Methods for detecting kernel rootkits.

Rootkits are stealthy, malicious software that allow an attacker to gain and maintain control of a system, attack other systems, destroy evidence, and decrease the chance of detection. Existing detection methods typically rely on a priori knowledge and operate by either (a) saving the system state before infection and comparing this information post infection, or (b) installing a detection program before infection. This dissertation focuses on detection using reduced a priori knowledge in the form of general knowledge of the statistical properties of broad classes of operating system/architecture pairs. Four new approaches to rootkit detection were implemented and evaluated. A general distribution model is employed against kernel rootkits utilizing the system call table modification attack. Using approaches from the field of outlier detection, this approach successfully detected four different rootkits, with no false positives. Scalability is, however, an issue with this approach. A second, normality-based approach was investigated for use against rootkits infecting systems via the system call table modification attack. This approach was partially successful, but did generate false positives in 0.35% of cases. The general distribution model was then applied to rootkits infecting systems via the system call target modification attack. This dataset is dramatically larger, including disassembled memory addresses from the entire kernel. Finally, a modified version of the normality based approach proved effective in detecting kernel rootkits infecting the kernel via the system call target modification attack. This approach capitalizes on the discovery that system calls are loaded into memory sequentially, with the higher level calls, which are more likely to be infected by kernel rootkits loaded first, and the lower level calls loaded later. In the single case evaluated, the enyelkm rootkit, neither false positives nor false positives were indicated. As a final evaluation, these techniques were applied to the Microsoft Windows operating systems. The Windows equivalent of the system call table, the system service descriptor table (SSDT), appears to be almost perfectly normally distributed. A Windows rootkit employing the system call table modification attack was detected using the general distribution and \u27assumption of normality\u27 models

Rage, Remembrance, Redemption: The Poetic Response to AIDS

This thesis explores the works of three poets whose works offer a response to the AIDS epidemic: Thom Gunn, Paul Monette, and Mark Doty. With chapters dedicated to each poefs work individually, the thesis examines the works in terms of thematic content, formal characteristics, and sociopolitical relevance. The three central chapters are framed by personal essays that also explore general characteristics of AIDS poetry In the great tradition of the elegy and the lyric. While all three poets offer narratives alternative to the political discourse surrounding the disease, each poet\u27s response is unique - just as each poet\u27s relationship to the disease is unique. The works studied here stand as cultural artifacts of the early days of the AIDS epidemic, when the disease had yet to reach the status of a global pandemic. The deeply personal and, at times. Intensely political responses illustrate the struggle inherent in artistic activism - expressing the horrors of individual narratives while attempting to cry out collectively for recognition and response

A microcoulometric study of adsorption on the hydrogen electrode

Thie work was begun with the intention of studying the adsorption of organic compounds upon the hydrogen electrode. The fact that certain substances, even when present in extremely low concentration, will poison the electrode with which they are in contact shows clearly that these substances must be strongly adsorbed on the electrode surface. The problem or determining the amount absorbed at various concentration, temperatures, and pressures, however, required a method capable of detecting quantities of adsorbate in the ordor of 10-11 moles

Effects of stream channelization on fishes and bottom fauna in the Little Sioux River, Iowa.

http://www.worldcat.org/oclc/50048889