A Behavior Based Approach to Virus Detection

Fast spreading unknown viruses have caused major damage on computer systems upon their initial release. Current detection methods have lacked capabilities to detect unknown virus quickly enough to avoid mass spreading and damage. This dissertation has presented a behavior based approach to detecting known and unknown viruses based on their attempt to replicate. Replication is the qualifying fundamental characteristic of a virus and is consistently present in all viruses making this approach applicable to viruses belonging to many classes and executing under several conditions. A form of replication called self-reference replication, (SR-replication), has been formalized as one main type of replication which specifically replicates by modifying or creating other files on a system to include the virus itself. This replication type was used to detect viruses attempting replication by referencing themselves which is a necessary step to successfully replicate files. The approach does not require a priori knowledge about known viruses. Detection was accomplished at runtime by monitoring currently executing processes attempting to replicate. Two implementation prototypes of the detection approach called SRRAT were created and tested on the Microsoft Windows operating systems focusing on the tracking of user mode Win32 API system calls and Kernel mode system services. The research results showed SR-replication capable of distinguishing between file infecting viruses and benign processes with little or no false positives and false negatives.

Impact of node mobility in user-centric routing

Recent paradigms in wireless communication architectures describe environments where nodes present a highly dynamic behavior (e.g., User Centric Networks). In such environments, routing is still performed based on the regular packet-switched behavior of store-and-forward. Albeit sufficient to compute at least an adequate path between a source and a destination, such routing behavior cannot adequately sustain the highly nomadic lifestyle that Internet users are today experiencing. This thesis aims to analyse the impact of the nodes’ mobility on routing scenarios. It also aims at the development of forwarding concepts that help in message forwarding across graphs where nodes exhibit human mobility patterns, as is the case of most of the user-centric wireless networks today. The first part of the work involved the analysis of the mobility impact on routing, and we found that node mobility significance can affect routing performance, and it depends on the link length, distance, and mobility patterns of nodes. The study of current mobility parameters showed that they capture mobility partially. The routing protocol robustness to node mobility depends on the routing metric sensitivity to node mobility. As such, mobility-aware routing metrics were devised to increase routing robustness to node mobility. Two categories of routing metrics proposed are the time-based and spatial correlation-based. For the validation of the metrics, several mobility models were used, which include the ones that mimic human mobility patterns. The metrics were implemented using the Network Simulator tool using two widely used multi-hop routing protocols of Optimized Link State Routing (OLSR) and Ad hoc On Demand Distance Vector (AODV). Using the proposed metrics, we reduced the path re-computation frequency compared to the benchmark metric. This means that more stable nodes were used to route data. The time-based routing metrics generally performed well across the different node mobility scenarios used. We also noted a variation on the performance of the metrics, including the benchmark metric, under different mobility models, due to the differences in the node mobility governing rules of the models.

A reflective characterization of occasional user

This work revisits established user classifications and aims to characterise a historically unspecified user category, the Occasional User (OU). Three user categories, novice, intermediate and expert, have dominated the work of user interface (UI) designers, researchers and educators for decades. These categories were created to conceptualise user's needs, strategies and goals around the 80s. Since then, UI paradigm shifts, such as direct manipulation and touch, along with other advances in technology, gave new access to people with little computer knowledge. This fact produced a diversification of the existing user categories not observed in the literature review of traditional classification of users. The findings of this work include a new characterisation of the occasional user, distinguished by user's uncertainty of repetitive use of an interface and little knowledge about its functioning. In addition, the specification of the OU, together with principles and recommendations will help UI community to informatively design for users without requiring a prospective use and previous knowledge of the UI. The OU is an essential type of user to apply user-centred design approach to understand the interaction with technology as universal, accessible and transparent for the user, independently of accumulated experience and technological era that users live in.

The Behavior of Hydroxyl Units of Synthetic Goethite and its Dehydroxylated Product Hematite

The behavior of the hydroxyl units of synthetic goethite and its dehydroxylated product hematite was characterized using a combination of Fourier transform infrared (FTIR) spectroscopy and X-ray diffraction (XRD) during the thermal transformation over a temperature range of 180-270 degrees C. Hematite was detected at temperatures above 200 degrees C by XRD while goethite was not observed above 230 degrees C. Five intense OH vibrations at 3212-3194, 1687-1674, 1643-1640, 888-884 and 800-798 cm(-1), and a H2O vibration at 3450-3445 cm(-1) were observed for goethite. The intensity of hydroxyl stretching and bending vibrations decreased with the extent of dehydroxylation of goethite. Infrared absorption bands clearly show the phase transformation between goethite and hematite: in particular. the migration of excess hydroxyl units from goethite to hematite. Two bands at 536-533 and 454-452 cm(-1) are the low wavenumber vibrations of Fe-O in the hematite structure. Band component analysis data of FTIR spectra support the fact that the hydroxyl units mainly affect the a plane in goethite and the equivalent c plane in hematite.