Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.

CAT Detect (Computer Activity Timeline Detection) : a tool for detecting inconsistency in computer activity timelines

The construction of timelines of computer activity is a part of many digital investigations. These timelines of events are composed of traces of historical activity drawn from system logs and potentially from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work introduces a software tool (CAT Detect) for the detection of inconsistency within timelines of computer activity. We examine the impact of deliberate tampering through experiments conducted with our prototype software tool. Based on the results of these experiments, we discuss techniques which can be employed to deal with such temporal inconsistencies.

Enhancing security of linux-based android devices

Our daily lives become more and more dependent upon smartphones due to their increased capabilities. Smartphones are used in various ways from payment systems to assisting the lives of elderly or disabled people. Security threats for these devices become increasingly dangerous since there is still a lack of proper security tools for protection. Android emerges as an open smartphone platform which allows modification even on operating system level. Therefore, third-party developers have the opportunity to develop kernel-based low-level security tools which is not normal for smartphone platforms. Android quickly gained its popularity among smartphone developers and even beyond since it bases on Java on top of "open" Linux in comparison to former proprietary platforms which have very restrictive SDKs and corresponding APIs. Symbian OS for example, holding the greatest market share among all smartphone OSs, was closing critical APIs to common developers and introduced application certification. This was done since this OS was the main target for smartphone malwares in the past. In fact, more than 290 malwares designed for Symbian OS appeared from July 2004 to July 2008. Android, in turn, promises to be completely open source. Together with the Linux-based smartphone OS OpenMoko, open smartphone platforms may attract malware writers for creating malicious applications endangering the critical smartphone applications and owners� privacy. In this work, we present our current results in analyzing the security of Android smartphones with a focus on its Linux side. Our results are not limited to Android, they are also applicable to Linux-based smartphones such as OpenMoko Neo FreeRunner. Our contribution in this work is three-fold. First, we analyze android framework and the Linux-kernel to check security functionalities. We survey wellaccepted security mechanisms and tools which can increase device security. We provide descriptions on how to adopt these security tools on Android kernel, and provide their overhead analysis in terms of resource usage. As open smartphones are released and may increase their market share similar to Symbian, they may attract attention of malware writers. Therefore, our second contribution focuses on malware detection techniques at the kernel level. We test applicability of existing signature and intrusion detection methods in Android environment. We focus on monitoring events on the kernel; that is, identifying critical kernel, log file, file system and network activity events, and devising efficient mechanisms to monitor them in a resource limited environment. Our third contribution involves initial results of our malware detection mechanism basing on static function call analysis. We identified approximately 105 Executable and Linking Format (ELF) executables installed to the Linux side of Android. We perform a statistical analysis on the function calls used by these applications. The results of the analysis can be compared to newly installed applications for detecting significant differences. Additionally, certain function calls indicate malicious activity. Therefore, we present a simple decision tree for deciding the suspiciousness of the corresponding application. Our results present a first step towards detecting malicious applications on Android-based devices.

The development of Monte Carlo techniques for the verification of radiotherapy treatments

Introduction: Recent advances in the planning and delivery of radiotherapy treatments have resulted in improvements in the accuracy and precision with which therapeutic radiation can be administered. As the complexity of the treatments increases it becomes more difficult to predict the dose distribution in the patient accurately. Monte Carlo (MC) methods have the potential to improve the accuracy of the dose calculations and are increasingly being recognised as the ‘gold standard’ for predicting dose deposition in the patient [1]. This project has three main aims: 1. To develop tools that enable the transfer of treatment plan information from the treatment planning system (TPS) to a MC dose calculation engine. 2. To develop tools for comparing the 3D dose distributions calculated by the TPS and the MC dose engine. 3. To investigate the radiobiological significance of any errors between the TPS patient dose distribution and the MC dose distribution in terms of Tumour Control Probability (TCP) and Normal Tissue Complication Probabilities (NTCP). The work presented here addresses the first two aims. Methods: (1a) Plan Importing: A database of commissioned accelerator models (Elekta Precise and Varian 2100CD) has been developed for treatment simulations in the MC system (EGSnrc/BEAMnrc). Beam descriptions can be exported from the TPS using the widespread DICOM framework, and the resultant files are parsed with the assistance of a software library (PixelMed Java DICOM Toolkit). The information in these files (such as the monitor units, the jaw positions and gantry orientation) is used to construct a plan-specific accelerator model which allows an accurate simulation of the patient treatment field. (1b) Dose Simulation: The calculation of a dose distribution requires patient CT images which are prepared for the MC simulation using a tool (CTCREATE) packaged with the system. Beam simulation results are converted to absolute dose per- MU using calibration factors recorded during the commissioning process and treatment simulation. These distributions are combined according to the MU meter settings stored in the exported plan to produce an accurate description of the prescribed dose to the patient. (2) Dose Comparison: TPS dose calculations can be obtained using either a DICOM export or by direct retrieval of binary dose files from the file system. Dose difference, gamma evaluation and normalised dose difference algorithms [2] were employed for the comparison of the TPS dose distribution and the MC dose distribution. These implementations are spatial resolution independent and able to interpolate for comparisons. Results and Discussion: The tools successfully produced Monte Carlo input files for a variety of plans exported from the Eclipse (Varian Medical Systems) and Pinnacle (Philips Medical Systems) planning systems: ranging in complexity from a single uniform square field to a five-field step and shoot IMRT treatment. The simulation of collimated beams has been verified geometrically, and validation of dose distributions in a simple body phantom (QUASAR) will follow. The developed dose comparison algorithms have also been tested with controlled dose distribution changes. Conclusion: The capability of the developed code to independently process treatment plans has been demonstrated. A number of limitations exist: only static fields are currently supported (dynamic wedges and dynamic IMRT will require further development), and the process has not been tested for planning systems other than Eclipse and Pinnacle. The tools will be used to independently assess the accuracy of the current treatment planning system dose calculation algorithms for complex treatment deliveries such as IMRT in treatment sites where patient inhomogeneities are expected to be significant. Acknowledgements: Computational resources and services used in this work were provided by the HPC and Research Support Group, Queensland University of Technology, Brisbane, Australia. Pinnacle dose parsing made possible with the help of Paul Reich, North Coast Cancer Institute, North Coast, New South Wales.

Avaliação da extrusão bacteriana apical após instrumentação mecanizada com sistemas reciprocantes de instrumento único comparados a um sistema rotatório multi-instrumento

O objetivo deste estudo foi avaliar ex vivo a extrusão bacteriana apical após instrumentação mecanizada com sistemas reciprocantes de instrumento único e movimento reciprocante (WaveOne and Reciproc) comparados a um sistema multi-instrumentos (BioRaCe). Quarenta e cinco incisivos inferiores humanos unirradiculares, ovais e de anatomia semelhante foram utilizados. Os dentes foram acessados e seus canais radiculares foram contaminados com uma suspensão de Enterococcus faecalis e incubados por 30 dias possibilitando crescimento bacteriano em biofilme. Os dentes contaminados foram divididos em três grupos com 15 espécimes cada (RE - Reciproc, WO -WaveOne e BR - BioRaCe). Foram utilizados oito dentes para grupos controle de crescimento bacteriano positivo e negativo. As bactérias extruídas apicalmente durante a instrumentação foram coletadas em frascos de vidro contendo 0,9% de NaCl. As amostras microbiológicas foram retiradas dos frascos e incubadas em meio BHI ágar, durante 24 horas. O crescimento bacteriano foi contado e os resultados foram expressos em unidades formadoras de colônia (UFC). Os dados foram analisados pelos testes estatísticos de Wilcoxon e Kruskal-Wallis. Não houve diferença estatisticamente significante no número de UFC entre os dois sistemas reciprocantes (p>0,05). Em contrapartida, o sistema de instrumentos rotatórios mostrou uma quantidade de UFC significativamente maior do que os dois outros grupos (p <0,05). A partir da análise dos resultados e dentro das limitações deste estudo foi possível concluir que todos os sistemas de instrumentação testados extruem bactérias apicalmente. No entanto, ambos os sistemas de instrumento único e movimento reciprocante extruem menos bactérias apicalmente do que o sistema rotatório multi-instrumentos de referência.

基于TPM的可信文件系统CIVFS的研究和实现

本文提出一种利用可信计算技术增强文件系统可信性的方法，以Linux为基础，设计实现了一个可信文件系统原型CIVFS。CIVFS是一个结合加密和完整性校验两种保护措施的文件系统，它借助堆式文件系统技术，嵌入在Linux内核中，添加了文件加密和完整性校验模块，利用TPM芯片提供的可信计算和安全存储等功能，增强了对系统安全组件和数据的安全保护。

基于双层ID空间的Peer-to-Peer文件系统设计与实现

提出并实现了一种建立在Peer-to-Peer 搜索策略上的自组织、自适应、高效和可靠的文件系统DISPFS(Double ID Space basedPeer-to-peer File System)。它在双层ID 空间中构造虚拟存储节点,不仅有效地取得了文件系统内的负载均衡、提高系统利用率,而且保证了动态环境中文件的可靠、快速获取。试验数据表明,DISPFS 在系统接近满负荷运行和文件插入/删除操作频繁的双重压力下依然保持优良的性能。

Linux内核多语言文件子系统的设计与实现

操作系统的多语言支持是网络环境下计算机软件发展的必然结果。由于POSIX标准的国际化体系结构对多语言和分布式应用需求的支持有其局限性，导致遵循POSIX标准的Linux文件予系统在支持多语言文本时可能造成数据丢失。本文从多语言角度考察了Linux文件予系统，重新构造了一个能够支持Urdcode编码的逻辑文件系统EXT2U，改进了文件予系统，同时提供了基于Urdcode编码的系统调用接口。通过新文件系统与系统调用接口，为操作系统多语言处理提供了更好的基础。

一种面向基于属性存取的文件系统的设计与实现

基于属性的存取，对于在包含不同来源的大量文件的系统中进行有效的信息管理来说，是一种非常具有吸引力的特性。然而尽管在相当长的一段时间内其价值已广为人知，该特性的真正有实用价值的实现仍然非常之少。本文探讨了实现该特性时面临的主要挑战，以及它们是怎样在一种专为此目的设计的文件系统中，通过成功的应用各种原则而被妥善处理。

具有事件恢复功能的文件系统的研究与实现

把一个进程在其执行过程中对文件的一系列修改称为一个事件.为了解决如何方便有效地恢复某个事件对文件的修改,研究并实现了一个具有事件恢复功能的文件系统GobackFS.GobackFS是一个用户空间文件系统,基于FUSE框架实现.测试结果表明,GobackFS文件系统在读写性能方面略低于Ext3文件系统,寻道速度方面略高于后者.

分布式文件系统Hadoop HDFS与传统文件系统Linux FS的比较与分析

对现有HDFS的设计架构进行分析,并借与LinuxFS架构的对比凸显HDFS的分布式特性。通过分析得出:现有的HDFS架构使用Java的Map界面,不利于任务的分解和并行处理,因此HDFS仅在数据的存储上实现分布式,数据处理依然是集中式的,这就形成了对NameNode的依赖,随着集群的扩大,NameNode的性能成为系统瓶颈,并提出了解决方向。

机群文件系统共享语义测试方法

机群文件系统能否满足用户需要的共享文件语义涉及机群文件系统服务的正确性、性能和易用性。为验证该类特性,提出文件系统共享语义测试概念,实现一个文件语义测试系统FSbench。FSbench使用随机测试和划分测试相结合的方法测试和验证文件系统是否满足一定的语义特性。测试表明该方法能够得到令人满意的结果。

基于事件的文件系统恢复技术

在现代文件系统中，用户只能访问文件和目录的当前版本，而无法查看文件和目录的改变过程。用户可能无意地或错误地对文件执行了删除或修改操作，或者执行了一段恶意脚本，导致一系列文件遭到破坏。如果能够记录文件和目录的修改过程，并且可以方便地恢复某次操作破坏的一系列文件，这对用户是相当有帮助的。本文把一个进程在其执行过程中对文件的一系列修改称为一个事件。 文件系统可以通过文件版本化技术来记录文件的修改过程。文件版本化技术包括两种：快照技术和单文件版本化技术。这两种技术都没有提供用户一种方便有效的方法来撤销一个进程对多个文件的一系列修改，无法撤消一个事件对文件的改变。所以，本文在单文件版本化技术的基础上提出了基于事件的文件系统恢复技术，并设计实现了一个具有事件恢复功能的文件系统GobackFS（Go back file system，简称GobackFS）。本文的主要贡献体现在以下几点： (1) 针对如何恢复一个进程在其运行过程中改变的一系列文件这一问题，本文提出了基于事件的文件系统恢复技术，并通过一个实例——GobackFS文件系统，给出了基于事件的文件系统恢复技术的一种设计与实现。 (2) 对用户完全透明的系统设计和实现。GobackFS文件系统透明地创建文件版本，记录文件的改变过程。在GobackFS文件系统中，如果文件以写标志打开时，创建一个新的文件版本，在文件每一次打开和关闭期间最多创建一个新版本。文件的访问权限和所有权发生变化时，创建新的文件子版本。GobackFS文件系统透明地记录改变文件的事件信息。在创建文件版本和子版本时，记录触发文件版本创建的事件信息。 (3) 提供了简单易用的使用接口。在GobackFS文件系统中，用户可以通过一条简单的命令来查看某段时间内哪些事件对文件做了更改，某个事件对哪些文件做了更改，并且通过一条命令就可以撤销某个事件对一系列文件的更改。另外，用户还可以方便的查看单个文件的所有保留版本，并可以恢复到任意版本。 (4) 方便移植的系统架构。GobackFS文件系统基于FUSE框架实现，是一个用户空间文件系统，可以方便地移植到多个Unix/Linux系统中使用，而不需要对内核做任何修改，也不需要复杂的配置。

Realizing Accelerated Cost-Effective Distributed RAID

The exponential growth in user and application data entails new means for providing fault tolerance and protection against data loss. High Performance Com- puting (HPC) storage systems, which are at the forefront of handling the data del- uge, typically employ hardware RAID at the backend. However, such solutions are costly, do not ensure end-to-end data integrity, and can become a bottleneck during data reconstruction. In this paper, we design an innovative solution to achieve a flex- ible, fault-tolerant, and high-performance RAID-6 solution for a parallel file system (PFS). Our system utilizes low-cost, strategically placed GPUs — both on the client and server sides — to accelerate parity computation. In contrast to hardware-based approaches, we provide full control over the size, length and location of a RAID array on a per file basis, end-to-end data integrity checking, and parallelization of RAID array reconstruction. We have deployed our system in conjunction with the widely-used Lustre PFS, and show that our approach is feasible and imposes ac- ceptable overhead.