Integrity-Based Kernel Malware Detection

Kernel-level malware is one of the most dangerous threats to the security of users on the Internet, so there is an urgent need for its detection. The most popular detection approach is misuse-based detection. However, it cannot catch up with today's advanced malware that increasingly apply polymorphism and obfuscation. In this thesis, we present our integrity-based detection for kernel-level malware, which does not rely on the specific features of malware. We have developed an integrity analysis system that can derive and monitor integrity properties for commodity operating systems kernels. In our system, we focus on two classes of integrity properties: data invariants and integrity of Kernel Queue (KQ) requests. We adopt static analysis for data invariant detection and overcome several technical challenges: field-sensitivity, array-sensitivity, and pointer analysis. We identify data invariants that are critical to system runtime integrity from Linux kernel 2.4.32 and Windows Research Kernel (WRK) with very low false positive rate and very low false negative rate. We then develop an Invariant Monitor to guard these data invariants against real-world malware. In our experiment, we are able to use Invariant Monitor to detect ten real-world Linux rootkits and nine real-world Windows malware and one synthetic Windows malware. We leverage static and dynamic analysis of kernel and device drivers to learn the legitimate KQ requests. Based on the learned KQ requests, we build KQguard to protect KQs. At runtime, KQguard rejects all the unknown KQ requests that cannot be validated. We apply KQguard on WRK and Linux kernel, and extensive experimental evaluation shows that KQguard is efficient (up to 5.6% overhead) and effective (capable of achieving zero false positives against representative benign workloads after appropriate training and very low false negatives against 125 real-world malware and nine synthetic attacks). In our system, Invariant Monitor and KQguard cooperate together to protect data invariants and KQs in the target kernel. By monitoring these integrity properties, we can detect malware by its violation of these integrity properties during execution.

Numerical modeling of ductile crack extension in high pressure pipelines with longitudinal flaws

This study examines the applicability of a micromechanics approach based upon the computational cell methodology incorporating the Gurson-Tvergaard (GT) model and the CTOA criterion to describe ductile crack extension of longitudinal crack-like defects in high pressure pipeline steels. A central focus is to gain additional insight into the effectiveness and limitations of both approaches to describe crack growth response and to predict the burst pressure for the tested cracked pipes. A verification study conducted on burst testing of large-diameter, precracked pipe specimens with varying crack depth to thickness ratio (a/t) shows the potential predictive capability of the cell approach even though both the CT model and the CTOA criterion appear to depend on defect geometry. Overall, the results presented here lend additional support for further developments in the cell methodology as a valid engineering tool for integrity assessments of pipelines with axial defects. (C) 2011 Elsevier Ltd. All rights reserved,

Modeling and Analysis of Noise and Interconnects for On-Chip Communication Link Design

This thesis considers modeling and analysis of noise and interconnects in onchip communication. Besides transistor count and speed, the capabilities of a modern design are often limited by on-chip communication links. These links typically consist of multiple interconnects that run parallel to each other for long distances between functional or memory blocks. Due to the scaling of technology, the interconnects have considerable electrical parasitics that affect their performance, power dissipation and signal integrity. Furthermore, because of electromagnetic coupling, the interconnects in the link need to be considered as an interacting group instead of as isolated signal paths. There is a need for accurate and computationally effective models in the early stages of the chip design process to assess or optimize issues affecting these interconnects. For this purpose, a set of analytical models is developed for on-chip data links in this thesis. First, a model is proposed for modeling crosstalk and intersymbol interference. The model takes into account the effects of inductance, initial states and bit sequences. Intersymbol interference is shown to affect crosstalk voltage and propagation delay depending on bus throughput and the amount of inductance. Next, a model is proposed for the switching current of a coupled bus. The model is combined with an existing model to evaluate power supply noise. The model is then applied to reduce both functional crosstalk and power supply noise caused by a bus as a trade-off with time. The proposed reduction method is shown to be effective in reducing long-range crosstalk noise. The effects of process variation on encoded signaling are then modeled. In encoded signaling, the input signals to a bus are encoded using additional signaling circuitry. The proposed model includes variation in both the signaling circuitry and in the wires to calculate the total delay variation of a bus. The model is applied to study level-encoded dual-rail and 1-of-4 signaling. In addition to regular voltage-mode and encoded voltage-mode signaling, current-mode signaling is a promising technique for global communication. A model for energy dissipation in RLC current-mode signaling is proposed in the thesis. The energy is derived separately for the driver, wire and receiver termination.

Artificial Immune Systems Applied to the Analysis of Structural Integrity of a Building

This paper presents the application of artificial immune systems for analysis of the structural integrity of a building. Inspired by a biological process, it uses the negative selection algorithm to perform the identification and characterization of structural failure. This paper presents the application of artificial immune systems for analysis of the structural integrity of a building. Inspired by a biological process, it uses the negative selection algorithm to perform the identification and characterization of structural failure. This methodology can assist professionals in the inspection of mechanical and civil structures, to identify and characterize flaws, in order to perform preventative maintenance to ensure the integrity of the structure and decision-making. In order to evaluate the methodology was made modeling a two-story building and several situations were simulated (base-line condition and improper conditions), yielding a database of signs, which were used as input data for the negative selection algorithm. The results obtained by the present method efficiency, robustness and accuracy.

Monitoring and Modeling of the Hydraulic and Sediment Processes at In-Stream Restoration Structures in the Vicinity of a Bridge Crossing

The long-term performance of infrastructure depends on reliable and sustainable designs. Many of Pennsylvania’s streams experience sediment transport problems that increase maintenance costs and lower structural integrity of bridge crossings. A stream restoration project is one common mitigation measure used to correct such problems at bridge crossings. Specifically, in an attempt to alleviate aggradation problems with the Old Route 15 Bridge crossing on White Deer Creek, in White Deer, PA, two in-stream structures (rock cross vanes) and several bank stabilization features were installed along with a complete channel redevelopment. The objectives of this research were to characterize the hydraulic and sediment transport processes occurring at the White Deer Creek site, and to investigate, through physical and mathematical modeling, the use of instream restoration structures. The goal is to be able to use the results of this study to prevent aggradation or other sediment related problems in the vicinity of bridges through improved design considerations. Monitoring and modeling indicate that the study site on White Deer Creek is currently unstable, experiencing general channel down-cutting, bank erosion, and several local areas of increased aggradation and degradation of the channel bed. An in-stream structure installed upstream of the Old Route 15 Bridge failed by sediment burial caused by the high sediment load that White Deer Creek is transporting as well as the backwater effects caused by the bridge crossing. The in-stream structure installed downstream of the Old Route 15 Bridge is beginning to fail because of the alignment of the structure with the approach direction of flow from upstream of the restoration structure.

Domain-Specific Multi-Modeling of Security Concerns in Service-Oriented Architectures

As a common reference for many in-development standards and execution frameworks, special attention is being paid to Service-Oriented Architectures. SOAs modeling, however, is an area in which a consensus has not being achieved. Currently, standardization organizations are defining proposals to offer a solution to this problem. Nevertheless, until very recently, non-functional aspects of services have not been considered for standardization processes. In particular, there exists a lack of a design solution that permits an independent development of the functional and non-functional concerns of SOAs, allowing that each concern be addressed in a convenient manner in early stages of the development, in a way that could guarantee the quality of this type of systems. This paper, leveraging on previous work, presents an approach to integrate security-related non-functional aspects (such as confidentiality, integrity, and access control) in the development of services.

Numerical modeling of electromagnetic coupling phenomena in the vicinities of overhead power transmission lines.

Electromagnetic coupling phenomena between overhead power transmission lines and other nearby structures are inevitable, especially in densely populated areas. The undesired effects resulting from this proximity are manifold and range from the establishment of hazardous potentials to the outbreak of alternate current corrosion phenomena. The study of this class of problems is necessary for ensuring security in the vicinities of the interaction zone and also to preserve the integrity of the equipment and of the devices there present. However, the complete modeling of this type of application requires the three- -dimensional representation of the region of interest and needs specific numerical methods for field computation. In this work, the modeling of problems arising from the flow of electrical currents in the ground (the so-called conductive coupling) will be addressed with the finite element method. Those resulting from the time variation of the electromagnetic fields (the so-called inductive coupling) will be considered as well, and they will be treated with the generalized PEEC (Partial Element Equivalent Circuit) method. More specifically, a special boundary condition on the electric potential is proposed for truncating the computational domain in the finite element analysis of conductive coupling problems, and a complete PEEC formulation for modeling inductive coupling problems is presented. Test configurations of increasing complexities are considered for validating the foregoing approaches. These works aim to provide a contribution to the modeling of this class of problems, which tend to become common with the expansion of power grids.

Modeling geometric rules in object based models:an XML / GML approach

Most object-based approaches to Geographical Information Systems (GIS) have concentrated on the representation of geometric properties of objects in terms of fixed geometry. In our road traffic marking application domain we have a requirement to represent the static locations of the road markings but also enforce the associated regulations, which are typically geometric in nature. For example a give way line of a pedestrian crossing in the UK must be within 1100-3000 mm of the edge of the crossing pattern. In previous studies of the application of spatial rules (often called 'business logic') in GIS emphasis has been placed on the representation of topological constraints and data integrity checks. There is very little GIS literature that describes models for geometric rules, although there are some examples in the Computer Aided Design (CAD) literature. This paper introduces some of the ideas from so called variational CAD models to the GIS application domain, and extends these using a Geography Markup Language (GML) based representation. In our application we have an additional requirement; the geometric rules are often changed and vary from country to country so should be represented in a flexible manner. In this paper we describe an elegant solution to the representation of geometric rules, such as requiring lines to be offset from other objects. The method uses a feature-property model embraced in GML 3.1 and extends the possible relationships in feature collections to permit the application of parameterized geometric constraints to sub features. We show the parametric rule model we have developed and discuss the advantage of using simple parametric expressions in the rule base. We discuss the possibilities and limitations of our approach and relate our data model to GML 3.1. © 2006 Springer-Verlag Berlin Heidelberg.

Centrifuge modeling of oblique pipe-soil interaction in dense and loose sand

Due to relative ground movement, buried pipelines experience geotechnical loads. The imposed geotechnical loads may initiate pipeline deformations that affect system serviceability and integrity. Engineering guidelines (e.g., ALA, 2005; Honegger and Nyman, 2001) provide the technical framework to develop idealized structural models to analyze pipe‒soil interaction events and assess pipe mechanical response. The soil behavior is modeled using discrete springs that represent the geotechnical loads per unit pipe length developed during the interaction event. Soil forces are defined along three orthogonal directions (i.e., axial, lateral and vertical) to analyze the response of pipelines. Nonlinear load-displacement relationships of soil defined by a spring, is independent of neighboring spring elements. However, recent experimental and numerical studies demonstrate significant coupling effects during oblique (i.e., not along one of the orthogonal axes) pipe‒soil interaction events. In the present study, physical modeling using a geotechnical centrifuge was conducted to improve the current understanding of soil load coupling effects of buried pipes in loose and dense sand. A section of pipeline, at shallow burial depth, was translated through the soil at different oblique angles in the axial-lateral plane. The force exerted by the soil on pipe is critically examined to assess the significance of load coupling effects and establish a yield envelope. The displacements required to soil yield force are also examined to assess potential coupling in mobilization distance. A set of laboratory tests were conducted on the sand used for centrifuge modeling to find the stress-strain behavior of sand, which was used to examine the possible mechanisms of centrifuge model test. The yield envelope, deformation patterns, and interpreted failure mechanisms obtained from centrifuge modeling are compared with other physical modeling and numerical simulations available in the literature.

Assessment of a multiple-span bridge by dynamic testing, in-situ monitoring and numerical modeling

Peer reviewed

Graded Meshes In Bio-thermal Problems With Transmission-line Modeling Method.

In this study, the transmission-line modeling (TLM) applied to bio-thermal problems was improved by incorporating several novel computational techniques, which include application of graded meshes which resulted in 9 times faster in computational time and uses only a fraction (16%) of the computational resources used by regular meshes in analyzing heat flow through heterogeneous media. Graded meshes, unlike regular meshes, allow heat sources to be modeled in all segments of the mesh. A new boundary condition that considers thermal properties and thus resulting in a more realistic modeling of complex problems is introduced. Also, a new way of calculating an error parameter is introduced. The calculated temperatures between nodes were compared against the results obtained from the literature and agreed within less than 1% difference. It is reasonable, therefore, to conclude that the improved TLM model described herein has great potential in heat transfer of biological systems.

Variability Modeling Of Rainfall, Deforestation, And Incidence Of American Tegumentary Leishmaniasis In Orán, Argentina, 1985-2007.

American tegumentary leishmaniasis (ATL) is a disease transmitted to humans by the female sandflies of the genus Lutzomyia. Several factors are involved in the disease transmission cycle. In this work only rainfall and deforestation were considered to assess the variability in the incidence of ATL. In order to reach this goal, monthly recorded data of the incidence of ATL in Orán, Salta, Argentina, were used, in the period 1985-2007. The square root of the relative incidence of ATL and the corresponding variance were formulated as time series, and these data were smoothed by moving averages of 12 and 24 months, respectively. The same procedure was applied to the rainfall data. Typical months, which are April, August, and December, were found and allowed us to describe the dynamical behavior of ATL outbreaks. These results were tested at 95% confidence level. We concluded that the variability of rainfall would not be enough to justify the epidemic outbreaks of ATL in the period 1997-2000, but it consistently explains the situation observed in the years 2002 and 2004. Deforestation activities occurred in this region could explain epidemic peaks observed in both years and also during the entire time of observation except in 2005-2007.

Modeling The Effects Of Temperature And Ph On The Resistance Of Alicyclobacillus Acidoterrestris In Conventional Heat-treated Fruit Beverages Through A Meta-analysis Approach.

In this work, all publicly-accessible published findings on Alicyclobacillus acidoterrestris heat resistance in fruit beverages as affected by temperature and pH were compiled. Then, study characteristics (protocols, fruit and variety, °Brix, pH, temperature, heating medium, culture medium, inactivation method, strains, etc.) were extracted from the primary studies, and some of them incorporated to a meta-analysis mixed-effects linear model based on the basic Bigelow equation describing the heat resistance parameters of this bacterium. The model estimated mean D* values (time needed for one log reduction at a temperature of 95 °C and a pH of 3.5) of Alicyclobacillus in beverages of different fruits, two different concentration types, with and without bacteriocins, and with and without clarification. The zT (temperature change needed to cause one log reduction in D-values) estimated by the meta-analysis model were compared to those ('observed' zT values) reported in the primary studies, and in all cases they were within the confidence intervals of the model. The model was capable of predicting the heat resistance parameters of Alicyclobacillus in fruit beverages beyond the types available in the meta-analytical data. It is expected that the compilation of the thermal resistance of Alicyclobacillus in fruit beverages, carried out in this study, will be of utility to food quality managers in the determination or validation of the lethality of their current heat treatment processes.

Supercritical CO2 recovery of caffeine from green coffee oil: new experimental solubility data and modeling

The caffeine solubility in supercritical CO2 was studied by assessing the effects of pressure and temperature on the extraction of green coffee oil (GCO). The Peng-Robinson¹ equation of state was used to correlate the solubility of caffeine with a thermodynamic model and two mixing rules were evaluated: the classical mixing rule of van der Waals with two adjustable parameters (PR-VDW) and a density dependent one, proposed by Mohamed and Holder² with two (PR-MH, two parameters adjusted to the attractive term) and three (PR-MH3 two parameters adjusted to the attractive and one to the repulsive term) adjustable parameters. The best results were obtained with the mixing rule of Mohamed and Holder² with three parameters.

Spatial pattern detection modeling of thrips (Thrips tabaci) on onion fields

Onion (Allium cepa) is one of the most cultivated and consumed vegetables in Brazil and its importance is due to the large laborforce involved. One of the main pests that affect this crop is the Onion Thrips (Thrips tabaci), but the spatial distribution of this insect, although important, has not been considered in crop management recommendations, experimental planning or sampling procedures. Our purpose here is to consider statistical tools to detect and model spatial patterns of the occurrence of the onion thrips. In order to characterize the spatial distribution pattern of the Onion Thrips a survey was carried out to record the number of insects in each development phase on onion plant leaves, on different dates and sample locations, in four rural properties with neighboring farms under different infestation levels and planting methods. The Mantel randomization test proved to be a useful tool to test for spatial correlation which, when detected, was described by a mixed spatial Poisson model with a geostatistical random component and parameters allowing for a characterization of the spatial pattern, as well as the production of prediction maps of susceptibility to levels of infestation throughout the area.