Redundancy Analysis and Elimination on Access Patterns of the Windows Applications Based on I/O Log Data

Abstract

In this paper, we analyze I/O log data monitored in the Windows operating system for improving the system performance. Especially, we focus on the I/O operations to the Windows registry. As a result, we identify redundant access patterns of the Windows applications. To find all the possible redundant patterns from the large-scale log data, we propose the redundancy detection algorithm. Then, we propose the two-level redundancy elimination method to remove unnecessary redundant operations. We also present an event-driven method that guarantees that the result of redundancy elimination is equivalent to that of the original program. Through experiments, we show that the proposed redundancy elimination method improves the performance of the original program having redundant access patterns by up to 90.25% for individual access patterns; by 8.93% ∼ 26.21% when the multiple programs having combined access patterns are running concurrently. INDEX TERMS I/O log data, access pattern analysis, redundancy elimination, Windows registry.

Mathematical Modeling Analysis of Data Attribute Encryption for Robot

“…Data encryption based on big data attributes is one of the effective methods to control data access users in the data outsourcing environment, but in the calculation process, it is impossible to realize the parallel application of multiple encryption methods. If the method is constantly updated, it will affect the execution efficiency of the overall algorithm and increase the time overhead [1]. In order to solve this problem, experts in relevant fields have obtained some good research results.…”

Large-scale digital forensic investigation for Windows registry on Apache Spark

“…In the Windows registry, the registry key and its corresponding registry value are stored in the form of a key-value pair. The Windows registry stores critical information, including user accounts and program locations executed, when the system is booting [2,3]. This information can be abused for cyberattacks such as dll hijacking, malware persistence, and privilege escalation by manipulating the stored information.…”