Modern Operating Systems Research Articles

Azərbaycan Respublikasının iqtisadi-sosial inkişafi strategiyasında maliyyə-kredit sahəsi

Given the high degree of openness of the Azerbaijani economy and the sensitivity of national banks to global challenges, the Strategic Road Map on the development of financial services was developed and introduced in 2016 in the Republic. The project was created taking into account the principles of modern technologies: financial inclusion; digital information support; protection of the rights of consumers of banking services; etc. The project implementation led to the modernization of the financial and credit sector of the Republic of Azerbaijan, to the introduction of modern operating systems in various segments of financial institutions.

KALD: Detecting Direct Pointer Disclosure Vulnerabilities

Modern operating system kernels deploy Kernel Address Space Layout Randomization (KASLR) to mitigate control-flow hijacking attacks. KASLR randomizes the base addresses of the kernel's code and data segments. However, it randomizes both with a single offset and does not randomize the internal layout of either of these segments, so relative addresses remain known to adversaries. If the kernel discloses a single code or global data pointer, an adversary can therefore infer the entire layout of the kernel's code segment and bypass KASLR. In this paper, we present Kernel Address Leak Detector ( KALD ), a tool that finds direct disclosure vulnerabilities by statically analyzing the kernel source code. KALD can analyze the source code of modern operating system kernels and find previously unreported leaks. KALD compiles a list of functions that can leak information to user-space accessible locations, and it uses the results of a points-to analysis to determine whether individual invocations of such functions can disclose kernel pointers. We show that KALD successfully detects several direct disclosure vulnerabilities in the Linux kernel and that it is flexible enough to be useful in practice.

Improving the quality of dermatoglyphics in accordance with DVI-INTERPOL standards

The article outlines prospects for using the latest approaches to identification of victims of major disasters and the involvement of specialists in international and state analytical information programs and identification courses in accordance with the recommendations of DVI-Interpol. The basic principles on which the forensic medical identification of an unknown person is based, namely, the multidisciplinary approach to identification, as well as the use of all possible lines of evidence to reinforce the identity between human remains and the missing person. These principles enhance the competence of forensic doctors in the context of adaptation of applied methodology and theoretical concepts of identification of persons in accordance with international standards and recommendations of coordinating structures in the event of emergencies of national and international scales. Current and discussed issues today among the forensic medical community are the search for new identification systems and algorithms that could give a very reliable result within short time limits. Important principles that ensure high authenticity of an unknown person is the multidisciplinary approach to identification, as well as the use of all possible evidence lines to maximize the identity of the human remains and the missing person.The method of obtaining dermatoglyphs of hands and feet, with the use of a printing ink causes a number of inconveniences with the receipt and further elaboration of received papillary prints. It is also worth noting that dermatoglyphs, obtained by the classical method of using printing ink, in modern conditions for the creation of computer databases and further quantitative and qualitative study, require digitization. However, when scanned, there are some difficulties associated with the quality of the scans received. The image may be distorted due to background effects caused by uneven application of the coloring agent, uneven illumination of the object, the structure of the surface of the paper, the noise of the recording equipment, the noise of the scanning equipment, quantization noise when digitizing the image. The subsequent use of computer image processing entails the need for dermatological fingerprints in high quality in order to avoid further mistakes during calculations. To facilitate the task that rests with the researcher, and to improve the quality of the images received, we are invited to use the Futronic’s FS80 USB 2.0 scanner.The Futronic’s FS80 USB 2.0 scanner uses advanced technology, namely the CMOS sensor and precision optical system for removing high-quality fingerprint images, and is compatible with all modern operating systems (Windows, Linux, MAC OS, Android), it connects via standard USB port The scanner software can be installed using the CD-ROM or by downloading from the manufacturer’s website. The software that comes with the scanner allows you to invert scan colors. The scanner is capable of capturing fingerprints and creating images of 480x320 pixels (500 DPI). The size of the scanning window is 16x24mm, with a 14mm glass thickness, which confirms its reliability and gives it advantages over any other sensors for fingerprint removal of the semiconductor type. The indicated scanner can be used to remove fingerprints not only distal phalanges, but also the middle and proximal. In our work, we used the Fingerprint Identification Algorithm (FIA) to improve the images. The main task of this software is to convert a rasterimage into a vector. When using this procedure, there is a potential misinterpretation of the pixel matrix data, so choosing an algorithm (or software) that is appropriate for the processing of photos with a papillary pattern is extremely important.The modern approach to the identification process is characterized by the integration interaction of the segmental components and provides the complexity of the data comparison process. In addition, the global experience of DVI’s operation suggests the feasibility of using the dermatological method as one of the basic methods for identifying an unknown person. Therefore, it does not lose its relevance, the search for possibilities to improve and modernize the provision of dermatological identification expertise, by improving the technique of obtaining fingerprint fingerprints (when using the Futronic’s FS80 scanner), and digitizing these data using the digital method (VeriFinger 6.6 / MegaMatcher 4.4 algorithm Identification Technology Algorithm), and improving the quality of the scans received (by converting raster prints into vector graphic objects) will increase the objectivity and evidentiary forensic medical examination in order to identify a person.

How to Fillet a Penguin: Runtime Data Driven Partitioning of Linux Code

In many modern operating systems (OSs), there exists no isolation between different kernel components, i.e., the failure of one component can affect the whole kernel. While microkernel OSs introduce address space separation for large parts of the OS, their improved fault isolation comes at the cost of performance. Despite significant improvements in modern microkernels, monolithic OSs like Linux are still prevalent in many systems. To achieve fault isolation in addition to high performance and code reuse in these systems, approaches to move only fractions of kernel code into user mode have been proposed. These approaches solely rely on static code analyses for deciding which code to isolate, neglecting dynamic properties like invocation frequencies. We propose to augment static code analyses with runtime data to achieve better estimates of dynamic properties for common case operation. We assess the impact of runtime data on the decision what code to isolate and the impact of that decision on the performance of such “microkernelized” systems. We extend an existing tool chain to implement automated code partitioning for existing monolithic kernel code and validate our approach in a case study of two widely used Linux device drivers and a file system.

An Effective Methodology for Measuring Software Resource Usage

In the last several years, an increasing number of attacks targeting services running on computing systems have been designed and deployed. Such attacks typically tend to overuse some of the system resources, e.g., CPU, memory, or storage. Current solutions are attack specific, i.e., they are designed for a specific malware or a specific set of malware that share the same resource usage profile and are mainly based on the underlying hypothesis that it is possible to measure the amount of resources used by each service under control. Such possibility is clearly available within modern operating systems, but using such measuring tools is nontrivial and limits their applicability. The advent of user-level virtualization systems may change this attitude. In this paper, we propose and validate a methodology for simplifying the measurements of resources used by a software service. Our approach uses the isolation properties of a containerized virtualization system in order to properly measure all the resources used by a specific service, even if it splits itself into different workers. At the same time, using the resource limitation functionalities provided by the virtualization system, we propose a methodology that can be used to limit the effects of malware by limiting the amount of resources that can be accessed on a system. In order to demonstrate the effectiveness of our approach, we consider the specific case of attacks targeting the overuse of power consumption.

Particular Qualities of Execution of the Program Component for Energy Resources Management of the Belgorod Region

The article considers modern operating systems for increasing energy efficiency at the municipal and regional levels. Present successfully applied practices in other regions are given. The essential distinctive features of the proposed system for the Belgorod region are revealed. Described, developed methods and algorithms for managing energy conservation in the budget sector. The structure of complex interaction of the developed modules used in the created software component is offered.

Time-shift replacement algorithm for main memory performance optimization

Page replacement algorithms of main memory in modern operating systems are crucial in system performance. When memory is full, a page replacement algorithm exploits temporal locality and frequency of page references to evict the page that is least likely to be accessed in the near future. Subsequently, loading the majority of data directly from memory improves performance by reducing I/O waits of accessing slow storage. Research of replacement algorithms that maximizes hit ratio while incurring as less overhead as possible has been constantly studied. In this paper, we propose a time-shift least recently used (TSLRU) algorithm that converts frequency information of page references into temporal locality. Frequent accesses of a page are thus recognized and accumulated in terms of time. Moreover, pages being loaded into memory for the first time are not necessarily the most recently used pages. As a result, one-pass pages are evicted sooner in our algorithm than in traditional LRU algorithm. Our performance evaluations show that the TSLRU outperforms conventional page replacement algorithms on both artificial and real application traces. For example, hit ratio of TSLRU advances ARC by \(4.17\%\) and LRU by \(5.91\%\) on normal distributed workloads. Moreover, TSLRU outperforms ARC by over \(2\%\) on half of the application traces tested.

LongLine: Visual Analytics System for Large-scale Audit Logs

Audit logs are different from other software logs in that they record the most primitive events (i.e., system calls) in modern operating systems. Audit logs contain a detailed trace of an operating system, and thus have received great attention from security experts and system administrators. However, the complexity and size of audit logs, which increase in real time, have hindered analysts from understanding and analyzing them. In this paper, we present a novel visual analytics system, LongLine, which enables interactive visual analyses of large-scale audit logs. LongLine lowers the interpretation barrier of audit logs by employing human-understandable representations (e.g., file paths and commands) instead of abstract indicators of operating systems (e.g., file descriptors) as well as revealing the temporal patterns of the logs in a multi-scale fashion with meaningful granularity of time in mind (e.g., hourly, daily, and weekly). LongLine also streamlines comparative analysis between interesting subsets of logs, which is essential in detecting anomalous behaviors of systems. In addition, LongLine allows analysts to monitor the system state in a streaming fashion, keeping the latency between log creation and visualization less than one minute. Finally, we evaluate our system through a case study and a scenario analysis with security experts.

Конфигурационная сборка варианта ядра Linux для прикладных систем

The Linux operating system is a modern open operating system containing more than 10,000 configuration variables and a large variety of functional system elements that handle the processing of various kinds of tasks. The task is to create some version of the OS for a class of applied systems (medicine, biology, etc.). This task is solved by analyzing the basic functions of the OS kernel and choosing from a variety of elements the most suitable for the operational management of application functions. Based on them, a model of variability is created from the basic characteristics of the OS and the model of the OS variant, including the main functional elements of the OS kernel. These models are tested for the correctness of their identification and relationships with other elements. Then, using these models, the OS version is configured as a configuration file. This file is verified and undergoes comprehensive testing on a set of tests that verify the correct functioning of the operating environment and the processing of tasks of applied systems. This paper discusses how to build a ready-made version of the operating system kernel from source. The preparations, the necessary packages, the patches for them and the ways of their installation will be affected. Then it presents a method for configuring a system version assembled from source and configuring the kernel to run.

BoundShield: Comprehensive Mitigation for Memory Disclosure Attacks via Secret Region Isolation

Address space layout randomization (ASLR) is now widely adopted in modern operating systems to thwart code reuse attacks. However, an adversary can still bypass fine-grained ASLR by exploiting memory corruption vulnerabilities and performing memory disclosure attacks. Although Execute-no-Read schemes have been proven to be an efficient solution against read-based memory disclosures, existing solutions need modifications to kernel or hypervisor. Besides, the defense of execution-based memory disclosures has been ignored. In this paper, we propose BoundShield, a self-protection scheme that provides comprehensive protection against memory disclosure attacks, especially against those based on executing arbitrary code by leveraging Intel Memory Protection Extension . BoundShield protects code memory by defending not only read-based memory disclosure attacks but also execution-based memory disclosure attacks. On one hand, read-based memory disclosures can be eliminated by hiding all code sections and code pointers in a secret region separated from the user address space. On the other hand, BoundShield prevents return addresses from being corrupted and ensures that all function pointers point to the legitimate entries whenever they are dereferenced, which significantly reduces the attack surface for execution-based memory disclosures. We have implemented a prototype of BoundShield based on a set of modifications to compiler toolchain and the standard C library. Our evaluation results show that the BoundShield can provide strong defenses against memory disclosure attacks while incurring a small performance overhead.

Carbonxs GUI – a Graphical Front End for Carbonxs

Disordered nanostructured carbons are commonly used as support materials for components in fuel cells, batteries, and catalysts. Deriving structural parameters from x-ray diffraction analysis is a critical tool to optimize the performance of these systems. CarbonXS is a Fortran 77 program originally developed in 1993 by Shi, Reimers, and Dahn that uses a model of 2D carbon layers instead of a 3D model used in traditional Rietveld refinement of x-ray diffraction patterns.1,2 The model uses the diffraction from stacked layers of graphene sheets with random perturbation to calculate a complete diffraction pattern. The χ2 loss function between the calculated and the experimental diffraction pattern is then minimized by Levenberg-Marquardt optimization algorithm. The parameters that CarbonXS optimize include the size of the crystalline domains in the lateral and stacking directions, the degree of turbostratic disorder, and the size of strain. It has been demonstrated to accurately model than 40 disordered and graphitized carbons.1,2 Zheng et al. also used this program to derive a correlation between the calculated disorder of carbons used as Li-ion batteries electrodes and their intercalation capacity.3 The original CarbonXS program was only available for old versions of Windows as a command line program, must be configured through a text file system, and only outputs to text files. These limitations have prevented its widespread adoption in fields where structural characterization of carbons is essential in optimizing performance. After receiving the source code for the original CarbonXS program along with permission to continue development for modern platform, we have recently released CarbonXS GUI as a Python program which acts as a cross-platform graphical front-end to a recompiled version of CarbonXS that works on modern operating systems. Currently supported platforms include Microsoft Windows, Apple OSX, and Linux. A screenshot of the program after performing an optimization is shown in Figure 1. CarbonXS GUI improves upon the command line experience by giving the user a complete graphical user interface to control their fitting process. Additional features of CarbonXS GUI include the ability to export and import fitting parameters as JSON files, instant feedback with a visual plot of the fit and the experimental data, and a calculation mode that allows a user to tune their parameters without running an optimization. The current version of CarbonXS GUI (v1.2.1) and its documentation are available as free, open-source software at Ref 4 and 5 respectively. We will demonstrate the use of this updated program in the context of structural analysis for nanoscale non-PGM catalyst materials for fuel cells.

Write-aware memory management for hybrid SLC-MLC PCM memory systems

In recent years, phase-change memory (PCM) has generated a great deal of interest because of its byte addressability and non-volatility properties. It is regarded as a good alternative storage medium that can reduce the performance gap between the main memory and the secondary storage in computing systems. To further reduce the bit cost of PCM, the development trend of PCM goes from single-level-cell (SLC) the multi-level-cell (MLC) technology. However, the worse endurance and the intolerable long write latency hinder a MLC PCM from being used as the main memory of computing systems. In this work, we propose a write-aware memory management design to facilitate enabling the use of hybrid PCM as main memory to achieve a better trade-off between the cost and the performance of PCM-based computing systems, where the hybrid PCM is composed of SLC PCM and MLC PCM. In particular, the proposed design can be seamlessly integrated into the inherent memory management of modern operation systems without additional hardware components. The capability of the proposed design was evaluated by a series of experiments, for which it was shown that the proposed design could greatly improve the read and write performance of hybrid PCM memory system up to 30%. At the same time, our proposed idea can significantly extend the lifetime of the investigated hybrid PCM architecture up to 1174 times, compared to existing approaches.

USBWall: A novel security mechanism to protect against maliciously reprogrammed USB devices

ABSTRACTUniversal Serial Bus (USB) is a popular choice of interfacing computer systems with peripherals. With the increasing support of modern operating systems, it is now truly plug-and-play for most USB devices. However, this great convenience comes with a risk that can allow a device to perform arbitrary actions at any time while it is connected. Researchers have confirmed that a simple USB device such as a mass storage device can be disguised to have an additional functionality such as a keyboard. An unauthorized keyboard attachment can compromise the security of the host by allowing arbitrary keystrokes to enter the host. This undetectable threat differs from traditional virus that spreads via USB devices due to the location where it is stored and the way it behaves. We propose a novel way to protect the host via a software/hardware solution we named a USBWall. USBWall uses BeagleBone Black (BBB), a low-cost open-source computer, to act as a middleware to enumerate the devices on behalf of the host. We developed a program to assist the user to identify the risk of a device. We present a simulated USB device with malicious firmware to the USBWall. Based on the results, we confirm that using the USBWall to enumerate USB devices on behalf of the host eliminates risks to the hosts.

Symmetric multiprocessing from boot to virtualization

SummaryThe x86 multicore processor architecture and the concepts associated with symmetric multiprocessing have become the linchpin of modern operating systems and cloud computing. A solid understanding of these technologies has become critical to any developer entering the field. Unfortunately, the complexity associated with discovering, enabling, using, and virtualizing multiple cores has created a paucity in the available documentation, transferable knowledge, and readable code exemplars. This paper describes our experience in overcoming these hurdles in the design of a from scratch, multi‐core operating system––Bear––for secure and resilient cloud computing. In particular, we trace the intricacies involved in the development of a multi‐core microkernel with an integrated multi‐core hypervisor. By exploring the implementation details, from bootstrapping through core virtualization to process scheduling, this paper aims to fill the knowledge gaps, highlight potential pitfalls, and introduce multicore development in a concise start‐to‐finish exemplar.

Automated and reliable resource release in device drivers based on dynamic analysis

In a modern operating system, device drivers acquire system resources to work. The acquired resources should be explicitly released by the drivers, because the operating system never reclaims them. Moreover, improper resource release can cause system crashes or hangs. Thus resource release is very important to driver reliability. However, according to our study on Linux driver mailing lists, many applied patches involve the modifications of resource release. Thus current resource management in drivers is not reliable enough.In this paper, we propose a novel approach named AutoRR, which can automatically and reliably release resources based on dynamic analysis. To identify resource handling operations, we use the dynamic specification-mining technique to mine resource acquiring and releasing functions. During execution, we maintain a resource-state list by intercepting the mined functions. If the driver fails to release acquired resources, AutoRR will report bugs and call corresponding releasing functions to safely release the resources. Dynamic analyses of resource dependency, allocation hierarchy, error handling form and releasing time are performed to avoid introducing new bugs when releasing resources. The evaluation on 12 Linux drivers shows that 40 detected bugs are all successfully and safely tolerated, and the overhead is only 7.84%.

CATS: cache-aware task scheduling for Hadoop-based systems

Today with the explosion of big data, data-intensive cluster computing systems have driven to a new data processing paradigm. As Hadoop, one of the most famous data processing frameworks, achieves high performance by running multiple tasks in parallel across nodes in large clusters, task scheduling is considered as one of the most important factors affecting the overall performance. In modern operating systems, caching is used to improve local disk access times, providing data from the main memory without disk accesses. This option, however, is poorly utilized by existing task scheduling methods of Hadoop-based systems, mainly due to the inability of tracking cached data in shared-nothing distributed environments. In this paper, we propose a cache-aware task scheduling method, cache-aware task scheduling (CATS), for Hadoop-based systems which is able to exploit the operating system's buffer cache and assign tasks to nodes in consideration of the cached data. Through comprehensive experiments, we show that the proposed cache-aware scheduling improves the overall job execution time for various workload types and data sizes.

Protecting Internet users from becoming victimized attackers of click‐fraud

AbstractInternet users are often victimized by malicious attackers. Some attackers infect and use innocent users' machines to launch large‐scale attacks without the users' knowledge. One of such attacks is the click‐fraud attack. Click‐fraud happens in pay‐per‐click ad networks where the ad network charges advertisers for every click on their ads. Click‐fraud has been proved to be a serious problem for the online advertisement industry. In a click‐fraud attack, a user or an automated software clicks on an ad with a malicious intent and advertisers need to pay for those valueless clicks. Among many forms of click‐fraud, botnets with the automated clickers are the most severe ones. In this study, we present a method for detecting automated clickers from the user side. The proposed method to fight click‐fraud, FCFraud, can be integrated into the desktop and smart device operating systems. Since most modern operating systems already provide some kind of antimalware service, our proposed method can be implemented as a part of the service. We believe that an effective protection at the operating system level can save billions of dollars of the advertisers. Experiments show that FCFraud is 99.6% (98.2% in mobile ad library–generated traffic) accurate in classifying ad requests from all user processes and it is 100% successful in detecting clickbots in both desktop and mobile devices. We implement a cloud backend for the FCFraud service to save battery power in mobile devices. The overhead of executing FCFraud is also analyzed and we show that it is reasonable for both the platforms.

The other guys: automated analysis of marginalized malware

In order to thwart dynamic analysis and bypass protection mechanisms, malware have been using several file formats and evasive techniques. While publicly available dynamic malware analysis systems are one of the main sources of information for researchers, security analysts and incident response professionals, they are unable to cope with all types of threats. Therefore, it is difficult to gather information from public systems about CPL, .NET/Mono, 64-bits, reboot-dependent, or malware targeting systems newer than Windows XP, which result in a lack of understanding about how current malware behave during infections on modern operating systems. In this paper, we discuss the challenges and issues faced during the development of this type of analysis system, mainly due to security features available in NT 6.x kernel versions of Windows OS. We also introduce a dynamic analysis system that addresses the aforementioned types of malware as well as present results obtained from their analyses.

Optimizing Memory Usage in L4-Based Microkernel

Memory allocation is a critical aspect of any modern operating system kernel because it must run continuously for long periods of time, therefore memory leaks and inefficiency must be eliminated. This paper presents different memory management algorithms and their aplicability to an L4-based microkernel. We aim to reduce memory usage and increase the performance of allocation and deallocation of memory.

ODSA: A Novel Ordering Divisional Scheduling Algorithm for Modern Operating Systems

CPU scheduling is defined as scheduling multiple processes that are required to be executed in a specific time period. A large number of scheduling algorithms have been proposed to achieve maximum CPU utilization/throughput and minimizing turn around, waiting and response time. Existing studies claim that Round Robin (RR) is providing best results in terms of above-mentioned factors. In RR, a process is assigned to CPU for a fixed time quantum then the process starts its execution, in case that assigned time quantum greater than CPU’s capacity then remaining section of that process waits for its next turn. Although RR schedules processes in an efficient manner, however, it has certain limitations such as if time quantum is too small or large, it causes frequent context switching and response time can increase. To address these identified problems, various improved versions of RR also exist. The purpose of this paper is twofold: 1) a comparison between different improved versions of RR; and 2) a new algorithm named Ordering Divisional Scheduling Algorithm (ODSA) is also proposed that combines various features of different algorithms and is actually an improvement to RR. Our results show that ODSA can schedule processes with less turn around and average waiting time as compared to existing solutions.