File Operations Research Articles

Mount SMB.pcap: Reconstructing file systems and file operations from network traffic

File system and network forensics are fundamental in forensic investigations, but are often treated as distinct disciplines. This work seeks to unify these fields by introducing a novel framework capable of mounting network captures, enabling investigators to seamlessly browse data using conventional tools. Although our implementation supports various protocols such as HTTP, TLS, and FTP, this work will particularly focus on the complexities of the Server Message Block (SMB) protocol, which is fundamental for shared file system access, especially within local networks.For this, we present a detailed methodology to extract essential file system data from SMB network traffic, aiming to reconstruct the share's file system as accurately as the original. Our approach goes beyond traditional tools like Wireshark, which typically only extract individual files from SMB transmissions. Instead, we reconstruct the entire file system hierarchy, retrieve all associated metadata, and handle multiple versions of files captured within the same network traffic. In addition, we also investigate how file operations impact SMB commands and show how these can be used to accurately recreate user activities on an SMB share based solely on network traffic. Although both methodologies and implementations can be applied independently, their combination provides investigators with a comprehensive view of the reconstructed file system along with the corresponding user activities extracted from network traffic.

The evolution of Microsoft Windows operating systems after 2001

The purpose of this article is to present the most important changes that occurred with the release of successive versions of Windows after 2001 and to compare Windows XP, Windows 7, Windows 10, Windows 11 in terms of performance, resource consumption, speed of file operations and usability of the graphical user interface. For this purpose, research scenarios were prepared to enable for reliable testing, two computer workstations were prepared to install the operating systems under study, and research experiments were conducted. The results of the research were presented graphically and analyzed. Conclusions were drawn to answer the question of whether the usability of Windows operating systems increased with the advent of new versions of the system.

Large file encryption in a reduced-round permutation-based AES file management system

In the rapid evolving digital landscape, the imperative to ensure data security has never been more crucial. This paper addresses the pressing challenges in data security by introducing a file encryption management system, leveraging a modified advanced encryption standard (AES) algorithm with reduced round iterations and bit permutation. This system aims to comprehensively secure various file types, providing a dependable solution for file exchange. Our findings reveal substantial improvements in both encryption and decryption processes using the reduced-round permutation-based AES (RRPBA). The adapted algorithm demonstrates a significant 38.8% acceleration in encryption time and a remarkable 44.86% improvement in decryption time, positioning it as a pivotal component for efficient file operations within the management system. Moreover, the throughput assessments showcase a remarkable 33.73% improvement in encryption and 23.72% in decryption, outperforming the original AES, emphasizing the algorithm's superior computational effectiveness, signaling positive implications for future high-performance applications. In conclusion, the study not only addresses critical security challenges but also presents a viable solution with tangible speed advantages for file encryption and decryption processes within digital file management systems.

Customized Virtual File System

Customized Virtual File System

An Asynchronous Parallel I/O Framework for Mass Conservation Ocean Model

I/O is often a performance bottleneck in global ocean circulation models with fine spatial resolution. In this paper, we present an asynchronous parallel I/O framework and demonstrate its efficacy in the Mass Conservation Ocean Model (MaCOM) as a case study. By largely reducing I/O operations in computing processes and overlapping output in I/O processes with computation in computing processes, this framework significantly improves the performance of the MaCOM. Through both reordering output data for maintaining data continuity and combining file access for reducing file operations, the I/O optimizing algorithms are provided to improve output bandwidth. In the case study of the MaCOM, the cost of output in I/O processes can be overlapped by up to 99% with computation in computing processes as decreasing output frequency. The 1D data output bandwidth with these I/O optimizing algorithms is 3.1 times faster than before optimization at 16 I/O worker processes. Compared to the synchronous parallel I/O framework, the overall performance of MaCOM is improved by 38.8% at 1024 computing processes for a 7-day global ocean forecast with 1 output every 2 h through the asynchronous parallel I/O framework presented in this paper.

Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security

Log lines consist of static parts that characterize their structure and enable assignment of event types, and event parameters, i.e., variable parts that provide specific information on system processes, such as host and user names, IP addresses, and file operations. Many detection approaches only focus on anomalous event type occurrences, i.e., they parse log lines to derive unique event identifiers and subsequently detect anomalies in event sequences or event count vectors, but neglect variable parts of log lines entirely during analysis. This is especially problematic, when monitoring strongly structured log data that contains only a small number of distinct event types, for example, logs that consist of strict key value pairs, i.e., parameters that occur consistently throughout all log lines, such as it is case in access and audit logs. Thus, novel approaches are required, which focus on analysis of log lines' variable parts. In this paper, we propose the variable type detector (VTD), a novel unsupervised approach that autonomously analyzes variable log line parts to enable anomaly detection. It assigns data types to each variable, which also include probability distributions for discrete and continuous variables. The VTD raises an alarm if a variable's data type changes. Furthermore, it implements a robust indicator function that reduces false positives by tracking the data type history of each variable and reports only significant data type changes. Additionally, an event indicator enables event-based anomaly detection by taking into account the data types of all variables of a single event type. The evaluation conducted on open-source log data, demonstrates the effectiveness of the VTD compared to conventional anomaly detection approaches, such as time series analysis and PCA. Consequently, the VTD acts as a solution that extends the intrusion detection capabilities of security information and event management (SIEM) and integrates with modern concepts of endpoint detection and response (EDR) and extended detection and responses (XDR), while simultaneously serving as an asset for process monitoring that supports user and entity behavior analytics (UEBA).

Analyzing execution path non-determinism of the Linux kernel in different scenarios

Safety-critical systems play a significant role in industrial domains, and their complexity is increasing with advanced technologies such as Artificial Intelligence (AI). To provide efficient services, safety-critical systems that integrate AI applications are always built based on Linux, where Linux offers massive amounts of features and an incredibly perfect software ecosystem for AI applications. Since Linux is a pre-existing complex software system, different research programmes aim to pave the way for developing Linux-based safety-critical systems. Still, only some focus on the system calls for file operations. However, the execution path of a system call is effectively non-deterministic in Linux kernel space, which challenges the test coverage-based verification recommended by the functional safety standards. This research analyzes the influence of system state on Linux kernel path variability from two perspectives: file system type and system load. Therefore, an online data collection system for system call execution paths was constructed based on Ftrace, network file system (NFS), and MD5 hash function, uniquely identifying the system call execution path. The collected data were processed and analysed in this study. Evaluations show that the number of function execution paths of the system calls relevant to file systems increased with the increase in system load but would eventually be stable. Additionally, the function execution paths of the system call varied in different file systems. Based on the evaluations, the results of this work can provide advice for analyzing Linux-based safety-critical systems. In addition, the method introduced in this research can also provide support for the verification of Linux-based safety-critical systems.

Cloud Storage Systems with Secure Attribute-Based Access Control

This research presents a novel approach to safe access procedure in cloud storage structure by addressing the challenges associated with managing and distributing complex secret keys. The proposed procedure utilizes attribute-based access control and incorporates a client process, an authentication terminal process, and a storage terminal process. The client generates a main secret key and public parameters for each user using an attribute password mechanism. The authentication terminal maintains user attribute, file attribute, and attribute secret key databases. Access control is determined by constructing an access control string from the attributes of the user, file, and file operation type, enabling fine-grained access control and accommodating large-scale user dynamic expansion. Consequently, the access control costs of the cloud storage structure are significantly reduced, while offering a flexible, effective, and secure access control mechanism for safe storage structure access.

Analisis Dan Implementasi Algoritma Rivest Code-5 Pada Keamanan Data

The RC-5 algorithm is an algorithm with the encryption method using the symmetric method and processing in the form of a cipher block, the same keywords are used for the encryption and decryption processes. The testing and analysis phase consists of a). Testing the execution time of the key generation process (set up key) b). Testing the success of the encryption and decryption process on the client-server integration method c). Testing the success of the encryption and decryption process using the file operation method d). Comparison of overhead/file size before and after passing through the system. The testing phase and execution time analysis are carried out when using the file operation method where the test will be divided into 3 parts, namely the execution time for the key setup process, the encryption process, and the decryption process. Testing the success of the encryption and decryption process on the client-server integration method is divided into 2 parts, namely testing the encryption process and the decryption process. In testing the encryption process, the characters that will be sent to the server will be encrypted first with a key to becoming a ciphertext in the form of integer data. The test results obtained are 1). The execution time for key generation (set up key) is very fast, around 9-10 ns. 2). In the encryption and decryption process, the execution time depends on the size of the plaintext file. The larger the plaintext file size, the longer the execution time. Where for a file with a size of 1 kb requires an execution time of 50.6 ms in the encryption process. 3). There is no difference between the size of the file before entering encryption and after decryption. Where for files with a size of 500 bytes before entering the encryption process, a file of 500 bytes will be generated from the decryption process.

Haptools: a toolkit for admixture and haplotype analysis.

Leveraging local ancestry and haplotype information in genome-wide association studies and downstream analyses can improve the utility of genomics for individuals from diverse and recently admixed ancestries. However, most existing simulation, visualization and variant analysis frameworks are based on variant-level analysis and do not automatically handle these features. We present haptools, an open-source toolkit for performing local ancestry aware and haplotype-based analysis of complex traits. Haptools supports fast simulation of admixed genomes, visualization of admixture tracks, simulation of haplotype- and local ancestry-specific phenotype effects and a variety of file operations and statistics computed in a haplotype-aware manner. Haptools is freely available at https://github.com/cast-genomics/haptools. Detailed documentation is available at https://haptools.readthedocs.io. Supplementary data are available at Bioinformatics online.

The effectiveness of the Webtable-Datatable Conversion approach

Informatics education in Hungary is based on the National Base Curriculum (NAT) and the Frame Curricula. These documents contain the subjects (sciences), the number of classes for each subject and the requirements for each grade. According to the NAT2012, Informatics as a compulsory school subject is introduced in Grade 6. The filemanagement is among the first topics that students must learn according to the Frame Curricula. However, this is not their first encounter with filemanagent, since by the age of 12 most of the students are already active users of digital tools, and associated with the false assumptions of digital natives. Due to the late introduction, the filemanagement is one of the most neglected topics in informatics education. Nevertheless, this is one of the most important topics, since it is essential for further development in handling digital products. Our research group developed the Webtable-Datatable Conversion (WDC) highmathability method to teach filemanagement. This approach not only focuses on the main file operations but handles real world problems which require firm algorithm construction and datamanagement. The aim of the present study is to measure the effectiveness of the WDC approach with Grade 9 students, where the comparison of groups studying with the traditional and the WDC methods was carried out.

Implementation of Shamir’s Secret Sharing Scheme in Cloud Computing

With the increase in the use of cloud systems, security on cloud systems has become one of the most important items that underlined. Due to the nature of the cloud systems, it is difficult to manage multi-user systems and access control devices, resulting in some security vulnerabilities. In this paper we studied on Cloud Computing with Shamir’s Secret Sharing Scheme with Advanced Encryption Standard (AES) algorithm for encryption and decryption process. For encryption and decryption process AES in Cryptool 1.4.41 has been used. For implementing Shamir Secret Sharing Scheme, Python language has been chosen and Spyder 3.8 has been chosen for environment. As a result, we successfully demonstrate the Shamir’s Scheme implementation with file operations.

Malware Detection Method Based on File and Registry Operations Using Machine Learning

Malware (Malicious Software) is any software which performs malicious activities on computer-based systems without the user's consent. The number, severity, and complexity of malware have been increasing recently. The detection of malware becomes challenging because new malware variants are using obfuscation techniques to hide themselves from the malware detection systems. In this paper, a new behavioral-based malware detection method is proposed based on file-registry operations. When malware features are generated, only the operations which are performed on specific file and registry locations are considered. The file-registry operations divided into five groups: autostart file locations, temporary file locations, specific system file locations, autostart registry locations, and DLLs related registry locations. Based on the file-registry operations and where they performed, the malware features are generated. These features are seen in malware samples with high frequencies, while rarely seen in benign samples. The proposed method is tested on malware and benign samples in a virtual environment, and a dataset is created. Well-known machine learning algorithms including C4.5 (J48), RF (Random Forest), SLR (Simple Logistic Regression), AdaBoost (Adaptive Boosting), SMO (Sequential Minimal Optimization), and KNN (K-Nearest Neighbors) are used for classification. In the best case, we obtained 98.8% true positive rate, 0% false positive rate, 100% precision and 99.05% accuracy which is quite high when compared with leading methods in the literature.

Analysis of the performance of iOS applications developed using native and cross-platform technology.

Study presented in this paper concerns the comparative analysis of the performance of iOS applications developed using native and cross-platform technologies. For the purpose of the research, two iOS applications were implemented: the first one was created using the Swift programming language, while the second one using Flutter technology. For both applications, a set of research scenarios was defined, which assumed the examination of the time of execution and CPU consumption during the execution of operations, such as: sorting integers, writing and reading string from a file or writing and reading records from the SQLite database. The conducted analysis showed that it is not possible to clearly state which application is more efficient in terms of execution time and CPU consumption, because they obtained divergent results for different research scenarios. The native application performed better for file and database operations, while the cross-platform one obtained lower time and CPU consumption when sorting numbers.

DISEASE DIAGNOSIS USING MACHINE LEARNING

A diagnosis is made based on medical signs and patient-reported symptoms, rather than diagnostic tests. The whole program is done and executed in Python language mainly using file operations in Python and HTML for creating webpages. This project mainly deals with how the diagnosis is made by listing out all the symptoms faced by the patients from the given diseases on the website. This project gives you the list of seven diseases spread over our country according to the WHO (World Health Organization). The seven diseases are Heart, Diabetics, Breast Cancer, Liver, Kidney, Malaria, and Pneumonia. So based on the patient givens details under a particular disease, it finds out whether the patient is having the disease or not. If the person is suffering from that particular disease it shows that person is positive with that particular disease and shows a warning that the person should consult the doctor. We also created a user-based login page where the user can create his login page, thereby creating an account that person can fill in the details. If the person is registered then that person can log in directly. The health diagnosis website was designed by using web technology and languages such as HTML & CSS and python respectively.

Analisis Berkas Rekam Medis Rawat Inap Pada Kasus Operasi Di Rumah Sakit Pusat Pertamina Jakarta Selatan

Based on the results of observations made at Pertamina Central Hospital, it was found that several inpatient medical record file forms, especially in cases of surgery, were related to filling out forms that were not 100% complete and there was no evaluation of the completeness of inpatient medical record files in surgical cases. The purpose of this study was to analyze the completeness of inpatient medical record files, especially cases of surgery at Pertamina Central Hospital in February 2022. This research method used qualitative descriptive. Sampling using the Slovin formula with a population of 200 and the sample results obtained 67 samples. The results of this study obtained that the completeness of filling out the medical record file operation form in the complete category was 43 medical record files (64%) and 24 medical record files were incomplete (36%). The conclusion of this study is that the completeness of inpatient medical record files in surgical cases, especially related to filling out forms at Pertamina Central Hospital is categorized as incomplete because filling out forms is not 100% complete.

A systematic approach to understanding MACB timestamps on Unix-like systems

File timestamps are used by forensics practitioners as a fundamental artifact. For example, the creation of user files can show traces of user activity, while system files, like configuration and log files, typically reveal when a program was run. Despite timestamps being ubiquitous, the understanding of their exact meaning is mostly overlooked in favor of fully-automated, correlation-based approaches. Existing work for practitioners aims at understanding Windows and is not directly applicable to Unix-like systems. In this paper, we review how each layer of the software stack (kernel, file system, libraries, application) influences MACB timestamps on Unix systems such as Linux, OpenBSD, FreeBSD and macOS. We examine how POSIX specifies the timestamp behavior and propose a framework for automatically profiling OS kernels, user mode libraries and applications, including compliance checks against POSIX. Our implementation covers four different operating systems, the GIO and Qt library, as well as several user mode applications and is released as open-source. Based on 187 compliance tests and automated profiling covering common file operations, we found multiple unexpected and non-compliant behaviors, both on common operations and in edge cases. Furthermore, we provide tables summarizing timestamp behavior aimed to be used by practitioners as a quick-reference.

A Real-Time Detection Method of Software Configuration Errors Based on Fine-Grained Configuration Item Types

With the continuous expansion of software scale and the continuous complexity of software functions, abnormal parameter configuration often brings adverse effects to the software system and even leads to system failure. Therefore, a method is needed to detect whether the parameter configuration is correct. Most of the current configuration errors detection methods focus on the passive diagnosis after the system failure, which cannot solve the potential delay problem of configuration error. This paper proposes an automatic real-time detection method of software configuration errors, in which the configuration items are classified based on the fine-grained configuration item types and related syntax patterns, and the configuration constraint rule base is generated. Then, the real-time exception detection of configuration update operation is realized by using the file operation monitoring function. The experimental results show that this method can accurately classify the types of configuration items and verify the effectiveness of detecting software configuration update exceptions in real time through the constraint rule base. The classification accuracy reaches up to 90.4% on MySQL and 87.4% on Apache.

Predicting the effects of task jitter in digital control systems

ABSTRACT Many digital controllers need an operating system to perform tasks such as networking and file operations. This causes an increase in task jitter which can affect the performance of the control system. Some researchers have claimed that Root-Mean-Square (RMS) of the task jitter is a good indicator of how the control system will be affected but there has been without evi- dence to show this to be true. In this paper, Gaussian, Uniform and a Brute force distributed task jitter, all with the same jitter RMS, were tested on a second order control system. The collected step response envelopes of 10,000 simulations for each jitter type show a very similar shape suggesting that task jitter RMS is a good indicator of control system performance. The overshoot distribution is shown to be normal which means that system performance can be characterised by a much smaller number of simulation runs.The work also shows that particular patterns can have a significant impact on overshoot and settling time. A real control system subject to task jitter may randomly and occasionally show extreme behaviour which may be outside acceptable limits. Simulation is essential to find these extremes early in the design process.

FileWallet: A File Management System Based on IPFS and Hyperledger Fabric

Online file management systems enable cooperatively editing and sharing. However, due to the cost of communication and storage infrastructures, traditional online file management services, e.g., Google Drive and OneDrive, usually provide limited storage space and relatively low download speed for free users. To achieve better performance, ordinary users have to purchase their expensive services. Moreover, these file management systems are based on centralized architecture and bear the privacy leakage risk, because users’ personal files are stored and controlled by their servers. To address the above problems, we propose a peer-to-peer (P2P) file management system based on IPFS and Hyperledger Fabric, named as FileWallet, which can serve as a personal wallet for individual users or organizations to store and share their files in a secure manner. In FileWallet, the users form a P2P network and a Fabric network, where P2P network builds the connections and distributed storage network and the Fabric network sustains consistent blockchain ledgers to record file operation related transactions. In our FileWallet, the storage and communication costs are mitigated in the decentralized design, and the file owner can fully control the access permission of the file to preserve the file privacy. The design of the system architecture, main functionalities, and system implementations are presented in this paper. The performance of the system is evaluated through experiments, and the experimental results show its wide applicability and scalability.