sAES: A high throughput and low latency secure cloud storage with pipelined DMA based PCIe interface

Chen, Yongzhen; Wang, Yi; Ha, Yajun; Felipe, Miguel Rodel; Ren, Shuqin; Aung, Khin Mi Mi

doi:10.1109/fpt.2013.6718391

Cited by 5 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Most critically, we assume access to periodic samples or snapshots of physical memory. Such snapshots could be provided via a hardware-based system (e.g., [7], [11], [14], [46], [50]), or through virtual machine introspection. In Section V, we evaluate our approach using both x86-supported System Management Mode and also PCIbased SlotScreamer devices to gather memory snapshots.…”

Section: ) Input Assumptionsmentioning

confidence: 99%

Towards Transparent Introspection

Leach

Spensky

Weimer

et al. 2016

2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER)

View full text Add to dashboard Cite

There is a growing need for the dynamic analysis of sensitive systems that do not support traditional debugging or emulation environments. Analysis can alter program behavior, necessitating transparency. For example, as the cat and mouse game between malware authors and malware analysts progresses, malicious software can increasingly detect and confound debuggers. Analysts must understand variable values, stack traces, and factors influencing dynamic behavior, but recent malware samples leverage any piece of information or artifact available that signals the presence of a debugger or emulator. In this work, we advance the state-of-the-art for transparent program analysis by introducing a low-artifact introspection technique. Our approach uses hardware-assisted live memory snapshots of process execution on native targets (e.g., x86 processors), coupled with static reasoning about programs. We produce highfidelity data and control flow information with minimal detectable artifacts that could influence benign subject behavior or be leveraged for anti-analysis. We evaluate our system using two hardware implementations (x86-supported System Management Mode and PCI-based SlotScreamer devices) and two software configurations (benign and evasive programs). We also analyze the theoretical and practical limitations of our technique. We discuss an expert case study in which we apply our technique to a malware reverse engineering task. Finally, we present results of a human study in which 30 participants performed debugging tasks using information provided by our approach; our tool was as useful as a gdb baseline, but applies transparently. Our dynamic analysis approach permits transparent introspection to access previously-unavailable information about a process's internal state with minimal instrumentation artifacts.

show abstract

Section: ) Input Assumptionsmentioning

confidence: 99%

Towards Transparent Introspection

Leach

Spensky

Weimer

et al. 2016

2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER)

View full text Add to dashboard Cite

show abstract

“…Serverless computing enables cloud services to provide a big data-focused architecture to users. The architectures are made up of various sub-services (i.e., microservices) that facilitate the end-to-end extract, transform and load (ETL) workflow needed to accomplish data analysis tasks (Chen et al, 2013). This study proposed a digital forensic readiness framework that utilizes human-natural language interaction, referred to as the DFClaaS system, that leverages microservices.…”

Section: The Proposed Dfr Hli Dfclaas Systemmentioning

confidence: 99%

Functional Architectural Design of a Digital Forensic Readiness Cybercrime Language as a Service

Baror

Ikuesan²,

Venter³

2023

eccws

View full text Add to dashboard Cite

Developing a generic digital forensic solution in a cloud computing platform that can address the functional requirements of digital forensic stakeholders is a complex process. The solution would require a technology-independent architectural design that addresses the challenges of incident threat identification, triggering, incident threat isolation and investigation. Existing approaches are limited to the functionality that treats these four challenges individually without the due diligence to consider their interoperability. This study proposes a context-independent and technology-neutral architecture to address these issues by developing a digital forensic readiness (DFR) based on a human language communication interaction (HLI) system that could create a cybercrime language as a service (DFClaaS). The functional architectural design of the proposed DFR HLI DFClaaS system comprises microservices, layered and event/component-based architectural patterns on top of cloud architectural patterns. The DFR HLI DFClaaS system integrates flexibility and other quality requirements to separate concerns while accommodating rigid requirements like security and reliability. The developed architecture is essential for any human-centred digital forensic solution. Therefore, integrating the developed architecture presents a reliable baseline for the digital forensic community.

show abstract

“…(e.g., [37,51,59,211,243]), or through VMI. In Section 5.4, we evaluate our approach using both LO-PHI and MalT techniques to gather memory snapshots.…”

Section: Memory Snapshotsmentioning

confidence: 99%

Transparent System Introspection in Support of Analyzing Stealthy Malware

Leach

View full text Add to dashboard Cite

The proliferation of malware has increased dramatically and seriously degraded the privacy of users and the integrity of hosts. Millions of unique malware samples appear every year, which has driven the development of a vast array of analysis tools. Malware analysis is often performed with the assistance of virtualization or emulation for rapid deployment.Malware samples are run in an instrumented virtual machine or analysis tool, and existing introspection techniques help an analyst determine its behavior. Unfortunately, a growing body of malware samples has begun employing anti-debugging, anti-virtualization, and antiemulation techniques to escape or otherwise subvert these analysis mechanisms.These anti-analysis techniques often require measuring differences between the analysis environment and the native environment (e.g., executing more slowly in a debugger). We call these measurable differences artifacts. Malware samples that use artifacts to exhibit stealthy behavior have increased the effort required to analyze and understand each stealthy sample. Additionally, traditional automated techniques fail against such samples because they produce measurable artifacts. We desire a transparent approach that produces no artifacts, thereby admitting the analysis of stealthy malware. We refer to this challenge as the debugging transparency problem. Solving this problem is thus concerned with reducing artifacts or permitting reliable analysis in the presence of artifacts.We present a system consisting of two approaches to address the debugging transparency problem and then demonstrate how these components can apply to currently available computer systems. We present two techniques capable of transparently acquiring snapshots of memory and disk activity that can be used to analyze stealthy malware. First, we discuss a novel use of a custom Field-Programmable Gate Array that provides snapshots of memory and disk activity with no measurable timing artifacts. Second, we present a novel use of System Management Mode on x86 platforms that produces no functional artifacts at the expense of producing timing artifacts. Finally, we present an approach to evaluating the i tradeoff space that exists between analysis transparency and the fidelity of introspection data provided by such an analysis system. Together, these approaches form a cohesive solution to the debugging transparency problem that admits analyzing stealthy malware.ii DedicationThe graduate school experience has been a long endurance test. There are several people to whom I owe a tremendous amount of gratitude.

show abstract

sAES: A high throughput and low latency secure cloud storage with pipelined DMA based PCIe interface

Cited by 5 publications

References 11 publications

Towards Transparent Introspection

Towards Transparent Introspection

Functional Architectural Design of a Digital Forensic Readiness Cybercrime Language as a Service

Transparent System Introspection in Support of Analyzing Stealthy Malware

Contact Info

Product

Resources

About