State Of Computer System Research Articles

Memory analysis of .NET and .Net Core applications

Memory analysis is a digital forensics technique whose goal is to model a computer system's state based solely on the analysis of a snapshot of physical memory (RAM). Memory forensics is frequently employed in incident response to detect and analyze modern malware and attack frameworks. Memory forensics is a particularly powerful tool for analyzing modern malware, which may exist only in memory and not touch non-volatile storage. Memory-only attacks leave no trace of the malware and its associated modules on the file system and all data that traverses the network is commonly encrypted. While initially focused on kernel level rootkits, memory analysis research efforts have recently shifted to detection of userland malware. This shift occurred as operating system vendors have strongly locked down the ability for kernel rootkits to load, and, in turn, malware authors have developed significant userland malware capabilities. In this paper, we present our effort to develop memory analysis capabilities that target a very powerful and widely abused set of userland runtimes: the .NET Framework and its replacement, .NET Core. To support automated and repeatable results, even for non-expert investigators, we developed a number of Volatility plugins that automatically target key areas of these runtimes and report any suspicious artifacts. Our suite of new plugins provides investigators with deep insight into the use of .NET on a target system as well as identification of suspicious and malicious components. These capabilities considerably advance a defenders' ability to combat, contain, and understand modern malware.

ПРОГНОЗИРОВАНИЕ ПРОФИЛЯ ФУНКЦИОНИРОВАНИЯ КОМПЬЮТЕРНОЙ СИСТЕМЫ НА ОСНОВЕ МНОГОЗНАЧНЫХ ЗАКОНОМЕРНОСТЕЙ

Purpose of work is to create a new algorithm for predicting anomalous states of computer systems (CS) using the mathematical apparatus of multivalued dependencies (Multivalued Dependencies Prognosus Algorithm, MDPA), which are categorical concepts. The research method is the analysis of historical data using the mathematical apparatus of multivalued dependencies. Objects of study are theoretical and practical issues of solving and visualizing information security problems. Results of the study. A methodology and algorithm for predicting the state of CS have been developed. The boundaries of the input parameters of the algorithm are derived and justified. The boundaries of the input parameters need to be pre-configured for the correct generation of the prognosis. A software implementation of the proposed prediction algorithm has been developed. The efficiency of the algorithm has been tested on real experimental data. A spatial analysis of the prediction results was carried out. The main disadvantage of the proposed algorithm is the need to fine-tune the input parameters for each set of “historical data”. Scientific significance. The scope of application of multivalued dependencies has been expanded; a new algorithm for predicting anomalous states of CS, which are categorical concepts, has been proposed. The developed prediction algorithm can be generalized to any subject area containing historical data of any type

A Report on a Novice User's Interaction with the Internet through a Self-Voicing Application

This study used verbal protocol analysis to examine the behavior of an individual with visual impairment using a self-voicing application to find information on the World Wide Web. The results indicated that executing actions (such as typing or pressing keys) and interpreting the computer system's state (data gathering) were the most frequent and time-consuming tasks. Furthermore, the individual had difficulty determining the effects of her actions on the system and whether relevant information was present on a page. These results suggest that there may be problems in interfacing the user with the software and the way textual information is aurally displayed to the user.