Integrity-based kernel malware detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. ^ We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. ^ We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. ^ We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). ^ In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.^

Modelagem e análise dinâmica de um sistema de conversão de energia eólica dotado de gerador síncrono de imã permanente utilizando a plataforma ATP

Human development requires a broad balance between ecological, social and economic factors in order to ensure its own sustainability. In this sense, the search for new sources of energy generation, with low deployment and operation costs, which cause the least possible impact to the environment, has been the focus of attention of all society segments. To do so, the reduction in exploration of fossil fuels and the encouragement of using renewable energy resources for distributed generation have proved interesting alternatives to the expansion of the energy matrix of various countries in the world. In this sense, the wind energy has acquired an increasingly significant role, presenting increasing rates of power grid penetration and highlighting technological innovations such as the use of permanent magnet synchronous generators (PMSG). In Brazil, this fact has also been noted and, as a result, the impact of the inclusion of this source in the distribution and sub-transmission power grid has been a major concern of utilities and agents connected to Brazilian electrical sector. Thus, it is relevant the development of appropriate computational tools that allow detailed predictive studies about the dynamic behavior of wind farms, either operating with isolated load, either connected to the main grid, taking also into account the implementation of control strategies for active/reactive power generation and the keeping of adequate levels of voltage and frequency. This work fits in this context since it comprises mathematical and computational developments of a complete wind energy conversion system (WECS) endowed with PMSG using time domain techniques of Alternative Transients Program (ATP), which prides itself a recognized reputation by scientific and academic communities as well as by electricity professionals in Brazil and elsewhere. The modeling procedures performed allowed the elaboration of blocks representing each of the elements of a real WECS, comprising the primary source (the wind), the wind turbine, the PMSG, the frequency converter, the step up transformer, the load composition and the power grid equivalent. Special attention is also given to the implementation of wind turbine control techniques, mainly the pitch control responsible for keeping the generator under the maximum power operation point, and the vector theory that aims at adjusting the active/reactive power flow between the wind turbine and the power grid. Several simulations are performed to investigate the dynamic behavior of the wind farm when subjected to different operating conditions and/or on the occurrence of wind intensity variations. The results have shown the effectiveness of both mathematical and computational modeling developed for the wind turbine and the associated controls.

Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

Applications of a Collaborative Open Object Oriented Learning Environment to Electronics, Computing and Mathematics Education

A lightweight Java application suite has been developed and deployed allowing collaborative learning between students and tutors at remote locations. Students can engage in group activities online and also collaborate with tutors. A generic Java framework has been developed and applied to electronics, computing and mathematics education. The applications are respectively: (a) a digital circuit simulator, which allows students to collaborate in building simple or complex electronic circuits; (b) a Java programming environment where the paradigm is behavioural-based robotics, and (c) a differential equation solver useful in modelling of any complex and nonlinear dynamic system. Each student sees a common shared window on which may be added text or graphical objects and which can then be shared online. A built-in chat room supports collaborative dialogue. Students can work either in collaborative groups or else in teams as directed by the tutor. This paper summarises the technical architecture of the system as well as the pedagogical implications of the suite. A report of student evaluation is also presented distilled from use over a period of twelve months. We intend this suite to facilitate learning between groups at one or many institutions and to facilitate international collaboration. We also intend to use the suite as a tool to research the establishment and behaviour of collaborative learning groups. We shall make our software freely available to interested researchers.

A review of risk factors for hamstring injury in soccer: a biomechanical approach

The aim has been to review the literature about the risk factors of hamstring injury in soccer from a biomechanical point of view. METHODOLOGY. Data bases of bibliography references were Medline, Scopus and SportDiscuss. RESULTS AND DISCUSSION. Many prospective studies have shown that the previous injury is the greatest risk factor of sustaining the injury. However the primary causes of the injury are unclear in soccer. A lack of hamstring flexibility has been one of the main injury risk factors with controversies on the results. Imbalance of isokinetic force is a risk factor but electrical coactivation of all muscles participating during knee flexion and extension are unknown in football. While the importance of lumbopelvic-hamstrings muscles synchronization during running seems to be crucial for understanding the risk of injury, no research has been developed in this topic in football. CONCLUSIONS. More research using new data recording procedures as Dynamic Scanners, Surface EMG, Inverse Dynamic Analysis are needed. The analysis of more specific movements as running, kicking or jumping is clearly required. Managers, coaches, physical trainers, physiotherapists, sport physicians and researchers should work together in order to improve the injury prevention and rehabilitation programs of football players. Key Words: sports biomechanics, soccer, hamstring injury, risk factors

EL "PASS THROUGH" DEL TIPO DE CAMBIO EN LOS PRECIOS DE BIENES TRANSABLES Y NO TRANSABLES EN COSTA RICA

Este trabajo estima el coeficiente de pass through del tipo de cambio en los precios de bienes transables y no transables en Costa Rica, para el corto y el largo plazo. Se utiliza el análisis de mínimos cuadrados para estimar los coeficientes, y se explora la dinámica de ajuste de los modelos utilizando el análisis de vectores auto regresivo. Dentro de los principales resultados del modelo se encontró un coeficiente de pass through para los bienes transables de 13% en el corto plazo y de 68% en el largo plazo; para los bienes no transables, el pass through es de 10% y 52% en el corto y largo plazo respectivamente. En el largo plazo se incluye un 7% de pass through indirecto producto del efecto de los precios de los transables en los de no transables. El estudio de la dinámica de ajuste de los precios de transables y no transables ante un choque del tipo de cambio mostró una duración de 17 y 27 meses respectivamente. Además se realizaron pruebas de causalidad de Granger y estabilidad del modelo. La primera mostró una relación de precedencia entre las variaciones de tipo de cambio e inflación, y entre inflación de los transables y de los no transables. La segunda evidencia un cambio estructural en el modelo de los no transables entre fines de 1995 e inicio de 1996. AbstractThis paper estimates short run and long run coefficients of exchange rate pass through in to the prices of tradable and non tradable goods in Costa Rica. The coefficients are estimated by OLS. A VAR analysis is conducted in order to estimate the dynamic process between exchange rate and inflation. Granger causality test and a stability test are conducted too. The short run pass through coefficients are 13% and 10%, for tradable and non tradable goods respectively and the long run coefficients are 68% and 52% in the same order. There is a second stage pass through of 7% included in the long run coefficient for non tradable goods. The dynamic analysis shows that the adjustment process of prices as a result of an exchange rate shock takes 17 months for tradable goods and 27 months for non tradable goods. The Granger causality test shows precedence between variation in the exchange rate and inflation, and between the prices of tradable and non tradable goods. There is statistical evidence of a structural change in the non tradable model between the end of 1995 and the beginning of 1996.

A frequency-domain pseudo-force method for dynamic structural analysis nonlinear systems and nonproportional damping

A frequency-domain method for nonlinear analysis of structural systems with viscous, hysteretic, nonproportional and frequency-dependent damping is presented. The nonlinear effects and nonproportional damping are considered through pseudo-force terms. The modal coordinates uncoupled equations are iteratively solved. The treatment of initial conditions in the frequency domain which is necessary for the treatment of the uncoupled equations is initially adressed.

NONSAP : a structural analysis program for static and dynamic response of nonlinear systems /

Photocopy of original: Berkeley : Structural Engineering Laboratory, University of California, 1974.

Dynamic positioning systems: An experimental analysis of sliding mode control

Vessel dynamic positioning (DP) systems are based on conventional PID-type controllers and an extended Kalman filter. However, they present a difficult tuning procedure, and the closed-loop performance varies with environmental or loading conditions since the dynamics of the vessel are eminently nonlinear. Gain scheduling is normally used to address the nonlinearity of the system. To overcome these problems, a sliding mode control was evaluated. This controller is robust to variations in environmental and loading conditions, it maintains performance and stability for a large range of conditions, and presents an easy tuning methodology. The performance of the controller was evaluated numerically and experimentally in order to address its effectiveness. The results are compared with those obtained from conventional PID controller. (c) 2010 Elsevier Ltd. All rights reserved.

Variational calculation of static and dynamic vibrational nonlinear optical properties

The vibrational configuration interaction method used to obtain static vibrational (hyper)polarizabilities is extended to dynamic nonlinear optical properties in the infinite optical frequency approximation. Illustrative calculations are carried out on H2 O and N H3. The former molecule is weakly anharmonic while the latter contains a strongly anharmonic umbrella mode. The effect on vibrational (hyper)polarizabilities due to various truncations of the potential energy and property surfaces involved in the calculation are examined

Nonlinear inverse dynamic models of gas sensing systems based on chemical sensor arrays for quantitative measurements

Gas sensing systems based on low-cost chemical sensor arrays are gaining interest for the analysis of multicomponent gas mixtures. These sensors show different problems, e.g., nonlinearities and slow time-response, which can be partially solved by digital signal processing. Our approach is based on building a nonlinear inverse dynamic system. Results for different identification techniques, including artificial neural networks and Wiener series, are compared in terms of measurement accuracy.

Dynamic Criteria: a Longitudinal Analysis of Professional Basketball Players" Outcomes

This paper describes the fluctuations of temporal criteria dynamics in the context of professional sport. Specifically, we try to verify the underlying deterministic patterns in the outcomes of professional basketball players. We use a longitudinal approach based on the analysis of the outcomes of 94 basketball players over ten years, covering practically players" entire career development. Time series were analyzed with techniques derived from nonlinear dynamical systems theory. These techniques analyze the underlying patterns in outcomes without previous shape assumptions (linear or nonlinear). These techniques are capable of detecting an intermediate situation between randomness and determinism, called chaos. So they are very useful for the study of dynamic criteria in organizations. We have found most players (88.30%) have a deterministic pattern in their outcomes, and most cases are chaotic (81.92%). Players with chaotic patterns have higher outcomes than players with linear patterns. Moreover, players with power forward and center positions achieve better results than other players. The high number of chaotic patterns found suggests caution when appraising individual outcomes, when coaches try to find the appropriate combination of players to design a competitive team, and other personnel decisions. Management efforts must be made to assume this uncertainty.

Essays on numerically efficient inference in nonlinear and non-Gaussian state space models, and commodity market analysis.

The first two articles build procedures to simulate vector of univariate states and estimate parameters in nonlinear and non Gaussian state space models. We propose state space speci fications that offer more flexibility in modeling dynamic relationship with latent variables. Our procedures are extension of the HESSIAN method of McCausland[2012]. Thus, they use approximation of the posterior density of the vector of states that allow to : simulate directly from the state vector posterior distribution, to simulate the states vector in one bloc and jointly with the vector of parameters, and to not allow data augmentation. These properties allow to build posterior simulators with very high relative numerical efficiency. Generic, they open a new path in nonlinear and non Gaussian state space analysis with limited contribution of the modeler. The third article is an essay in commodity market analysis. Private firms coexist with farmers' cooperatives in commodity markets in subsaharan african countries. The private firms have the biggest market share while some theoretical models predict they disappearance once confronted to farmers cooperatives. Elsewhere, some empirical studies and observations link cooperative incidence in a region with interpersonal trust, and thus to farmers trust toward cooperatives. We propose a model that sustain these empirical facts. A model where the cooperative reputation is a leading factor determining the market equilibrium of a price competition between a cooperative and a private firm

Speech Analysis using Modern Techniques of Nonlinear Dynamics

Medical fields requires fast, simple and noninvasive methods of diagnostic techniques. Several methods are available and possible because of the growth of technology that provides the necessary means of collecting and processing signals. The present thesis details the work done in the field of voice signals. New methods of analysis have been developed to understand the complexity of voice signals, such as nonlinear dynamics aiming at the exploration of voice signals dynamic nature. The purpose of this thesis is to characterize complexities of pathological voice from healthy signals and to differentiate stuttering signals from healthy signals. Efficiency of various acoustic as well as non linear time series methods are analysed. Three groups of samples are used, one from healthy individuals, subjects with vocal pathologies and stuttering subjects. Individual vowels/ and a continuous speech data for the utterance of the sentence "iruvarum changatimaranu" the meaning in English is "Both are good friends" from Malayalam language are recorded using a microphone . The recorded audio are converted to digital signals and are subjected to analysis.Acoustic perturbation methods like fundamental frequency (FO), jitter, shimmer, Zero Crossing Rate(ZCR) were carried out and non linear measures like maximum lyapunov exponent(Lamda max), correlation dimension (D2), Kolmogorov exponent(K2), and a new measure of entropy viz., Permutation entropy (PE) are evaluated for all three groups of the subjects. Permutation Entropy is a nonlinear complexity measure which can efficiently distinguish regular and complex nature of any signal and extract information about the change in dynamics of the process by indicating sudden change in its value. The results shows that nonlinear dynamical methods seem to be a suitable technique for voice signal analysis, due to the chaotic component of the human voice. Permutation entropy is well suited due to its sensitivity to uncertainties, since the pathologies are characterized by an increase in the signal complexity and unpredictability. Pathological groups have higher entropy values compared to the normal group. The stuttering signals have lower entropy values compared to the normal signals.PE is effective in charaterising the level of improvement after two weeks of speech therapy in the case of stuttering subjects. PE is also effective in characterizing the dynamical difference between healthy and pathological subjects. This suggests that PE can improve and complement the recent voice analysis methods available for clinicians. The work establishes the application of the simple, inexpensive and fast algorithm of PE for diagnosis in vocal disorders and stuttering subjects.

Variational calculation of static and dynamic vibrational nonlinear optical properties

The vibrational configuration interaction method used to obtain static vibrational (hyper)polarizabilities is extended to dynamic nonlinear optical properties in the infinite optical frequency approximation. Illustrative calculations are carried out on H2 O and N H3. The former molecule is weakly anharmonic while the latter contains a strongly anharmonic umbrella mode. The effect on vibrational (hyper)polarizabilities due to various truncations of the potential energy and property surfaces involved in the calculation are examined