Selective Dynamic Analysis of Virtualized Whole-System Guest Environments

Dynamic binary analysis is a prevalent and indispensable technique in program analysis. While several dynamic binary analysis tools and frameworks have been proposed, all suffer from one or more of: prohibitive performance degradation, a semantic gap between the analysis code and the execution under analysis, architecture/OS specificity, being user-mode only, and lacking flexibility and extendability. This dissertation describes the design of the Dynamic Executable Code Analysis Framework (DECAF), a virtual machine-based, multi-target, whole-system dynamic binary analysis framework. In short, DECAF seeks to address the shortcomings of existing whole-system dynamic analysis tools and extend the state of the art by utilizing a combination of novel techniques to provide rich analysis functionality without crippling amounts of execution overhead. DECAF extends the mature QEMU whole-system emulator, a type-2 hypervisor capable of emulating every instruction that executes within a complete guest system environment. DECAF provides a novel, hardware event-based method of just-in-time virtual machine introspection (VMI) to address the semantic gap problem. It also implements a novel instruction-level taint tracking engine at bitwise level of granularity, ensuring that taint propagation is sound and highly precise throughout the guest environment. A formal analysis of the taint propagation rules is provided to verify that most instructions introduce neither false positives nor false negatives. DECAF’s design also provides a plugin architecture with a simple-to-use, event-driven programming interface that makes it both flexible and extendable for a variety of analysis tasks. The implementation of DECAF consists of 9550 lines of C++ code and 10270 lines of C code. Its performance is evaluated using CPU2006 SPEC benchmarks, which show an average overhead of 605% for system wide tainting and 12% for VMI. Three platformneutral DECAF plugins - Instruction Tracer, Keylogger Detector, and API Tracer - are described and evaluated in this dissertation to demonstrate the ease of use and effectiveness of DECAF in writing cross-platform and system-wide analysis tools. This dissertation also presents the Virtual Device Fuzzer (VDF), a scalable fuzz testing framework for discovering bugs within the virtual devices implemented as part of QEMU. Such bugs could be used by malicious software executing within a guest under analysis by DECAF, so the discovery, reproduction, and diagnosis of such bugs helps to protect DECAF against attack while improving QEMU and any analysis platforms built upon QEMU. VDF uses selective instrumentation to perform targeted fuzz testing, which explores only the branches of execution belonging to virtual devices under analysis. By leveraging record and replay of memory-mapped I/O activity, VDF quickly cycles virtual devices through an arbitrarily large number of states without requiring a guest OS to be booted or present. Once a test case is discovered that triggers a bug, VDF reduces the test case to the minimum number of reads/writes required to trigger the bug and generates source code suitable for reproducing the bug during debugging and analysis. VDF is evaluated by fuzz testing eighteen QEMU virtual devices, generating 1014 crash or hang test cases that reveal bugs in six of the tested devices. Over 80% of the crashes and hangs were discovered within the first day of testing. VDF covered an average of 62.32% of virtual device branches during testing, and the average test case was minimized to a reproduction test case only 18.57% of its original size

Measuring outcomes: Post-Graduation Measures of Success in the U.S. News & (and) World Report Law School Rankings

The U.S. News & World Report annual rankings play a key role in ordering the market for legal education, and, by extension, the market for entry level lawyers. This Article explores the impact and evolution of placement and post-graduation data, which are important input variables that comprise twenty percent of the total rankings methodology. In general, we observe clear evidence that law schools are seeking to maximize each placement and post-graduation input variable. During the 1997 to, 2006 time period, law schools in all four tiers posted large average gains in employment rates upon graduation and nine months, which appear to result from a combination of competition and gaming strategies. In addition, law schools in tiers 2, 3, and 4 have increased 1L academic attrition, which may be an attempt to increase the U.S. News bar passage score. We also use multivariate regression analysis to model the employed at graduation and employed at nine months input variables. We find that the following factors are associated with higher employed at graduation rates: (1) higher 25th percentile Law School Admissions Test (LSAT) scores, (2) more on-campus interviews (OCI), (3) higher percentage of part-time students, (4) location outside a Top 10 corporate law market, and (5) status as a historically black law school. All of these factors except LSAT and OCI activity vanish when examining the employed at nine months data. The U.S. News Lawyer/Judge reputation score is associated with higher employment at nine months. Further research on the Lawyer/Judge survey instrument is needed. After presenting our empirical results, we critique the specific measures of post-graduation success used in the U.S. News rankings and explain how each can be improved. We conclude that the best solution to law schools\u27 complaints about the impact of U.S. News rankings is greater data availability and transparency, particularly on post-graduation outcomes and other factors affecting students\u27 eventual employment prospects

Student Quality as Measured by LSAT Scores: Migration Patterns in the U.S. News Rankings Era

This study examines the change in entering-class median LSATscore, a key input into the U.S. News & World Report ( U.S. News\u27) rankings, between 1993 and 2004. Using multivariate regression analysis, the authors model several factors that can influence the direction and magnitude of this change. The study presents six specific findings: (1) the marketfor high Law SchoolAdmission Test (LSAT) scores is divided into two segments that operate under different rules; (2) initial starting position is a strong predictor of the future gain or loss in LSATscores; (3) the allure of the high-end corporate law firms appears to cause a signficant portion of students to discount the importance of rankings in favor of locational advantages related to the regional job market; (4) students will pay a tuition premium to attend elite law schools but, when deciding among non-elite schools, are willing to forgo a higher-ranked school for lower tuition; (5) there is little or no association between change in lawyer/judge and academic reputation and median LSAT scores; and (6) two well-known gaming strategies for driving up median LSAT scores appear to work. Drawing upon these results, the authors suggest that the current rankings competition among law schools has all the hallmarks of a positional arms race that undermines social welfare. The authors outline the emerging equilibrium in which non-elite schools engage in costly strategies to boost their reputations while elite law schools are able to further leverage their positional advantage. Because this dynamic spawns rapidly escalating costs in the form of higher tuition, continuation of the ranking tournament threatens the long-term viability of the current model of legal education. The authors conclude with four specific recommendations to law school deans and the editors of U.S. News

Measuring Outcomes: Post-Graduation Measures of Success in the U.S. News & World Report Law School Rankings

The U.S. News & World Report annual rankings play a key role in ordering the market for legal education, and, by extension, the market for entry level lawyers. This Article explores the impact and evolution of placement and post-graduation data, which are important input variables that comprise twenty percent of the total rankings methodology. In general, we observe clear evidence that law schools are seeking to maximize each placement and post-graduation input variable. During the 1997 to, 2006 time period, law schools in all four tiers posted large average gains in employment rates upon graduation and nine months, which appear to result from a combination of competition and gaming strategies. In addition, law schools in tiers 2, 3, and 4 have increased 1L academic attrition, which may be an attempt to increase the U.S. News bar passage score. We also use multivariate regression analysis to model the employed at graduation and employed at nine months input variables. We find that the following factors are associated with higher employed at graduation rates: (1) higher 25th percentile Law School Admissions Test (LSAT) scores, (2) more on-campus interviews (OCI), (3) higher percentage of part-time students, (4) location outside a Top 10 corporate law market, and (5) status as a historically black law school. All of these factors except LSAT and OCI activity vanish when examining the employed at nine months data. The U.S. News Lawyer/Judge reputation score is associated with higher employment at nine months. Further research on the Lawyer/Judge survey instrument is needed. After presenting our empirical results, we critique the specific measures of post graduation success used in the U.S. News rankings and explain how each can be improved. We conclude that the best solution to law schools\u27 complaints about the impact of U.S. News rankings is greater data availability and transparency, particularly on post-graduation outcomes and other factors affecting students\u27 eventual employment prospects

Student Quality as Measured by LSAT Scores: Migration Patterns in the U.S. News Rankings Era

This study examines the change in entering-class median LSAT score, a key input into the U.S. News & World Report ( U.S. News\u27) rankings, between 1993 and 2004. Using multivariate regression analysis, the authors model several factors that can influence the direction and magnitude of this change. The study presents six specific findings: (1) the market for high Law School Admission Test (LSAT) scores is divided into two segments that operate under different rules; (2) initial starting position is a strong predictor of the future gain or loss in LSAT scores; (3) the allure of the high end corporate law firms appears to cause a significant portion of students to discount the importance of rankings in favor of locational advantages related to the regional job market; (4) students will pay a tuition premium to attend elite law schools but, when deciding among non-elite schools, are willing to forgo a higher-ranked school for lower tuition; (5) there is little or no association between change in lawyer/judge and academic reputation and median LSAT scores; and (6) two well-known gaming strategies for driving up median LSAT scores appear to work. Drawing upon these results, the authors suggest that the current rankings competition among law schools has all the hallmarks of a positional arms race that undermines social welfare. The authors outline the emerging equilibrium in which non-elite schools engage in costly strategies to boost their reputations while elite law schools are able to further leverage their positional advantage. Because this dynamic spawns rapidly escalating costs in the form of higher tuition, continuation of the ranking tournament threatens the long-term viability of the current model of legal education. The authors conclude with four specific recommendations to law school deans and the editors of U.S. News. Symposium: The Next Generation of Law School Rankings held April 15, 2005 at Indiana University School of Law-Bloomington

Treaty of Fort Laramie, 1868 (Kappler)

This 1904 reprint of the Sioux Treaty of 1868, also known as the Treaty of Fort Laramie, 1868, was transcribed and published in vol. II of Charles Kappler’s Indian Affairs. Laws and Treaties. This treaty, between the United States government and the Sioux and Arapaho Nations, established the Great Sioux Reservation, promised the Sioux would own the Black Hills in perpetuity, and set aside the country north of the North Platte River and east of the summits of the Big Horn Mountains as unceded Indian territory. Furthermore, the U.S. government pledged to close the Bozeman Trail forts and provide food, clothing, and annuities to the tribes, given that they agreed to relinquish all rights to live outside the reservation.https://commons.und.edu/indigenous-gov-docs/1176/thumbnail.jp

Treaty Of Fort Laramie 1868

This treaty, signed on April 29, 1868, between the United States government and the Sioux and Arapaho Nations, established the Great Sioux Reservation, promised the Sioux would own the Black Hills in perpetuity, and set aside the country north of the North Platte River and east of the summits of the Big Horn Mountains as unceded Indian territory. Furthermore, the U.S. government pledged to close the Bozeman Trail forts and provide food, clothing, and annuities to the tribes, given that they agreed to relinquish all rights to live outside the reservation.https://commons.und.edu/indigenous-gov-docs/1000/thumbnail.jp