Methods for detecting kernel rootkits.

Rootkits are stealthy, malicious software that allow an attacker to gain and maintain control of a system, attack other systems, destroy evidence, and decrease the chance of detection. Existing detection methods typically rely on a priori knowledge and operate by either (a) saving the system state before infection and comparing this information post infection, or (b) installing a detection program before infection. This dissertation focuses on detection using reduced a priori knowledge in the form of general knowledge of the statistical properties of broad classes of operating system/architecture pairs. Four new approaches to rootkit detection were implemented and evaluated. A general distribution model is employed against kernel rootkits utilizing the system call table modification attack. Using approaches from the field of outlier detection, this approach successfully detected four different rootkits, with no false positives. Scalability is, however, an issue with this approach. A second, normality-based approach was investigated for use against rootkits infecting systems via the system call table modification attack. This approach was partially successful, but did generate false positives in 0.35% of cases. The general distribution model was then applied to rootkits infecting systems via the system call target modification attack. This dataset is dramatically larger, including disassembled memory addresses from the entire kernel. Finally, a modified version of the normality based approach proved effective in detecting kernel rootkits infecting the kernel via the system call target modification attack. This approach capitalizes on the discovery that system calls are loaded into memory sequentially, with the higher level calls, which are more likely to be infected by kernel rootkits loaded first, and the lower level calls loaded later. In the single case evaluated, the enyelkm rootkit, neither false positives nor false positives were indicated. As a final evaluation, these techniques were applied to the Microsoft Windows operating systems. The Windows equivalent of the system call table, the system service descriptor table (SSDT), appears to be almost perfectly normally distributed. A Windows rootkit employing the system call table modification attack was detected using the general distribution and \u27assumption of normality\u27 models

Rage, Remembrance, Redemption: The Poetic Response to AIDS

This thesis explores the works of three poets whose works offer a response to the AIDS epidemic: Thom Gunn, Paul Monette, and Mark Doty. With chapters dedicated to each poefs work individually, the thesis examines the works in terms of thematic content, formal characteristics, and sociopolitical relevance. The three central chapters are framed by personal essays that also explore general characteristics of AIDS poetry In the great tradition of the elegy and the lyric. While all three poets offer narratives alternative to the political discourse surrounding the disease, each poet\u27s response is unique - just as each poet\u27s relationship to the disease is unique. The works studied here stand as cultural artifacts of the early days of the AIDS epidemic, when the disease had yet to reach the status of a global pandemic. The deeply personal and, at times. Intensely political responses illustrate the struggle inherent in artistic activism - expressing the horrors of individual narratives while attempting to cry out collectively for recognition and response

Effects of stream channelization on fishes and bottom fauna in the Little Sioux River, Iowa.

http://www.worldcat.org/oclc/50048889

Dynamical processes in the middle atmosphere as observed from Upper Atmosphere Research Satellite limb-sounding data

This study uses data from the Upper Atmosphere Research Satellite (UARS) to investigate two topics in middle atmosphere dynamics: the 4-day wave and transport processes deduced from atmospheric carbon monoxide. The 4-day wave is an eastward moving quasi-nondispersive feature with 4 day period occurring near the winter polar stratopause. Evidence of the 4-day feature is presented in UARS Microwave Limb Sounder (MLS) temperature, geopotential height, quasigeostrophic potential vorticity (PV), and ozone from the late southern winters of 1992 and 1993. Space-time spectral analyses reveal a double-peaked vertical temperature structure with an out-of-phase relationship between the two peaks. The height variation of the 4-day ozone signal compares well with a linear advective-photochemical tracer model. Regions of negative PV gradient and positive Eliassen-Palm flux divergence are shown to occur, consistent with instability dynamics playing a role in wave forcing. The three-dimensional wave structure resembles the PV charge concept, wherein a PV anomaly in the atmosphere (analogous to an electrical charge in a dielectric material) induces a geopotential field, a vertically oriented temperature dipole, and circulation about the vertical axis;Observations of carbon monoxide in the upper stratosphere and lower mesosphere from the UARS Improved Stratospheric and Mesospheric Sounder (ISAMS) are presented during the early northern winter 1991/1992. High CO mixing ratios are found to saturate the polar vortex. 2D analyses in the meridional plane indicate: (1) Increasing mixing ratio with altitude. (2) Large mixing ratios near the Arctic winter pole due to downward advection from the diabatic circulation. (3) A tropical upper stratosphere maximum likely due largely to methane oxidation. ISAMS CO data are compared with CO output from a 3D chemistry and transport model (CTM), initialized with ISAMS CO. ISAMS and CTM horizontal distributions compare favorably near the stratopause, while disagreement in the vertical zonal mean CO distributions occurs several weeks into the model run, with CTM mixing ratios biased high in the upper stratosphere outside the polar vortex and low in the stratospheric vortex and lower mesosphere. Novel modified Lagrangian mean diagnostics applied to ISAMS and CTM data provide insight into horizontal mixing processes during a rapid merger of two anticyclones

A microcoulometric study of adsorption on the hydrogen electrode

Thie work was begun with the intention of studying the adsorption of organic compounds upon the hydrogen electrode. The fact that certain substances, even when present in extremely low concentration, will poison the electrode with which they are in contact shows clearly that these substances must be strongly adsorbed on the electrode surface. The problem or determining the amount absorbed at various concentration, temperatures, and pressures, however, required a method capable of detecting quantities of adsorbate in the ordor of 10-11 moles