Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

Seawater carbonate chemistry and structural integrity of the coralline algae Lithothamnion glaciale in a laboratory experiment

The uptake of anthropogenic emission of carbon dioxide is resulting in a lowering of the carbonate saturation state and a drop in ocean pH. Understanding how marine calcifying organisms such as coralline algae may acclimatize to ocean acidification is important to understand their survival over the coming century. We present the first long-term perturbation experiment on the cold-water coralline algae, which are important marine calcifiers in the benthic ecosystems particularly at the higher latitudes. Lithothamnion glaciale, after three months incubation, continued to calcify even in undersaturated conditions with a significant trend towards lower growth rates with increasing pCO2. However, the major changes in the ultra-structure occur by 589 µatm (i.e. in saturated waters). Finite element models of the algae grown at these heightened levels show an increase in the total strain energy of nearly an order of magnitude and an uneven distribution of the stress inside the skeleton when subjected to similar loads as algae grown at ambient levels. This weakening of the structure is likely to reduce the ability of the alga to resist boring by predators and wave energy with severe consequences to the benthic community structure in the immediate future (50 years).

Error Recovery Performance: The Impact of Leader Behavioral Integrity and Job Satisfaction

This article introduces the concept of error recovery performance, followed by the development and validation of an instrument to measure it. The first objective of this article is to broaden the current concept of service recovery to be relevant to the back-of-house operations. The second objective is to examine the influence of leader behavioral integrity (BI) on error recovery performance. Moreover, the study examines the mediating effect of job satisfaction between BI and error recovery performance. Finally, the study links error management performance with work-unit effectiveness. Data for Study 1 were collected from 369 hotel employees in Turkey. The same relationships were tested again in Study 2 to validate the findings of Study 1 with a different sample. Data for Study 2 were collected from 33 departmental managers from the same hotels. Linear regression analysis was used to test the direct effects. The mediating effects were tested using the mediation test suggested by Preacher and Hayes. In addition, in Study 2, general managers of the hotels were asked to rate the effectiveness of each manager and their respective department. Results from Study 1 indicate that BI drives error recovery performance, and this impact is mediated by employee job satisfaction. Results of Study 2 confirm this model and finds further that managers’ self-rated error recovery performance was associated with their general managers’ assessment of their deliverables and of their department’s overall performance.

Transcriptome, carbohydrate, and phytohormone analysis of Petunia hybrida reveals a complex disturbance of plant functional integrity under mild chilling stress

Cultivation of chilling-tolerant ornamental crops at lower temperature could reduce the energy demands of heated greenhouses. To provide a better understanding of how sub-optimal temperatures (12 degrees C vs. 16 degrees C) affect growth of the sensitive Petunia hybrida cultivar 'SweetSunshine Williams', the transcriptome, carbohydrate metabolism, and phytohormone homeostasis were monitored in aerial plant parts over 4 weeks by use of a microarray, enzymatic assays and GC-MS/MS. The data revealed three consecutive phases of chilling response. The first days were marked by a strong accumulation of sugars, particularly in source leaves, preferential up-regulation of genes in the same tissue and down-regulation of several genes in the shoot apex, especially those involved in the abiotic stress response. The midterm phase featured a partial normalization of carbohydrate levels and gene expression. After 3 weeks of chilling exposure, a new stabilized balance was established. Reduced hexose levels in the shoot apex, reduced ratios of sugar levels between the apex and source leaves and a higher apical sucrose/hexose ratio, associated with decreased activity and expression of cell wall invertase, indicate that prolonged chilling induced sugar accumulation in source leaves at the expense of reduced sugar transport to and reduced sucrose utilization in the shoot. This was associated with reduced levels of indole-3-acetic acid and abscisic acid in the apex and high numbers of differentially, particularly up-regulated genes, especially in the source leaves, including those regulating histones, ethylene action, transcription factors, and a jasmonate-ZIM-domain protein. Transcripts of one Jumonji C domain containing protein and one expansin accumulated in source leaves throughout the chilling period. The results reveal a dynamic and complex disturbance of plant function in response to mild chilling, opening new perspectives for the comparative analysis of differently tolerant cultivars.

Role of phospholipase A(2) and tyrosine kinase in Clostridium difficile toxin A-induced disruption of epithelial integrity, histologic inflammatory damage and intestinal secretion

Clostridium difficile-associated disease causes diarrhea to fulminant colitis and death. We investigated the role of phospholipase A(2) (PLA(2)) inhibitors, aristolochic acid (AA), bromophenacyl bromide BPB and quinacrine (QUIN) on the C. difficile toxin A-induced disruption of epithelial integrity, histologic inflammatory damage and intestinal secretion. Toxin A caused severe hemorrhagic and inflammatory fluid secretion at 6-8 h in rabbit ileal segments, an effect that was significantly inhibited by QUIN (71%, P < 0.01), AA (87%, P < 0.0001) or by BPB (51%, P < 0.01). The secretory effect of toxin A was also inhibited in segments adjacent to those with AA (89%, P < 0.01). Furthermore, QUIN or AA substantially reduced the histologic damage seen after 6-8 h in rabbit ileal segments. The cyclooxygenase inhibitor, indomethacin, also significantly inhibited (96%; n = 6) the secretory effects of toxin A in ligated rabbit intestinal segments. The destruction by toxin A of F-actin at the light junctions of T-84 cell monolayers was not inhibited by AA or BPB. AA or QUIN had no effect on the T-84 cell tissue resistance reduction over 8-24 h after toxin A exposure. All the inhibitors were shown to be effective in the doses administered direct in ileal loops to inhibit PLA(2) activity. The data suggest that PLA(2) is involved in the major pathway of toxin A-induced histologic inflammatory damage and hemorrhagic fluid secretion. Cop. right (C) 2008 John Wiley & Sons, Ltd.

Steno cipher to provide data confidentiality and tampered data recovery for RFID tag

Radio Frequency Identification (RFID) is an emerging wireless object identification technology with many potential applications such as supply chain management, personnel tracking and healthcare. However, security vulnerabilities of the RFID system have been a serious concern for its wide adoption in many applications. Although much work has been done to provide privacy and anonymity, little focus has been given to ensure RFID data confidentiality, integrity and to address the tampered data recovery problem. To this end, we propose a lightweight stenographic-based approach to ensure RFID data confidentiality and integrity as well as the recovery of tampered RFID data. © 2013 Springer-Verlag Berlin Heidelberg.

Variable integrity testing of software

This paper provides a method of variable integrity testing to detect the faults of software. By checking the definition domain of the variable itself and the restriction condition of consistency between variables, we only need to determine the bound of each output data, rather than the exact value. Although the output of testing case cannot be easily caught, this method can improve the efficiency of detecting faults. Furthermore, the checking point is not limited to the final output place, but spreads over the reference places in the program code to key variables just like those at the checkpoints under debugging. As a consequence, the testing becomes more precise.

Big data storage security

The demand for data storage and processing is increasing at a rapid speed in the big data era. The management of such tremendous volume of data is a critical challenge to the data storage systems. Firstly, since 60% of the stored data is claimed to be redundant, data deduplication technology becomes an attractive solution to save storage space and traffic in a big data environment. Secondly, the security issues, such as confidentiality, integrity and privacy of the big data should also be considered for big data storage. To address these problems, convergent encryption is widely used to secure data deduplication for big data storage. Nonetheless, there still exist some other security issues, such as proof of ownership, key management and so on. In this chapter, we first introduce some major cyber attacks for big data storage. Then, we describe the existing fundamental security techniques, whose integration is essential for preventing data from existing and future security attacks. By discussing some interesting open problems, we finally expect to trigger more research efforts in this new research field.

USING INDICATORS OF BIOTIC INTEGRITY FOR ASSESSMENT OF STREAM CONDITION

Multiple indices of biotic integrity and biological condition gradient models have been developed and validated to assess ecological integrity in the Laurentian Great Lakes Region. With multiple groups such as Tribal, Federal, and State agencies as well as scientists and local watershed management or river-focused volunteer groups collecting data for bioassessment it is important that we determine the comparability of data and the effectiveness of indices applied to these data for assessment of natural systems. We evaluated the applicability of macroinvertebrate and fish community indices for assessing site integrity. Site quality (i.e., habitat condition) could be classified differently depending on which index was applied. This highlights the need to better understand the metrics driving index variation as well as reference conditions for effective communication and use of indices of biotic integrity in the Upper Midwest. We found the macroinvertebrate benthic community index for the Northern Lakes and Forests Ecoregion and a coldwater fish index of biotic integrity for the Upper Midwest were most appropriate for use in the Big Manistee River watershed based on replicate sampling, ability to track trends over time and overall performance. We evaluated three sites where improper road stream crossings (culverts) were improved by replacing them with modern full-span structures using the most appropriate fish and macroinvertebrate IBIs. We used a before-after-control-impact paired series analytical design and found mixed results, with evidence of improvement in biotic integrity based on macroinvertebrate indices at some of the sites while most sites indicated no response in index score. Culvert replacements are often developed based on the potential, or the perception, that they will restore ecological integrity. As restoration practitioners, researchers and managers, we need to be transparent in our goals and objectives and monitor for those results specifically. The results of this research serve as an important model for the broader field of ecosystem restoration and support the argument that while biotic communities can respond to actions undertaken with the goal of overall restoration, practitioners should be realistic in their expectations and claims of predicted benefit, and then effectively evaluate the true impacts of the restoration activities.

Structural Data Acquisition Using Sensor Network

The development cost of any civil infrastructure is very high; during its life span, the civil structure undergoes a lot of physical loads and environmental effects which damage the structure. Failing to identify this damage at an early stage may result in severe property loss and may become a potential threat to people and the environment. Thus, there is a need to develop effective damage detection techniques to ensure the safety and integrity of the structure. One of the Structural Health Monitoring methods to evaluate a structure is by using statistical analysis. In this study, a civil structure measuring 8 feet in length, 3 feet in diameter, embedded with thermocouple sensors at 4 different levels is analyzed under controlled and variable conditions. With the help of statistical analysis, possible damage to the structure was analyzed. The analysis could detect the structural defects at various levels of the structure.

‘Much more than a basic education’: supporting self-determination and cultural integrity in a non-traditional school for Indigenous girls

This paper presents data from an interview-based case study of a secondary school located in a suburban area of Queensland (Australia). The school is a non-traditional education site designed to support disadvantaged girls, many of whom are Indigenous, and is highly regarded for its holistic approach to gender and cultural inclusion and equity. Through lenses that align Nancy Fraser's theories of redistributive and recognitive justice, with Indigenous feminists' equity priorities, the paper identifies and analyses the structures and practices at the school that support the girls' capacities for self-determination and their sense of cultural integrity. The paper is an important counterpoint within the context of mainstream gender equity and schooling discourses that continue to homogenise gender categories, sideline the multiple axes of differentiation that interplay to compound gender (dis)advantage and deflect attention away from marginalised girls. In particular, it provides significant insight into how schools can begin to reconcile the double bind of racism and sexism that continues to stymie the schooling and post-school outcomes of Indigenous girls.