检索结果-内蒙古大学图书馆

Measurement of Anti-Debugging Techniques on the Windows and linux Operating Systems for the Intel x86_64 Architecture

引用

IEEE ACCESS 2025年 13卷 46568-46583页

作者： Norby, Austin Rimal, Bhaskar P. Brizendine, Bramwell Bogart Associates Northern Virginia Reston VA 20190 USA Univ Idaho Dept Comp Sci Moscow ID 83844 USA Univ Alabama Dept Comp Sci Huntsville AL 35899 USA

Malware authors and software protection frameworks often use anti-debugging techniques to hinder understanding of the underlying code. Companies use anti-debugging techniques to prevent intellectual property, including music, movies, and games, from being stolen or abused by malicious actors. In addition, the encryption of program data or private data can also be classified as an anti-debugging technique because it requires additional effort to reverse engineer or debug it. Malware authors also use these techniques to prevent their software from being analyzed, detected, or blocked. While anti-debugging techniques are not novel, there is minimal research on their performance. This paper conducted novel research on commonly used anti-debugging techniques by measuring their performance on both the Windows and linux operating system while also creating performance data about the most common anti-debugging techniques, including implementations and statistical measures for six categories of anti-debugging techniques. The statistical results describe a low overhead for the API tests, timing tests, and debug register tests. As expected, the memory encryption test had the highest overhead. Lastly, the paper discusses these results and their statistics per technique and includes code samples for future research.

关键词： Codes Malware linux Debugging Kernel Virtual machine monitors Encryption Timing Registers Data visualization Anti-debugging code obfuscation debugger malware analysis memory encryption OpenSSL

来源：评论

学校读者我要写书评

暂无评论

Application-Level Evaluation of IEEE 802.1AS Synchronized Time and linux for Distributed Real-Time Systems

引用

ACM TRANSACTIONS ON EMBEDDED COMPUTING SYSTEMS 2025年第1期24卷 1-16页

作者： Tijero, Hector perez Gutierrez Garcia, J. javier Prieto, D. I. E. G. O. GARCiA Univ Cantabria Santander Cantabria Spain

The use of Ethernet and linux is becoming common in industrial applications, even for those with real-time requirements, although neither of them were originally designed for this purpose. The emergence of Industry 4.0 (also known as Industrial Internet of Things, IIoT) has encouraged the evolution of these technologies to better handle real-time issues. On the one hand, linux now supports mechanisms to configure certain real-time parameters, as well as core isolation and interrupt allocation facilities in multicore processors. On the other hand, the set of Ethernet standards IEEE 802.1 Time-Sensitive Networking (TSN) includes a high precision clock synchronization protocol (IEEE 802.1AS). The purpose of this work is to outline an execution framework for distributed systems based on TSN and linux, which allows the execution of time-aware applications. We have studied and evaluated different configurations available for the proposed execution framework. In particular, a detailed characterization of the clock synchronization mechanism, from the application point of view, has been performed. Some conclusions about the current real-time capabilities of these technologies are also presented.

关键词： Clock synchronization distributed real-time systems IEEE 802.1AS linux TSN Industry 4.0

来源：评论

学校读者我要写书评

暂无评论

100-Gbit/s UDP Data Acquisition on linux Using AF_XDP: The TRISTAN Detector

引用

IEEE TRANSACTIONS ON NUCLEAR SCIENCE 2025年第3期72卷 295-300页

作者： Mostafa, Jalal Tcherniakhovski, Denis Chilingaryan, Suren Balzer, Matthias Kopmann, Andreas Becker, Jurgen Karlsruhe Inst Technol Inst Data Proc & Elect D-76344 Eggenstein Leopoldshafen Germany Karlsruhe Inst Technol Inst Tech Informat Verarbeitung D-76131 Karlsruhe Germany

A growing number of detectors produce data rates of more than 100 Gb/s, which often necessitate software-defined data processing to operate. Because of its simplicity, the user datagram protocol (UDP) offers a straightforward method for integrating such detectors with online computing resources that host the data processing software. Nevertheless, conventional technologies-such as POSIX sockets-are either ineffective or difficult to apply on detector boards based on field-programmable gateway arrays (FPGAs). The new linux AF_XDP sockets (XSK) are a novel method that uses zero-copy methods to target high data speeds. In this article, we present "DQDK," a novel data acquisition (DAQ) framework based on AF_XDP and UDP for readout systems with more than 100 Gb/s. We evaluate our framework for the TRItium sterile antineutrino (TRISTAN) detector whose rates are expected to reach 200 Gb/s. We describe our experience developing a TRISTAN detector readout system using AF_XDP.

关键词： Data acquisition Detectors Software Protocols linux Sockets Field programmable gate arrays AF_XDP data acquisition (DAQ) high-throughput detectors remote direct memory access (RDMA) user datagram protocol (UDP) zero-copy networking

来源：评论

学校读者我要写书评

暂无评论

Analyzing linux on a Supercomputer

引用

IEEE SOFTWARE 2025年第2期42卷 18-23页

作者： Spinellis, Diomidis Athens Univ Econ & Business Dept Management Sci & Technol Athens 10434 Greece Delft Univ Technol Dept Software Technol NL-2600 AA Delft Netherlands

The C preprocessor, a key element of the language, has become a liability due to its lack of integration with modern language semantics. This column describes the analysis of the C preprocessor usage in the linux kernel, comprising 20 million lines of code, using the CScout refactoring browser. Processing limitations led to a solution leveraging a supercomputer's parallel processing capabilities. The analysis divided the kernel's source files across 32 supercomputer nodes and implemented a binary tournament database merging strategy. Initial efforts revealed multiple difficulties. Resolving them involved several false starts involving recursive SQL statements, an SQLite extension, and the GraphViz connected components tool. After a number of redesigns guided by stress-testing, the analysis finished in just 32 hours rather than a week, using 374 CPU hours and 640 GiB RAM on the supercomputer's nodes.

关键词： Supercomputers Databases Codes linux Source Code CPU Hours Running Open Source Software Set Of Equations Nodes In The Graph State Machine Merging Process Breadth First Search Database File Unit Tests Merge Operation Header File Source Code Files

来源：评论

学校读者我要写书评

暂无评论

Securing linux Cloud Environments: Privacy-Aware Federated Learning Framework for Advanced Malware Detection in linux Clouds

引用

IEEE ACCESS 2025年 13卷 30377-30394页

作者： Landman, Tom Nissim, Nir Ben Gurion Univ Negev Cyber Secur Res Ctr Malware Lab IL-8410501 Beer Sheva Israel Ben Gurion Univ Negev Dept Ind Engn & Management Malware Lab IL-8410501 Beer Sheva Israel

Cloud computing is integral to modern IT infrastructure, with linux-based virtual machines (VMs) comprising 95% of public cloud environments. This widespread use makes linux VMs a prime target for cyberattacks, particularly advanced malware designed for financial gain, data theft, or operational sabotage. Traditional malware detection methods, despite their sophistication, often operate directly on the VMs they protect, making them susceptible to evasion by advanced malware-based threats. Furthermore, these methods are limited by their reliance on data confined to individual VMs, hindering their ability to generalize across different environments. While machine learning (ML) algorithms are frequently used to enhance malware detection, they typically require extensive data sharing, which poses significant risks to data confidentiality and user privacy. To overcome these challenges, we propose a federated learning-based framework for detecting unknown malware in linux cloud environments. This framework allows a community of VMs, each equipped with a trusted local malware detection mechanism, to collaborate and enhance detection capabilities without sharing the underlying data, thus preserving privacy. The approach involves continuously capturing and converting volatile memory dumps into images, which are then used to train a federated convolutional neural network (CNN) in a decentralized manner. This eliminates the need for manual feature extraction and mitigates the risk of a single point of failure. Experimental results on widely-used linux VMs demonstrate the framework's effectiveness, achieving an AUC of up to 98.3% in detecting unknown malware, providing a robust and privacy-preserving solution for cloud security.

关键词： Cloud computing linux Malware Federated learning Servers Data models Virtual machines Data privacy Computational modeling Virtual machine monitors Deep learning federated learning malware detection privacy

来源：评论

学校读者我要写书评

暂无评论

Worst case response time analysis for completely fair scheduling in linux systems

引用

REAL-TIME SYSTEMS 2025年第1期61卷 118-158页

作者： Yoon, Kyonghwan Jeong, Eunjin Kang, Woosuk Choe, Jonghyun Ha, Soonhoi Seoul Natl Univ Seoul South Korea

The popularity of linux in embedded systems has grown because of its reliability, flexibility, and performance. To ensure these systems meet specific real-time requirements, such as deadlines and throughput, linux provides support for real-time schedulers and the PREEMPT_RT patch. However, while these tools prioritize high-priority tasks, they can inadvertently compromise the performance of other tasks. Completely Fair Scheduling (CFS) has served as the default scheduling policy in linux until recently. The CFS is based on the principle that all runnable tasks should share the processor fairly, which helps balance task performance with overall system responsiveness. Despite its benefits, there has been no established method to assess whether real-time requirements are met under CFS. This paper introduces a novel analysis method to estimate the worst-case response time (WCRT) of tasks under CFS, providing a new solution for running real-time tasks in embedded linux systems. Due to the dynamic nature of CFS, traditional WCRT analysis techniques are not applicable directly. Our technique analyzes how tasks sharing the same processor affect each other, focusing on their vruntime. By examining the bounds of vruntime variation and calculating the maximum interference from other tasks, we effectively estimate the WCRT. We also introduce algorithms that assign the nice values to tasks based on our proposed WCRT analysis technique, ensuring that the real-time requirements are met. We validate the proposed approach through comparative experiments using both a self-developed CFS simulator and an actual linux system. Our simulator allows for rapid simulations and efficient exploration of various execution scenarios. Through extensive experiments, we empirically validate that our proposed analysis method is efficient with an acceptable level of overestimation. These make it a valuable tool for system verification and design optimization in linux-based real-time systems.

关键词： linux CFS Schedulability WCRT

来源：评论

学校读者我要写书评

暂无评论

Efficiently Supporting Attribute-Based Access Control in linux

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2024年第4期21卷 2012-2026页

作者： Varshith, H. O. Sai Sural, Shamik Vaidya, Jaideep Atluri, Vijayalakshmi Indian Inst Technol Dept Comp Sci & Engn Kharagpur 721302 W Bengal India Rutgers State Univ MSIS Dept Newark NJ 07103 USA

linux is a widely used multi-user operating system with applications ranging from personal desktop to commercial heavy duty web servers. It has built-in security features based on discretionary access control enforced in the form of access control lists, which can be enhanced using the linux Security Module (LSM) Framework. LSM allows inserting security verification hooks for supporting custom security policies. However, there is no support yet for Attribute-Based Access Control (ABAC) - an access control model gaining popularity due to its dynamic nature and flexibility. In ABAC, access is granted or denied based on attributes of the subject, object and environment. In this work, we propose a method for enhancing linux's security features by integrating ABAC for file system objects using the LSM framework. We look at various kernel and user space components and how they can be made to work together to enforce ABAC policies. Different algorithms and data structures for efficient access request resolution are also investigated. Finally, we carry out extensive performance evaluation of the ABAC-enabled linux system and discuss its results.

关键词： linux Access control Kernel File systems Data structures Authentication Sockets ABAC linux security module file system security access resolution

来源：评论

学校读者我要写书评

暂无评论

A Portable linux-based Firmware for NVMe Computational Storage Devices

引用

ACM TRANSACTIONS ON STORAGE 2025年第2期21卷 1-36页

作者： Wertenbroek, Rick Thoma, Yann Dassatti, Alberto HES SO Univ Appl Sci & Arts Western Switzerland Sch Engn & Management Vaud HEIG VD REDS Yverdon Switzerland Univ Lausanne DBC Lausanne Switzerland

Over the years, interest in computational storage devices has been growing steadily. This is largely due to the rise of data-intensive applications, such as machine learning, online video distribution, astrophysics, and genomics. Moving compute operations closer to the data provides benefits in terms of scaling possibilities and energy efficiency. The development of computational storage devices has been limited by the need for specialized and complex hardware. In this work, we propose a portable linux-based firmware framework for the development of NVMe computational storage devices. Our firmware runs on a variety of hardware platforms ranging from expensive FPGA solutions to inexpensive off-the-shelf single board computers. The firmware leverages the vast linux software ecosystem to facilitate the development and prototyping of novel computational storage devices. We benchmark our firmware on multiple hardware platforms and demonstrate its versatility through several computational examples including a content-aware disk image search engine based on natural language processing and AI-driven image recognition.

关键词： NVMe computational storage linux in-storage processing

来源：评论

学校读者我要写书评

暂无评论

The Hidden Threat: Analysis of linux Rootkit Techniques and Limitations of Current Detection Tools

引用

DIGITAL THREATS: RESEARCH AND PRACTICE 2024年第3期5卷 1-24页

作者： Stuehn, Jakob Hilgert, Jan-Niclas Lambertz, Martin Fraunhofer Inst Commun Informat Proc & Ergon FKIE Bonn Germany

This article addresses the significant threat posed by rootkits as part of the diverse malware landscape of today. Rootkits enable an attacker to regain access to an already comprised system at root-level making their prompt identification and removal crucial. However, rootkits implement advanced stealth features, enabling them to evade detection by conventional measures during analysis. Consequently, analysts generally rely on customized tools to detect the presence of a rootkit. However, our research highlights significant deficits in the tools available for the detection of rootkits on the linux operating system, which is frequently encountered in investigations of server environments. Recognizing the need for improved awareness and capabilities among investigators, we conducted an in-depth analysis of 21 distinct linux rootkits allowing us to dive into their techniques and features. Furthermore, we critically assessed the effectiveness of standard detection tools, revealing their limitations. Based on these insights, we propose best practices for investigators to effectively identify and detect signs of rootkit infections. Additionally, we provide a repository of indicators of compromise we extracted during our analyses to facilitate the detection of the analyzed rootkits on compromised systems along with a utility to detect rootkits via hidden files on a live system.

关键词： linux Rootkits Malware Incident Response Detection

来源：评论

学校读者我要写书评

暂无评论

Automatic Permission Check Analysis for linux Kernel

引用

IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING 2023年第3期20卷 1849-1866页

作者： Zhou, Jinmeng Zhang, Tong Shen, Wenbo Lee, Dongyoon Jung, Changhee Azab, Ahmed Wang, Ruowen Ning, Peng Ren, Kui Zhejiang Univ Hangzhou 310027 Zhejiang Peoples R China Samsung Elect Ridgefield Pk NJ 07660 USA ZJU Hangzhou Global Sci & Technol Innovat Ctr Key Lab Blockchain & Cyberspace Governance Zhejian Hangzhou 311215 Zhejiang Peoples R China SUNY Stony Brook Dept Comp Sci Stony Brook NY 11794 USA Purdue Univ Dept Comp Sci W Lafayette IN 47907 USA Facebook Menlo Pk CA 94025 USA Google Mountain View CA 94043 USA

Permission checks play an essential role in operating system security by providing access control to privileged functionalities. However, it is challenging for kernel developers to scalably verify the soundness of existing checks due to the large codebase and complexity of the kernel. In fact, linux kernel contains millions of lines of code with hundreds of permission checks, and even worse, its complexity is fast-growing. This paper presents PeX, a static Permission check error detector for linux, which takes as input a kernel source code and reports any missing, inconsistent, and redundant permission checks. PeX uses KIRIN (Kernel InteRface based Indirect call aNalysis), a novel, precise, and scalable indirect call analysis technique. Over the interprocedural control flow graph built by KIRIN, PeX automatically identifies permission checks and infers the mappings between permission checks and privileged functions. For each privileged function, PeX examines all possible paths to the function to check if necessary permission checks are correctly enforced. We evaluated PeX on the latest stable linux kernel v4.18.5 for three types of permission checks: Discretionary Access Controls (DAC), Capabilities, and linux Security Modules (LSM). PeX reported 45 new permission check errors, 17 of which have been confirmed by the kernel developers.

关键词： Kernel linux Permission Codes Access control Computer science Computer bugs linux kernel static analysis permission check bug detection

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：