Search engine users often have clear search tasks hidden behind their queries. Inspired by this, the modern search engines are providing an increasing number of services to help users simplify their key tasks. However...
详细信息
Recent years have witnessed an increasing threat from kernel rootkits. A common feature of such attack is hiding malicious objects to conceal their presence, including processes, sockets, and kernel modules. Scanning ...
详细信息
ISBN:
(纸本)9781450305648
Recent years have witnessed an increasing threat from kernel rootkits. A common feature of such attack is hiding malicious objects to conceal their presence, including processes, sockets, and kernel modules. Scanning memory with object signatures to detect the stealthy rootkit has been proven to be a powerful approach only when it is hard for adversaries to evade. However, it is difficult, if not impossible, to select fields from a single data structure as robust signatures with traditional techniques. In this paper, we propose the concepts of inter-structure signature and imported signature, and present techniques to detect stealthy malware based on these concepts. The key idea is to use cross-reference relationships of multiple data structures as signatures to detect stealthy malware, and to import some extra information into regions attached to target data structures as signatures. We have inferred four invariants as signatures to detect hidden processes, sockets, and kernel modules in Linux respectively and implemented a prototype detection system called DeepScanner. Meanwhile, we have also developed a hypervisor-based monitor to protect imported signatures. Our experimental result shows that our DeepScanner can effectively and efficiently detect stealthy objects hidden by seven real-world rootkits without any false positives and false negatives, and an adversary can hardly evade DeepScanner if he/she does not break the normal functions of target objects and the system. Copyright 2011 ACM.
Unemployment rate prediction has become critically important, because it can help government to make decision and design policies. In recent years, forecast of unemployment rate attracts much attention from government...
详细信息
In this paper, a random rough subspace based neural network ensemble method is proposed for insurance fraud detection. In this method, rough set reduction is firstly employed to generate a set of reductions which can ...
详细信息
Domain terms play a crucial role in many research areas, which has led to a rise in demand for automatic domain terms extraction. In this paper, we present a two-level evaluation approach based on term hood and unit h...
详细信息
Visualization technique is a powerful method used by science and technology intelligence analysis experts to identify technical competitor groups. Common visualization methods tend to create graphs meeting the aesthet...
详细信息
In RFID application systems with multiple packaging layers, labeling packaging relationship of objects in different packaging layers by encoding methods is a important technology field. Prefix-based labeling scheme is...
详细信息
LS2 is the logic to reason about the property of trusted computing. However, it lacks the capability of modeling the isolation provided by virtualization which is often involved in previous trusted computing system. W...
详细信息
Trusted platform module (TPM) has little computation capability, and it is the performance bottleneck of remote attestation. In the scenario where the server is the attestation-busy entity which answers attestation re...
详细信息
Complex spatial data is the fundamental content of Smart Earth. Spatial data mining plays an important role in Smart Earth. In this paper, it is proposed that "Smart earth equals to Digital Earth plus the Interne...
详细信息
暂无评论