Integrity-based kernel malware detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. ^ We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. ^ We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. ^ We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). ^ In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.^

Non-equilibrium induction of tin in germanium: towards direct bandgap Ge1-xSnx nanowires

The development of non-equilibrium group IV nanoscale alloys is critical to achieving new functionalities, such as the formation of a direct bandgap in a conventional indirect bandgap elemental semiconductor. Here, we describe the fabrication of uniform diameter, direct bandgap Ge1-xSnx alloy nanowires, with a Sn incorporation up to 9.2[thinsp]at.%, far in excess of the equilibrium solubility of Sn in bulk Ge, through a conventional catalytic bottom-up growth paradigm using noble metal and metal alloy catalysts. Metal alloy catalysts permitted a greater inclusion of Sn in Ge nanowires compared with conventional Au catalysts, when used during vapour-liquid-solid growth. The addition of an annealing step close to the Ge-Sn eutectic temperature (230[thinsp][deg]C) during cool-down, further facilitated the excessive dissolution of Sn in the nanowires. Sn was distributed throughout the Ge nanowire lattice with no metallic Sn segregation or precipitation at the surface or within the bulk of the nanowires. The non-equilibrium incorporation of Sn into the Ge nanowires can be understood in terms of a kinetic trapping model for impurity incorporation at the triple-phase boundary during growth.

Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

From Scarcity to Overload: Finding “Good Enough” Public Information in Myanmar’s Transition Information Symposium Summary Report

The Myanmar Book Aid Preservation Foundation (MBAPF) and Enlightened Research Myanmar (EMR) held an Information Symposium titled, From Scarcity to Overload: Finding “Good Enough” Public Information in Myanmar’s Transition in Yangon, Myanmar on January 28-29, 2016. The Symposium was co-sponsored by the University of Washington’s Henry M. Jackson School of International Studies (JSIS) and the Technology & Social Change Group (TASCHA) of the University’s Information School with support from the United States Agency for International Development (USAID), Microsoft, the Bill & Melinda Gates Foundation, and the Asia Foundation. The Information Symposium was held as part of a larger project supported by USAID, Microsoft, the Bill & Melinda Gates Foundation, and the Tableau Foundation implemented by the University of Washington’s JSIS and TASCHA, along with Myanmar partners, MBAPF and EMR. This project, Information Strategies for Societies in Transition, was developed largely because of the staggering challenges Myanmar is facing as it seeks to “catch-up” in the world’s most economically competitive region.

Forests as landscapes of social inequality: tropical forest cover and land distribution among shifting cultivators

Can social inequality be seen imprinted in a forest landscape? We studied the relationship between land holding, land use, and inequality in a peasant community in the Peruvian Amazon where farmers practice swidden-fallow cultivation. Longitudinal data on land holding, land use, and land cover were gathered through field-level surveys (n = 316) and household interviews (n = 51) in 1994/1995 and 2007. Forest cover change between 1965 and 2007 was documented through interpretation of air photos and satellite imagery. We introduce the concept of “land use inequality” to capture differences across households in the distribution of forest fallowing and orchard raising as key land uses that affect household welfare and the sustainability of swidden-fallow agriculture. We find that land holding, land use, and forest cover distribution are correlated and that the forest today reflects social inequality a decade prior. Although initially land-poor households may catch up in terms of land holdings, their use and land cover remain impoverished. Differential land use investment through time links social inequality and forest cover. Implications are discussed for the study of forests as landscapes of inequality, the relationship between social inequality and forest composition, and the forest-poverty nexus.

Effects of age and body mass on development of diving capabilities of gray seal pups: costs and benefits of the postweaning fast

Development of adequate diving capabilities is crucial for survival of seal pups and may depend on age and body size. We tracked the diving behavior of 20 gray seal pups during their first 3 mo at sea using satellite relay data loggers. We employed quantile analysis to track upper limits of dive duration and percentage time spent diving, and lower limits of surface intervals. When pups first left the breeding colony, extreme (ninety-fifth percentile) dive duration and percentage time spent diving were positively correlated with age, but not mass, at departure. Extreme dive durations and percentage time spent diving peaked at [Formula: see text] d of age at values comparable with those of adults, but were not sustained. Greater peaks in extreme percentage time spent diving occurred in pups that had higher initial values, were older at their peak, and were heavier at departure. Pups that were smaller and less capable divers when they left the colony improved extreme dive durations and percentage time spent diving more rapidly, once they were at sea. Minimum survival time correlated positively with departure mass. Pups that were heavier at weaning thus benefitted from being both larger and older at departure, but smaller pups faced a trade-off. While age at departure had a positive effect on early dive performance, departure mass impacted on peak percentage time spent diving and longer-term survival. We speculate that once small pups have attained a minimum degree of physiological development to support diving, they would benefit by leaving the colony when younger but larger to maximize limited fuel reserves, rather than undergoing further maturation on land away from potential food resources, because poor divers may be able to "catch up" once at sea.

Análise dos efeitos da legislação urbanística na formação e crescimento do Bairro de Lagoa Nova: planos diretores de 1974, 1984 e 1994

To Analyze the Managing Plans of Natal in the decades of 1970, 1980 and 1990, identifying elements that had contributed for the growth of the Lagoa Nova quarter, capital one of the Rio Grande do Norte state. Ahead of the sped up growth of the urban centers, many times is not given to analyze which law had taken care of to its objective, and which the imperfections that had appeared during the application of these laws. To make the comparisons in you square them chosen at there distantinct times made possible to analyze the form as the ground of Lagoa Nova absorbed the proposals laws.Therefore toanalyze influences it of the Managing Plans, to make comparatives analyses between the urbanistics condicion, made possible to understand that the fabric urban of the quarter of Lagoa Nova is a true granary of information that it makes possible to the dedicated ones to the urban studies, a true field of analysis

Intercepting Cyclic Dinucleotide Signaling with Small Molecules

Bacterial infections, especially the ones that are caused by multidrug-resistant strains, are becoming increasingly difficult to treat and put enormous stress on healthcare systems. Recently President Obama announced a new initiative to combat the growing problem of antibiotic resistance. New types of antibiotic drugs are always in need to catch up with the rapid speed of bacterial drug-resistance acquisition. Bacterial second messengers, cyclic dinucleotides, play important roles in signal transduction and therefore are currently generating great buzz in the microbiology community because it is believed that small molecules that inhibit cyclic dinucleotide signaling could become next-generation antibacterial agents. The first identified cyclic dinucleotide, c-di-GMP, has now been shown to regulate a large number of processes, such as virulence, biofilm formation, cell cycle, quorum sensing, etc. Recently, another cyclic dinucleotide, c-di-AMP, has emerged as a regulator of key processes in Gram-positive and mycobacteria. C-di-AMP is now known to regulate DNA damage sensing, fatty acid synthesis, potassium ion transport, cell wall homeostasis and host type I interferon response induction. Due to the central roles that cyclic dinucleotides play in bacteria, we are interested in small molecules that intercept cyclic dinucleotide signaling with the hope that these molecules would help us learn more details about cyclic dinucleotide signaling or could be used to inhibit bacterial viability or virulence. This dissertation documents the development of several small molecule inhibitors of a cyclic dinucleotide synthase (DisA from B. subtilis) and phosphodiesterases (RocR from P. aeruginosa and CdnP from M. tuberculosis). We also demonstrate that an inhibitor of RocR PDE can inhibit bacterial swarming motility, which is a virulence factor.

Effective Approaches to Enhancing the Social Dimension of Higher Education

Despite all intentions in the course of the Bologna Process and decades of investment into improving the social dimension, results in many national and international studies show that inequity remains stubbornly persistent, and that inequity based on socio-economic status, parental education, gender, country-of-origin, rural background and more continues to prevail in our Higher Education systems and at the labour market. While improvement has been shown, extrapolation of the gains of the last 40 years in the field show that it could take over 100 years for disadvantaged groups to catch up with their more advantaged peers, should the current rate of improvement be maintained. Many of the traditional approaches to improving equity have also necessitated large-scale public investments, in the form of direct support to underrepresented groups. In an age of austerity, many countries in Europe are finding it necessary to revisit and scale down these policies, so as to accommodate other priorities, such as balanced budgets or dealing with an aging population. An analysis of the current situation indicates that the time is ripe for disruptive innovations to mobilise the cause forward by leaps and bounds, instead of through incrementalist approaches. Despite the list of programmes in this analysis there is very little evidence as to the causal link between programmes, methodologies for their use and increases/improvements in equity in institutions. This creates a significant information gap for institutions and public authorities seeking for indicators to allocate limited resources to equity improving initiatives, without adequate evidence of effectiveness. The IDEAS project and this publication aims at addressing and improving this information gap. (DIPF/Orig.)

Análise dos efeitos da legislação urbanística na formação e crescimento do Bairro de Lagoa Nova: planos diretores de 1974, 1984 e 1994

To Analyze the Managing Plans of Natal in the decades of 1970, 1980 and 1990, identifying elements that had contributed for the growth of the Lagoa Nova quarter, capital one of the Rio Grande do Norte state. Ahead of the sped up growth of the urban centers, many times is not given to analyze which law had taken care of to its objective, and which the imperfections that had appeared during the application of these laws. To make the comparisons in you square them chosen at there distantinct times made possible to analyze the form as the ground of Lagoa Nova absorbed the proposals laws.Therefore toanalyze influences it of the Managing Plans, to make comparatives analyses between the urbanistics condicion, made possible to understand that the fabric urban of the quarter of Lagoa Nova is a true granary of information that it makes possible to the dedicated ones to the urban studies, a true field of analysis

Crescita volumetrica dei miomi uterini: analisi dei fattori di rischio

I miomi uterini sono la neoplasia uterina più comune e colpiscono fino al 30% delle donne in età fertile. Nonostante l’elevata prevalenza, pochi studi in Letteratura hanno analizzato i fattori di rischio per la crescita dei miomi uterini, mostrando spesso dei risultati contrastanti. Nel nostro studio osservazionale prospettico sono state arruolate pazienti che rispettassero i criteri di inclusione e di esclusione, con diagnosi di miomi uterini evidenziati mediante ecografia eseguita presso i nostri ambulatori, a partire da giugno 2017. A partire da gennaio 2019, sono state ricercate mensilmente le pazienti precedentemente arruolate che erano tornate presso i nostri ambulatori per esecuzione di ulteriore ecografia, a distanza di 24 ± 5 mesi, fino a raggiungere il campione designato, cioè 450 pazienti totali. È stato, quindi, valutato il tasso di crescita annuo del mioma di maggiori dimensioni ed è stato utilizzato l'approccio polinomiale frazionario multivariabile per selezionare i fattori di rischio anamnestici ed ecografici legati all’incremento volumetrico. Circa la metà dei miomi uterini analizzati ha mostrato stabilità dimensionale nel corso del follow-up (crescita ≤10%), mentre la restante metà ha mostrato una crescita > 10%. Il solo fattore di rischio associato alla crescita volumetrica dei miomi uterini è risultato essere il volume del mioma durante l’ecografia di arruolamento (P = 0.001), quindi miomi di piccole dimensioni presentano un tasso di crescita maggiore rispetto ai miomi di grandi dimensioni. Lo studio ha raccolto la più ampia casistica in Letteratura nella valutazione del naturale andamento di modifica dimensionale dei miomi uterini. Sebbene siano necessari ulteriori studi con campione più ampio, questi dati possono fornire un utile supporto per eseguire un adeguato counselling con le pazienti nella pratica clinica quotidiana.

Body mass index trajectories and predictors among 3rd to 12th graders using growth curve mixture modeling the Child and Adolescent Trial for Cardiovascular Health (CATCH) study

This dissertation examined body mass index (BMI) growth trajectories and the effects of gender, ethnicity, dietary intake, and physical activity (PA) on BMI growth trajectories among 3rd to 12th graders (9-18 years of age). Growth curve model analysis was performed using data from The Child and Adolescent Trial for Cardiovascular Health (CATCH) study. The study population included 2909 students who were followed up from grades 3-12. The main outcome was BMI at grades 3, 4, 5, 8, and 12. ^ The results revealed that BMI growth differed across two distinct developmental periods of childhood and adolescence. Rate of BMI growth was faster in middle childhood (9-11 years old or 3rd - 5th grades) than in adolescence (11-18 years old or 5th - 12th grades). Students with higher BMI at 3rd grade (baseline) had faster rates of BMI growth. Three groups of students with distinct BMI growth trajectories were identified: high, average, and low. ^ Black and Hispanic children were more likely to be in the groups with higher baseline BMI and faster rates of BMI growth over time. The effects of gender or ethnicity on BMI growth differed across the three groups. The effects of ethnicity on BMI growth were weakened as the children aged. The effects of gender on BMI growth were attenuated in the groups with a large proportion of black and Hispanic children, i.e., “high” or “average” BMI trajectory group. After controlling for gender, ethnicity, and age at baseline, in the “high BMI trajectory”, rate of yearly BMI growth in middle childhood increased 0.102 for every 500 Kcals increase (p=0.049). No significant effects of percentage of energy from total fat and saturated fat on BMI growth were found. Baseline BMI increased 0.041 for every 30 minutes increased in moderate-to-vigorous PA (MVPA) in the “low BMI trajectory”, while Baseline BMI decreased 0.345 for every 30 minutes increased in vigorous PA (VPA) in the “high BMI trajectory”. ^ Childhood overweight and obesity interventions should start at the earliest possible ages, prior to 3rd grade and continue through grade school. Interventions should focus on all children, but specifically black and Hispanic children, who are more likely to be highest at-risk. Promoting VPA earlier in childhood is important for preventing overweight and obesity among children and adolescents. Interventions should target total energy intake, rather than only percentage of energy from total fat or saturated fat. ^

Growth, habit formation, and catching-up\ with the Joneses

When habits are introduced multiplicatively in a capital accumulation model, the consumers' objective function might fail to be concave. In this paper we provide conditions aimed at guaranteeing the existence of interior solutions to the consumers' problem. We also characterize the equilibrium path of two growth models with multiplicative habits: the internal habit formation model, where individual habits coincide with own past consumption, and the external habit formation (or catching-up with the Joneses) model, where habits arise from the average past consumption in the economy. We show that the introduction of external habits makes the equilibrium path inefficient during the transition towards the balanced growth path. We characterize in this context the optimal tax policy.

A growth hormone-releasing peptide that binds scavenger receptor CD36 and ghrelin receptor up-regulates sterol transporters and cholesterol efflux in macrophages through a peroxisome proliferator-activated receptor gamma-dependent pathway.

Macrophages play a central role in the pathogenesis of atherosclerosis by accumulating cholesterol through increased uptake of oxidized low-density lipoproteins by scavenger receptor CD36, leading to foam cell formation. Here we demonstrate the ability of hexarelin, a GH-releasing peptide, to enhance the expression of ATP-binding cassette A1 and G1 transporters and cholesterol efflux in macrophages. These effects were associated with a transcriptional activation of nuclear receptor peroxisome proliferator-activated receptor (PPAR)gamma in response to binding of hexarelin to CD36 and GH secretagogue-receptor 1a, the receptor for ghrelin. The hormone binding domain was not required to mediate PPARgamma activation by hexarelin, and phosphorylation of PPARgamma was increased in THP-1 macrophages treated with hexarelin, suggesting that the response to hexarelin may involve PPARgamma activation function-1 activity. However, the activation of PPARgamma by hexarelin did not lead to an increase in CD36 expression, as opposed to liver X receptor (LXR)alpha, suggesting a differential regulation of PPARgamma-targeted genes in response to hexarelin. Chromatin immunoprecipitation assays showed that, in contrast to a PPARgamma agonist, the occupancy of the CD36 promoter by PPARgamma was not increased in THP-1 macrophages treated with hexarelin, whereas the LXRalpha promoter was strongly occupied by PPARgamma in the same conditions. Treatment of apolipoprotein E-null mice maintained on a lipid-rich diet with hexarelin resulted in a significant reduction in atherosclerotic lesions, concomitant with an enhanced expression of PPARgamma and LXRalpha target genes in peritoneal macrophages. The response was strongly impaired in PPARgamma(+/-) macrophages, indicating that PPARgamma was required to mediate the effect of hexarelin. These findings provide a novel mechanism by which the beneficial regulation of PPARgamma and cholesterol metabolism in macrophages could be regulated by CD36 and ghrelin receptor downstream effects.

3-M syndrome associated with growth hormone deficiency: 18 year follow-up of a patient.

3-M syndrome is a rare autosomal recessive disorder that causes short stature, unusual facial features and skeletal abnormalities. Mutations in the CUL7, OBSL1 and CCDC8 genes could be responsible for 3-M syndrome.Here we describe the growth and evolution of dismorphic features of an Italian boy with 3-M syndrome and growth hormone deficiency (GHD) from birth until adulthood. He was born full term with a very low birth weight (2400 g=-3.36 standard deviation score, SDS) and length (40.0 cm =-6.53 SDS). At birth he presented with a broad, fleshy nose with anteverted nostrils, thick and patulous lips, a square chin, curvilinear shaped eyebrows without synophrys, short thorax and long slender bones. Then, during childhood tall vertebral bodies, hip dislocation, transverse chest groove, winged scapulae and hyperextensible joints became more evident and the diagnosis of 3-M syndrome was made; this was also confirmed by the finding of a homozygous deletion in exon 18 of the CUL7 gene, which has not been previously described.The patient also exhibited severe GHD (GH <5 ng/ml) and from the age of 18 months was treated with rhGH. Notwithstanding the early start of therapy and good compliance, his growth rate was always very low, except for the first two years of treatment and he achieved a final height of 132 cm (-6.42 SDS).