Integrity-based kernel malware detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. ^ We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. ^ We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. ^ We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). ^ In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.^

Coastline evolution rates of Portugal

Regional/global-scale information on coastline rates of change and trends is extremely valuable, but national-scale studies are scarce. A widely accepted standardized methodology for analysing long-term coastline change has been difficult to achieve, but is essential to conduct an integrated and holistic approach to coastline evolution and hence support coastal management actions. Additionally, databases providing knowledge on coastline evolution are of key importance to support both coastal management experts and users. The main objective of this work is to present the first systematic, global and consistent long-term coastline evolution data of Portuguese mainland low-lying sandy. The methodology used quantifies coastline evolution using an unique and robust coastline indicator (the foredune toe), which is independent of short-term changes. The dataset presented comprises: 1) two polyline sets, mapping the 1958 and 2010 sandy beach-dune systems coastline, both optimized for working at 1:50 000 scale or smaller, and 2) one polyline set representing long-term change rates between 1958 and 2010, estimated at each 250 m. Results show beach erosion as the dominant trend, with a mean change rate of -0.24 ± 0.01 m/year for all mainland Portuguese beach-dune systems. Although erosion is dominant, this evolution is variable in signal and magnitude in different coastal sediment cell and also within each cell. The most relevant beach erosion issues were found in the coastal stretches of Espinho - Torreira and Costa Nova - Praia da Mira, both at sub-cell 1b; Cova Gala - Leirosa, at sub-cell 1c and Cova do Vapor - Costa da Caparica, at cell 4. Cells 1 and 4 exhibit a history of major human interventions interfering with the coastal system, many of which originated and maintained a sediment deficit. In contrast, cells 5 and 6 have been less intervened and show stable or moderate accretion behaviour.

Mechanical and material properties of cortical and trabecular bone from cannabinoid receptor-1-null (Cnr1-/-) mice

Funding ABK was funded by a studentship from the University of Aberdeen, Institute of Medical Sciences, and the Overseas Research Students Awards Scheme Acknowledgments We are grateful to Dr J.S. Gregory for assistance with Image J and Mr K. Mackenzie for assistance with Micro-CT analysis.

Caractérisation tridimensionnelle de l’amplitude articulaire de l’épaule

L’épaule est l’articulation la plus mobile et la plus instable du corps humain dû à la faible quantité de contraintes osseuses et au rôle des tissus mous qui lui confèrent au moins une dizaine de degrés de liberté. La mobilité de l’épaule est un facteur de performance dans plusieurs sports. Mais son instabilité engendre des troubles musculo-squelettiques, dont les déchirures de la coiffe des rotateurs sont fréquentes et les plus handicapantes. L’évaluation de l’amplitude articulaire est un indice commun de la fonction de l’épaule, toutefois elle est souvent limitée à quelques mesures planaires pour lesquelles les degrés de liberté varient indépendamment les uns des autres. Ces valeurs utilisées dans les modèles de simulation musculo-squelettiques peuvent amener à des solutions non physiologiques. L’objectif de cette thèse était de développer des outils pour la caractérisation de la mobilité articulaire tri-dimensionnelle de l’épaule, en passant par i) fournir une méthode et son approche expérimentale pour évaluer l’amplitude articulaire tridimensionnelle de l’épaule incluant des interactions entre les degrés de liberté ; ii) proposer une représentation permettant d’interpréter les données tri-dimensionnelles obtenues; iii) présenter des amplitudes articulaires normalisées, iv) implémenter une amplitude articulaire tridimensionnelle au sein d’un modèle de simulation numérique afin de générer des mouvements sportifs optimaux plus réalistes; v) prédire des amplitudes articulaires sécuritaires et vi) des exercices de rééducation sécuritaires pour des patients ayant subi une réparation de la coiffe des rotateurs. i) Seize sujets ont été réalisé séries de mouvements d’amplitudes maximales actifs avec des combinaisons entre les différents degrés de liberté de l’épaule. Un système d’analyse du mouvement couplé à un modèle cinématique du membre supérieur a été utilisé pour estimer les cinématiques articulaires tridimensionnelles. ii) L’ensemble des orientations définies par une séquence de trois angles a été inclus dans un polyèdre non convexe représentant l’espace de mobilité articulaire prenant en compte les interactions entre les degrés de liberté. La combinaison des séries d’élévation et de rotation est recommandée pour évaluer l’amplitude articulaire complète de l’épaule. iii) Un espace de mobilité normalisé a également été défini en englobant les positions atteintes par au moins 50% des sujets et de volume moyen. iv) Cet espace moyen, définissant la mobilité physiologiques, a été utilisé au sein d’un modèle de simulation cinématique utilisé pour optimiser la technique d’un élément acrobatique de lâcher de barres réalisée par des gymnastes. Avec l’utilisation régulière de limites articulaires planaires pour contraindre la mobilité de l’épaule, seulement 17% des solutions optimales sont physiologiques. En plus, d’assurer le réalisme des solutions, notre contrainte articulaire tridimensionnelle n’a pas affecté le coût de calculs de l’optimisation. v) et vi) Les seize participants ont également réalisé des séries d’amplitudes articulaires passives et des exercices de rééducation passifs. La contrainte dans l’ensemble des muscles de la coiffe des rotateurs au cours de ces mouvements a été estimée à l’aide d’un modèle musculo-squelettique reproduisant différents types et tailles de déchirures. Des seuils de contrainte sécuritaires ont été utilisés pour distinguer les amplitudes de mouvements risquées ou non pour l’intégrité de la réparation chirurgicale. Une taille de déchirure plus grande ainsi que les déchirures affectant plusieurs muscles ont contribué à réduire l’espace de mobilité articulaire sécuritaire. Principalement les élévations gléno-humérales inférieures à 38° et supérieures à 65°, ou réalisées avec le bras maintenu en rotation interne engendrent des contraintes excessives pour la plupart des types et des tailles de blessure lors de mouvements d’abduction, de scaption ou de flexion. Cette thèse a développé une représentation innovante de la mobilité de l’épaule, qui tient compte des interactions entre les degrés de liberté. Grâce à cette représentation, l’évaluation clinique pourra être plus exhaustive et donc élargir les possibilités de diagnostiquer les troubles de l’épaule. La simulation de mouvement peut maintenant être plus réaliste. Finalement, nous avons montré l’importance de personnaliser la rééducation des patients en termes d’amplitude articulaire, puisque des exercices passifs de rééducation précoces peuvent contribuer à une re-déchirure à cause d’une contrainte trop importante qu’ils imposent aux tendons.

Measuring the impact of a quality improvement collaboration to decrease maternal mortality in a Ghanaian regional hospital.

OBJECTIVE: To evaluate the performance of a continuous quality improvement collaboration at Ridge Regional Hospital, Accra, Ghana, that aimed to halve maternal and neonatal deaths. METHODS: In a quasi-experimental, pre- and post-intervention analysis, system deficiencies were analyzed and 97 improvement activities were implemented from January 2007 to December 2011. Data were collected on outcomes and implementation rates of improvement activities. Severity-adjustment models were used to calculate counterfactual mortality ratios. Regression analysis was used to determine the association between improvement activities, staffing, and maternal mortality. RESULTS: Maternal mortality decreased by 22.4% between 2007 and 2011, from 496 to 385 per 100000 deliveries, despite a 50% increase in deliveries and five- and three-fold increases in the proportion of pregnancies complicated by obstetric hemorrhage and hypertensive disorders of pregnancy, respectively. Case fatality rates for obstetric hemorrhage and hypertensive disorders of pregnancy decreased from 14.8% to 1.6% and 3.1% to 1.1%, respectively. The mean implementation score was 68% for the 97 improvement processes. Overall, 43 maternal deaths were prevented by the intervention; however, risk severity-adjustment models indicated that an even greater number of deaths was averted. Mortality reduction was correlated with 26 continuous quality improvement activities, and with the number of anesthesia nurses and labor midwives. CONCLUSION: The implementation of quality improvement activities was closely correlated with improved maternal mortality.

Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

High volume fabrication of laser targets using MEMS techniques

The latest techniques for the fabrication of high power laser targets, using processes developed for the manufacture of Micro-Electro-Mechanical System (MEMS) devices are discussed. These laser targets are designed to meet the needs of the increased shot numbers that are available in the latest design of laser facilities. Traditionally laser targets have been fabricated using conventional machining or coarse etching processes and have been produced in quantities of 10s to low 100s. Such targets can be used for high complexity experiments such as Inertial Fusion Energy (IFE) studies and can have many complex components that need assembling and characterisation with high precision. Using the techniques that are common to MEMS devices and integrating these with an existing target fabrication capability we are able to manufacture and deliver targets to these systems. It also enables us to manufacture novel targets that have not been possible using other techniques. In addition, developments in the positioning systems that are required to deliver these targets to the laser focus are also required and a system to deliver the target to a focus of an F2 beam at 0.1Hz is discussed.

Endonuclease Controlled Aggregation of Gold Nanoparticles for the Ultrasensitive Detection of Pathogenic Bacterial DNA

The development of an ultrasensitive biosensor for the low-cost and on-site detection of pathogenic DNA could transform detection capabilities within food safety, environmental monitoring and clinical diagnosis. Herein, we present an innovative approach exploiting endonuclease-controlled aggregation of plasmonic gold nanoparticles (AuNPs) for label-free and ultrasensitive detection of bacterial DNA. The method utilizes RNA-functionalized AuNPs which form DNA-RNA heteroduplex structures through specific hybridization with target DNA. Once formed, the DNA-RNA heteroduplex is susceptible to RNAse H enzymatic cleavage of the RNA probe, allowing the target DNA to liberate and hybridize with another RNA probe. This continuously happens until all of the RNA probes are cleaved, leaving the nanoparticles unprotected and thus aggregated upon exposure to a high electrolytic medium. The assay is ultrasensitive, allowing the detection of target DNA at femtomolar level by simple spectroscopic analysis (40.7 fM and 2.45 fM as measured by UV-vis and dynamic light scattering (DLS), respectively). The target DNA spiked food matrix (chicken meat) is also successfully detected at a concentration of 1.2 pM (by UV-vis) or 18.0 fM (by DLS). In addition to the ultra-high sensitivity, the total analysis time of the assay is less than 3 hours, thus demonstrating its practicality for food analysis.

Occupied childhoods: discourses and politics of childhood and their place in Palestinian and Pan-­Arab screen content for children

This thesis explores changing discourses of childhood and the ways in which power relations intersect with socio-cultural norms to shape screen-based media for Palestinian children. Situated within the interdisciplinary study of childhood, the research is an institutional and textual analysis that includes discursive and micro-level analysis of the socio-political circumstances within which children consume media in present-day Palestine. The thesis takes a social constructionist view, arguing that ‘childhood’ is not a fixed universal concept and that discourses of childhood are produced at specific historical moments as an effect of power. The study has a three-part research agenda. The first section uses secondary literature to explore theories and philosophies relating to definitions of childhood in Arab societies. The second employs participant observation and semi-structured interviews to understand the history and politics of children’s media in the West Bank. The final part of the research activity focuses on the impact that definitions of childhood and the politics of children’s media have on broadcasting outcomes through an analysis of (a) discourses on children’s media that circulate in Palestinian society, and (b) local and pan-Arab cultural texts consumed by Palestinian children. The analysis demonstrates that complex ideological and political factors are at play, which has led to the marginalisation, politicisation and internationalisation of local production for children. Due to the lack of alternatives, local producers often rely on international funding, and are hence forced to negotiate competing definitions of childhood, which while fitting with an international agenda of normalising the Israeli occupation, conflict culturally and politically with local conceptions of childhood and hopes for the Palestinian nation. While the Palestinian community appreciates the positive potential of local production, discourses and strategies around children’s media show that Palestinian children are constructed as vulnerable, incomplete and in constant need of guidance. Pan-Arab content presents a slightly less didactic approach and in certain cases presents childhood as a dynamic space of empowerment. However, by constructing children as ‘consumercitizens’, it alienates Arab (and Palestinian) children from disadvantaged backgrounds,as the preferred audience is middle-class children living in oil-rich countries of the Gulf.

Micromechanical insight into the undrained instability of granular materials: deformation characteristics of geomaterials.

There is no agreement between experimental researchers whether the point where a granular material responds with a large change of stresses, strains or excess pore water pressure given a prescribed small input of some of the same variables defines a straight line or a curve in the stress space. This line, known as the instability line, may also vary in shape and position if the onset of instability is measured from drained or undrained triaxial tests. Failure of granular materials, which might be preceded by the onset of instability, is a subject that the geotechnical engineers have to deal with in the daily practice, and generally speaking it is associated to different phenomena observed not only in laboratory tests but also in the field. Examples of this are the liquefaction of loose sands subjected to undrained loading conditions and the diffuse instability under drained loading conditions. This research presents results of DEM simulations of undrained triaxial tests with the aim of studying the influence of stress history and relative density on the onset of instability in granular materials. Micro-mechanical analysis including the evolution of coordination numbers and fabric tensors is performed aiming to gain further insight on the particle-scale interactions that underlie the occurrence of this instability. In addition to provide a greater understanding, the results presented here may be useful as input for macro-scale constitutive models that enable the prediction of the onset of instability in boundary value problems.

Comparison of High Q microresonators operating on a thin plate mode : the Lamé-mode

International audience

In-situ based reanalysis of the global ocean temperature and salinity with ISAS: variability of the heat content and steric height

The In Situ Analysis System (ISAS) was developed to produce gridded fields of temperature and salinity that preserve as much as possible the time and space sampling capabilities of the Argo network of profiling floats. Since the first global re-analysis performed in 2009, the system has evolved and a careful delayed mode processing of the 2002-2012 dataset has been carried out using version 6 of ISAS and updating the statistics to produce the ISAS13 analysis. This last version is now implemented as the operational analysis tool at the Coriolis data centre. The robustness of the results with respect to the system evolution is explored through global quantities of climatological interest: the Ocean Heat Content and the Steric Height. Estimates of errors consistent with the methodology are computed. This study shows that building reliable statistics on the fields is fundamental to improve the monthly estimates and to determine the absolute error bars. The new mean fields and variances deduced from the ISAS13 re-analysis and dataset show significant changes relative to the previous ISAS estimates, in particular in the southern ocean, justifying the iterative procedure. During the decade covered by Argo, the intermediate waters appear warmer and saltier in the North Atlantic and fresher in the Southern Ocean than in WOA05 long term mean. At inter-annual scale, the impact of ENSO on the Ocean Heat Content and Steric Height is observed during the 2006-2007 and 2009-2010 events captured by the network.

O impacto das medidas da Troika no desempenho económico-financeiro das empresas portuguesas

Os efeitos despoletados com a crise financeira de 2008 marcaram uma mudança radical de pensamentos e políticas entre as várias economias mundiais. Esta crise ficou marcada pelo enorme esforço que as economias tiveram que suportar, obrigando todos mercados a moldarem-se em função das contingências implementadas. Após análise e leitura de diversa literatura é consensual a referência ao início da crise financeira nos Estados Unidos da América (EUA) com o chamado subprime, percebendo-se também que muito rapidamente atingiria a Europa e todo o mundo. Desta forma, a Europa e inevitavelmente Portugal, acabaria por ser atingido e sofrer diversas consequências resultantes desta crise financeira. Na verdade, fruto da enorme turbulência dos mercados mundiais e da globalização, Portugal (incapaz de por si só sair da crise em que se viu envolvido) vê-se na necessidade de recorrer a ajuda externa por parte da Troika. Neste sentido, a presente dissertação tem como objetivo relatar resumidamente o início da crise financeira mundial, analisando o impacto das políticas de combate à crise implementadas em Portugal, no desempenho económico-financeiro das empresas portuguesas. Este estudo recaiu sobre a análise e perceção de comportamento de alguns indicadores económico financeiros entre os anos de 2010 a 2014, período durante o qual a Troika esteve presente em Portugal, implementando uma serie de reformas e políticas de combate à crise. Assim, debruçamo-nos sobre quatro setores de atividade (Construção Civil, Restauração, Hotelaria e Indústria do Calçado), observando os dados financeiros extraídos da base de dados SABI (Sistema de análise de Balanços Ibéricos) sobre empresas inseridas nos respetivos setores de atividade. Com base nos resultados do estudo realizado podemos concluir que o desempenho dos indicadores económico financeiros foram mais penalizados nos setores da Construção Civil e da Hotelaria.

Mestres estrangeiros; operariado nacional : resistências e derrotas no cotidiano da maior fábrica têxtil do rio de janeiro (1890 - 1920)

Dissertação (mestrado)—Universidade de Brasília, Departamento de História, Programa de Pós-Graduação em História, 2015.

Estudo da sinterização do aço inox 316L reforçado com 3% Carbeto de Tântalo - TaC

The present work shows a contribution to the studies of development and solid sinterization of a metallic matrix composite MMC that has as starter materials 316L stainless steel atomized with water, and two different Tantalum Carbide TaC powders, with averages crystallite sizes of 13.78 nm and 40.66 nm. Aiming the metallic matrix s density and hardness increase was added different nanometric sizes of TaC by dispersion. The 316L stainless steel is an alloy largely used because it s high resistance to corrosion property. Although, its application is limited by the low wear resistance, consequence of its low hardness. Besides this, it shows low sinterability and it cannot be hardened by thermal treatments traditional methods because of the austenitic structure, face centered cubic, stabilized mainly in nickel presence. Steel samples added with TaC 3% wt (each sample with different type of carbide), following a mechanical milling route using conventional mill for 24 hours. Each one of the resulted samples, as well as the pure steel sample, were compacted at 700 MPa, room temperature, without any addictive, uniaxial tension, using a 5 mm diameter cylindrical mold, and quantity calculated to obtain compacted final average height of 5 mm. Subsequently, were sintered in vacuum atmosphere, temperature of 1290ºC, heating rate of 20ºC/min, using different soaking times of 30 and 60 min and cooled at room temperature. The sintered samples were submitted to density and micro-hardness analysis. The TaC reforced samples showed higher density values and an expressive hardness increase. The complementary analysis in optical microscope, scanning electronic microscope and X ray diffractometer, showed that the TaC, processed form, contributed with the hardness increase, by densification, itself hardness and grains growth control at the metallic matrix, segregating itself to the grain boarders