficult to treat and put enormous stress on healthcare systems. Recently President Obama announced a new initiative to combat the growing problem of antibiotic resistance. New types of antibiotic drugs are always in need to catch up with the rapid speed of bacterial drug-resistance acquisition. Bacterial second messengers, cyclic dinucleotides, play important roles in signal transduction and therefore are currently generating great buzz in the microbiology community because it is believed that small molecules that inhibit cyclic dinucleotide signaling could become next-generation antibacterial agents. The first identified cyclic dinucleotide, c-di-GMP, has now been shown to regulate a large number of processes, such as virulence, biofilm formation, cell cycle, quorum sensing, etc. Recently, another cyclic dinucleotide, c-di-AMP, has emerged as a regulator of key processes in Gram-positive and mycobacteria. C-di-AMP is now known to regulate DNA damage sensing, fatty acid synthesis, potassium ion transport, cell wall homeostasis and host type I interferon response induction. Due to the central roles that cyclic dinucleotides play in bacteria, we are interested in small molecules that intercept cyclic dinucleotide signaling with the hope that these molecules would help us learn more details about cyclic dinucleotide signaling or could be used to inhibit bacterial viability or virulence. This dissertation documents the development of several small molecule inhibitors of a cyclic dinucleotide synthase (DisA from B. subtilis) and phosphodiesterases (RocR from P. aeruginosa and CdnP from M. tuberculosis). We also demonstrate that an inhibitor of RocR PDE can inhibit bacterial swarming motility, which is a virulence factor.

Effective Approaches to Enhancing the Social Dimension of Higher Education

Despite all intentions in the course of the Bologna Process and decades of investment into improving the social dimension, results in many national and international studies show that inequity remains stubbornly persistent, and that inequity based on socio-economic status, parental education, gender, country-of-origin, rural background and more continues to prevail in our Higher Education systems and at the labour market. While improvement has been shown, extrapolation of the gains of the last 40 years in the field show that it could take over 100 years for disadvantaged groups to catch up with their more advantaged peers, should the current rate of improvement be maintained. Many of the traditional approaches to improving equity have also necessitated large-scale public investments, in the form of direct support to underrepresented groups. In an age of austerity, many countries in Europe are finding it necessary to revisit and scale down these policies, so as to accommodate other priorities, such as balanced budgets or dealing with an aging population. An analysis of the current situation indicates that the time is ripe for disruptive innovations to mobilise the cause forward by leaps and bounds, instead of through incrementalist approaches. Despite the list of programmes in this analysis there is very little evidence as to the causal link between programmes, methodologies for their use and increases/improvements in equity in institutions. This creates a significant information gap for institutions and public authorities seeking for indicators to allocate limited resources to equity improving initiatives, without adequate evidence of effectiveness. The IDEAS project and this publication aims at addressing and improving this information gap. (DIPF/Orig.)

School Development in Urbanizing Areas

Good schools are essential for building thriving urban areas. They are important for preparing the future human resource and directly contribute to social and economic development of a place. They not only act as magnets for prospective residents, but also are necessary for retaining current population. As public infrastructure, schools mirror their neighborhood. “Their location, design and physical condition are important determinants of neighborhood quality, regional growth and change, and quality of life.”2 They impact housing development and utility requirements among many things. Hence, planning for schools along with other infrastructure in an area is essential. Schools are very challenging to plan, especially in urbanizing areas with changing demographic dynamics, where the development market and housing development can shift drastically a number of times. In such places projecting the future school enrollments is very difficult and in case of large population influx, school development can be unable to catch up with population growth which results in overcrowding. Typical is the case of Arlington County VA. In the past two decades the County has changed dramatically from a collection of bedroom communities in Washington DC Metro Region to a thriving urban area. Its metro accessible urban corridors are among most desired locations for development in the region. However, converting single family neighborhoods into high density areas has put a lot of pressure on its school facilities and has resulted in overcrowded schools. Its public school enrollment has grown by 19% from 2009 to 2014.3 While the percentage of population under 5 years age has increased in last 10 years, those in the 5-19 age group have decreased4. Hence, there is more pressure on the elementary school facilities than others in the County. Design-wise, elementary schools, due to their size, can be imagined as a community component. There are a number of strategies that can be used to develop elementary school in urbanizing areas as a part of the neighborhood. Experimenting with space planning and building on partnership and mixed-use opportunities can help produce better designs for new schools in future. This thesis is an attempt to develop elementary school models for urbanizing areas of Arlington County. The school models will be designed keeping in mind the shifting nature of population and resulting student enrollments in these areas. They will also aim to be efficient and sustainable, and lead to the next generation design for elementary school education. The overall purpose of the project is to address barriers to elementary school development in urbanizing areas through creative design and planning strategies. To test above mentioned ideas, the Joint-Use School typology of housing +school design has been identified for elementary school development in urbanizing areas in this thesis project. The development is based on the Arlington Public School’s Program guidelines (catering to 600 students). The site selected for this project is Clarendon West (part of Red Top Cab Properties) in Clarendon, Arlington County VA.

Fishing power and standardised catch rates: Implications of missing vessel-characteristic data from the Australian eastern king prawn fishery

Standardised time series of fishery catch rates require collations of fishing power data on vessel characteristics. Linear mixed models were used to quantify fishing power trends and study the effect of missing data encountered when relying on commercial logbooks. For this, Australian eastern king prawn (Melicertus plebejus) harvests were analysed with historical (from vessel surveys) and current (from commercial logbooks) vessel data. Between 1989 and 2010, fishing power increased up to 76%. To date, both forward-filling and, alternatively, omitting records with missing vessel information from commercial logbooks produce broadly similar fishing power increases and standardised catch rates, due to the strong influence of years with complete vessel data (16 out of 23 years of data). However, if gaps in vessel information had not originated randomly and skippers from the most efficient vessels were the most diligent at filling in logbooks, considerable errors would be introduced. Also, the buffering effect of complete years would be short lived as years with missing data accumulate. Given ongoing changes in fleet profile with high-catching vessels fishing proportionately more of the fleet’s effort, compliance with logbook completion, or alternatively ongoing vessel gear surveys, is required for generating accurate estimates of fishing power and standardised catch rates.

Efficiency and catch dynamics of collapsible square and conical pots used in the red king crab (Paralithodes camtschaticus) fishery

We compared the capture efficiency and catch dynamics of collapsible square and conical pots used in resource assessment and harvesting of red king crabs (Paralithodes camtschaticus [Tilesius, 1815]) in the Barents Sea. After two days of soaking, square pots caught three times as many crabs as conical pots, and their catches consisted of a higher proportion of male crabs and male crabs larger than 160 mm carapace length compared to the catches in the conical pots. Catches in the square pots did not increase as soak times were increased beyond two days, which indicates equilibrium between the rate of entries into and the rate of exits from the pots. Catches in conical pots, however, increased with increasing soak times up to eight days, the longest soak time examined in this study. These findings demonstrate the higher efficiency of square pots and the importance of understanding catch dynamics when making population assessments based on catchper-unit-of-effort data. The favorable catch characteristics and handling properties of the collapsible square pot may make this pot design suitable for other crab fisheries, as well.

The U.S. Gulf of Mexico Pink Shrimp, Farfantepenaeus duorarum, Fishery: 50 Years of Commercial Catch Statistics

U.S. Gulf of Mexico, pink shrimp, Farfantepenaeus duorarum, catch statistics have been collected by NOAA’s National Marine Fisheries Service, or its predecessor agency, for over 50 years. Recent events, including hurricanes and oil spills within the ecosystem of the fishery, have shown that documentation of these catch data is of primary importance. Fishing effort for this stock has fluctuated over the 50-year period analyzed, ranging from 3,376 to 31,900 days fished, with the most recent years on record, 2008 and 2009, exhibiting declines up to 90% relative to the high levels recorded in the mid 1990’s. Our quantification of F. duorarum landings and catch rates (CPUE) indicates catch have been below the long-term average of about 12 million lb for all of the last 10 years on record. In contrast to catch and effort, catch rates have increased in recent years, with record CPUE levels measured in 2008 and 2009, of 1,340 and 1,144 lb per day fished, respectively. Our regression results revealed catch was dependent upon fishing effort (F=98.48df=1, 48, p<0.001, r2=0.67), (Catch=1,623,378 + (520) × (effort)). High CPUE’s measured indicate stocks were not in decline prior to 2009, despite the decline in catch. The decrease in catch is attributed in large part to low effort levels caused by economical and not biological or habitat related conditions. Future stock assessments using these baseline data will provide further insights and management advice concerning the Gulf of Mexic

Report of Catch Assessment Survey of Lake Albert – Albert Nile conducted in July 2012

A Catch Assessment Surveys (CAS) with the overall objective of generating information on the fish production and commercial value of the fisheries of Lake Albert and Albert Nile system was implemented by the National Fisheries Resources Research Institute (NAFIRRI) in collaboration with the Department of Fisheries Resources (DFR), Local Government staff (FOs) and BMU members at selected landing sites on Lake Albert (12 landing sites) and Albert Nile (26 landing sites) in July 2012. A total 622 and 313 boat days on Lake Albert and Albert Nile respectively were sampled for a period of 9 days. Results indicate an annual landing of 151,600 and 5,900 tonnes (t) of fish with an estimated beach value of 122.5 and 14 Billion (UShs) from Lake Albert and Albert Nile respectively. Over 80% of the catch from Lake Albert comprised the small pelagic species; Neobola bredoi (Muziri) and Brycinus nurse (Ragoogi) followed by Nile perch (6%). However, due to low market value of the small fishes and the high prices attached to Nile perch for industrial processing and export market, the contribution of the latter to beach value rose to 34% of the total. The contribution of the light fishery based on small pelagic species (B. nurse and N. bredoi) are insignificant on Albert Nile. Even if the small pelagic species may be present in the river system, a light fishery based on these two is yet to be developed. Proportionally, Albert Nile still remain a multispecies fishery with over 20 fish species harvested commercially. Interestingly, the Albert Nile fishery still remains primitive with simple crafts and gears (mainly dugout canoes, traps, and gillnets). This could suggest that the more developed the system becomes the higher the level of transformation in its fisheries leading to simplification, characterized by reduction in multispecies nature and dominance of few species. Illegal gears especially undersized gillnet of mesh size less than 4 inches were the most dominant in the Lake Albert and Albert Nile fisheries. They captured large quantities of immature fish particularly when used to target Nile perch, Bagrus, Nile tilapia, and large Barbus spp. Their impact when used to target the smaller species (Ragoogi, Angara & Ngasia) is yet to be evaluated. A specific study to analyze selectivity and impacts of these nets is a recommended. However, the dominance of 1.5” mesh sizes especially on Albert Nile to target Angara, Ngassia and Barbus, is definitely destructive to their fisheries and should be checked forthwith. In addition, there is an emerging fishing method locally referred to as “Salsio or Luzira” whereby fishers stay on the lake from 3 days up to 2 weeks without returning to the landing site. They carry with them food and salt for processing the catches on the lake, and in the case of Albert Nile on make shift shelters on islands and in the game park. They normally use gillnets of 3-3½ inch mesh size and caught mainly Nile perch & Bagrus (Pethi & Munama). On return they land several tons of fish. Most of these Catches are not captured in the estimates presented in our analyses since we target daily fishing boats. The possible impacts of this fishing method should be studied and appropriate action recommended.

Final report of the Fisheries Catch Assessment Survey in the Ugandan waters of Lake Victoria for the May 2011 survey

This report presents findings of the CAS conducted in the Ugandan waters of Lake Victoria in May 2011. The results of the previous eleven CASs conducted under the IFMP of the LVFO programme in July, August, September and November 2005; in March, August and December 2006; in March and August 2007; in February and December 2008; and March 2010 are included to show the emerging trends. The report also presents annual catch estimates for the Ugandan part of the lake from 2005 to 2011. Through these CASs, information is building up to show the emerging picture of fish production in the Ugandan waters of the lake. Similar surveys are conducted in the Kenyan and Tanzanian parts of the lake, which provide the lake wide perspective of fisheries production but this time not simultaneously as under the LVFO effort due to different sources and timing of funding. These data can now be utilised together with other Resource and Socio-economic Monitoring survey data for a stock assessment of the lake to provide a firm basis for planning and management of the fisheries resources.