Multi-aspect, robust, and memory exclusive guest os fingerprinting

Precise fingerprinting of an operating system (OS) is critical to many security and forensics applications in the cloud, such as virtual machine (VM) introspection, penetration testing, guest OS administration, kernel dump analysis, and memory forensics. The existing OS fingerprinting techniques primarily inspect network packets or CPU states, and they all fall short in precision and usability. As the physical memory of a VM always exists in all these applications, in this article, we present OS-Sommelier+, a multi-aspect, memory exclusive approach for precise and robust guest OS fingerprinting in the cloud. It works as follows: given a physical memory dump of a guest OS, OS-Sommelier+ first uses a code hash based approach from kernel code aspect to determine the guest OS version. If code hash approach fails, OS-Sommelier+ then uses a kernel data signature based approach from kernel data aspect to determine the version. We have implemented a prototype system, and tested it with a number of Linux kernels. Our evaluation results show that the code hash approach is faster but can only fingerprint the known kernels, and data signature approach complements the code signature approach and can fingerprint even unknown kernels

Polarization Induced Switching Effect in Graphene Nanoribbon Edge-Defect Junction

With nonequilibrium Green's function approach combined with density functional theory, we perform an ab initio calculation to investigate transport properties of graphene nanoribbon junctions self-consistently. Tight-binding approximation is applied to model the zigzag graphene nanoribbon (ZGNR) electrodes, and its validity is confirmed by comparison with GAUSSIAN03 PBC calculation of the same system. The origin of abnormal jump points usually appearing in the transmission spectrum is explained with the detailed tight-binding ZGNR band structure. Transport property of an edge defect ZGNR junction is investigated, and the tunable tunneling current can be sensitively controlled by transverse electric fields.Comment: 18 pages, 8 figure

The correlations between the twin kHz QPO frequencies of LMXBs

We analyzed the recently published kHz QPO data in the neutron star low-mass X-ray binaries (LMXBs), in order to investigate the different correlations of the twin peak kilohertz quasi-eriodic oscillations (kHz QPOs) in bright Z sources and in the less luminous Atoll sources. We find that a power-law relation \no\sim\nt^{b} between the upper and the lower kHz QPOs with different indices: $b\simeq$1.5 for the Atoll source 4U 1728-34 and $b\simeq$1.9 for the Z source Sco X-1. The implications of our results for the theoretical models for kHz QPOs are discussed.Comment: 6 pages, accepted by MNRA