HyBIS: Windows Guest Protection through Advanced Memory Introspection

Effectively protecting the Windows OS is a challenging task, since most implementation details are not publicly known. Windows has always been the main target of malwares that have exploited numerous bugs and vulnerabilities. Recent trusted boot and additional integrity checks have rendered the Windows OS less vulnerable to kernel-level rootkits. Nevertheless, guest Windows Virtual Machines are becoming an increasingly interesting attack target. In this work we introduce and analyze a novel Hypervisor-Based Introspection System (HyBIS) we developed for protecting Windows OSes from malware and rootkits. The HyBIS architecture is motivated and detailed, while targeted experimental results show its effectiveness. Comparison with related work highlights main HyBIS advantages such as: effective semantic introspection, support for 64-bit architectures and for latest Windows (8.x and 10), advanced malware disabling capabilities. We believe the research effort reported here will pave the way to further advances in the security of Windows OSes

A Raman lidar at La Reunion (20.8° S, 55.5° E) for monitoring water vapour and cirrus distributions in the subtropical upper troposphere: preliminary analyses and description of a future system

A ground-based Rayleigh lidar has provided continuous observations of tropospheric water vapour profiles and cirrus cloud using a preliminary Raman channels setup on an existing Rayleigh lidar above La Reunion over the period 2002–2005. With this instrument, we performed a first measurement campaign of 350 independent water vapour profiles. A statistical study of the distribution of water vapour profiles is presented and some investigations concerning the calibration are discussed. Analysis regarding the cirrus clouds is presented and a classification has been performed showing 3 distinct classes. Based on these results, the characteristics and the design of a future lidar system, to be implemented at the new Reunion Island altitude observatory (2200 m) for long-term monitoring, is presented and numerical simulations of system performance have been realised to compare both instruments

Arctic stratospheric dehydration – Part 2: Microphysical modeling

Large areas of synoptic-scale ice PSCs (polar stratospheric clouds) distinguished the Arctic winter 2009/2010 from other years and revealed unprecedented evidence of water redistribution in the stratosphere. A unique snapshot of water vapor repartitioning into ice particles was obtained under extremely cold Arctic conditions with temperatures around 183 K. Balloon-borne, aircraft and satellite-based measurements suggest that synoptic-scale ice PSCs and concurrent reductions and enhancements in water vapor are tightly linked with the observed de- and rehydration signatures, respectively. In a companion paper (Part 1), water vapor and aerosol backscatter measurements from the RECONCILE (Reconciliation of essential process parameters for an enhanced predictability of Arctic stratospheric ozone loss and its climate interactions) and LAPBIAT-II (Lapland Atmosphere–Biosphere Facility) field campaigns have been analyzed in detail. This paper uses a column version of the Zurich Optical and Microphysical box Model (ZOMM) including newly developed NAT (nitric acid trihydrate) and ice nucleation parameterizations. Particle sedimentation is calculated in order to simulate the vertical redistribution of chemical species such as water and nitric acid. Despite limitations given by wind shear and uncertainties in the initial water vapor profile, the column modeling unequivocally shows that (1) accounting for small-scale temperature fluctuations along the trajectories is essential in order to reach agreement between simulated optical cloud properties and observations, and (2) the use of recently developed heterogeneous ice nucleation parameterizations allows the reproduction of the observed signatures of de- and rehydration. Conversely, the vertical redistribution of water measured cannot be explained in terms of homogeneous nucleation of ice clouds, whose particle radii remain too small to cause significant dehydration

Tropopause and hygropause variability over the equatorial Indian Ocean during February and March 1999.

Measurements of temperature, water vapor, total water, ozone, and cloud properties were made above the western equatorial Indian Ocean in February and March 1999. The cold-point tropopause was at a mean pressure-altitude of 17 km, equivalent to a potential temperature of 380 K, and had a mean temperature of 190 K. Total water mixing ratios at the hygropause varied between 1.4 and 4.1 ppmv. The mean saturation water vapor mixing ratio at the cold point was 3.0 ppmv. This does not accurately represent the mean of the measured total water mixing ratios because the air was unsaturated at the cold point for about 40% of the measurements. As well as unsaturation at the cold point, saturation was observed above the cold point on almost 30% of the profiles. In such profiles the air was saturated with respect to water ice but was free of clouds (i.e., backscatter ratio <2) at potential temperatures more than 5 K above the tropopause and hygropause. Individual profiles show a great deal of variability in the potential temperatures of the cold point and hygropause. We attribute this to short timescale and space-scale perturbations superimposed on the seasonal cycle. There is neither a clear and consistent “setting” of the tropopause and hygropause to the same altitude by dehydration processes nor a clear and consistent separation of tropopause and hygropause by the Brewer-Dobson circulation. Similarly, neither the tropopause nor the hygropause provides a location where conditions consistently approach those implied by a simple “tropopause freeze drying” or “stratospheric fountain” hypothesis

Nitric acid trihydrate nucleation and denitrification in the Arctic stratosphere

Nitric acid trihydrate (NAT) particles in the polar stratosphere have been shown to be responsible for vertical redistribution of reactive nitrogen (NO_y). Recent observations by Cloud–Aerosol Lidar with Orthogonal Polarization (CALIOP) aboard the CALIPSO satellite have been explained in terms of heterogeneous nucleation of NAT on foreign nuclei, revealing this to be an important formation pathway for the NAT particles. In state of the art global- or regional-scale models, heterogeneous NAT nucleation is currently simulated in a very coarse manner using a constant, saturation-independent nucleation rate. Here we present first simulations for the Arctic winter 2009/2010 applying a new saturation-dependent parametrisation of heterogeneous NAT nucleation rates within the Chemical Lagrangian Model of the Stratosphere (CLaMS). The simulation shows good agreement of chemical trace species with in situ and remote sensing observations. The simulated polar stratospheric cloud (PSC) optical properties agree much better with CALIOP observations than those simulated with a constant nucleation rate model. A comparison of the simulated particle size distributions with observations made using the Forward Scattering Spectrometer Probe (FSSP) aboard the high altitude research aircraft Geophysica, shows that the model reproduces the observed size distribution, except for the very largest particles above 15 &mu;m diameter. The vertical NO_y redistribution caused by the sedimentation of the NAT particles, in particular the denitrification and nitrification signals observed by the ACE-FTS satellite instrument and the in situ SIOUX instrument aboard the Geophysica, are reproduced by the improved model, and a small improvement with respect to the constant nucleation rate model is found

Validation of water vapour profiles from the Atmospheric Chemistry Experiment (ACE)

International audienceThe Atmospheric Chemistry Experiment (ACE) mission was launched in August 2003 to sound the atmosphere by solar occultation. Water vapour (H2O), one of the most important molecules for climate and atmospheric chemistry, is one of the key species provided by the two principal instruments, the infrared Fourier Transform Spectrometer (ACE-FTS) and the MAESTRO UV-Visible spectrometer (ACE-MAESTRO). The first instrument performs measurements on several lines in the 1362?2137 cm?1 range, from which vertically resolved H2O concentration profiles are retrieved, from 7 to 90 km altitude. ACE-MAESTRO measures profiles using the water absorption band in the near infrared part of the spectrum at 926.0?969.7 nm. This paper presents a comprehensive validation of the ACE-FTS profiles. We have compared the H2O volume mixing ratio profiles with space-borne (SAGE II, HALOE, POAM III, MIPAS, SMR) observations and measurements from balloon-borne frostpoint hygrometers and a ground based lidar. We show that the ACE-FTS measurements provide H2O profiles with small retrieval uncertainties in the stratosphere (better than 5% from 15 to 70 km, gradually increasing above). The situation is unclear in the upper troposphere, due mainly to the high variability of the water vapour volume mixing ratio in this region. A new water vapour data product from the ACE-MAESTRO (Measurement of Aerosol Extinction in the Stratosphere and Troposphere Retrieved by Occultation) is also presented and initial comparisons with ACE-FTS are discussed

The SPARC Water Vapor Assessment II: assessment of satellite measurements of upper tropospheric humidity

Nineteen limb-viewing data sets (occultation, passive thermal, and UV scattering) and two nadir upper tropospheric humidity (UTH) data sets are intercompared and also compared to frost-point hygrometer balloon sondes. The upper troposphere considered here covers the pressure range from 300–100 hPa. UTH is a challenging measurement, because concentrations vary between 2–1000 ppmv (parts per million by volume), with sharp changes in vertical gradients near the tropopause. Cloudiness in this region also makes the measurement challenging. The atmospheric temperature is also highly variable ranging from 180–250 K. The assessment of satellite-measured UTH is based on coincident comparisons with balloon frost-point hygrometer sondes, multi-month mapped comparisons, zonal mean time series comparisons, and coincident satellite-to-satellite comparisons. While the satellite fields show similar features in maps and time series, quantitatively they can differ by a factor of 2 in concentration, with strong dependencies on the amount of UTH. Additionally, time-lag response-corrected Vaisala RS92 radiosondes are compared to satellites and the frost-point hygrometer measurements. In summary, most satellite data sets reviewed here show on average ∼30 % agreement amongst themselves and frost-point data but with an additional ∼30 % variability about the mean bias. The Vaisala RS92 sonde, even with a time-lag correction, shows poor behavior for pressures less than 200 hPa