System Calls Research Articles

A Lightweight File System Design for Unikernel

Unikernels are specialized operating system (OS) kernels optimized for a single application or service, offering advantages such as rapid boot times, high performance, minimal memory usage, and enhanced security compared to general-purpose OS kernels. Unikernel applications must remain compatible with the runtime environment of general-purpose kernels, either through binary or source compatibility. As a result, many Unikernel projects have prioritized system call compatibility over performance enhancements. In this paper, we explore the design principles of Unikernel file systems and introduce a new file system tailored for Unikernels named ULFS (Ultra Lightweight File System). ULFS provides system call services akin to those of general-purpose OS kernels but achieves superior performance and security with significantly fewer system resources. Specifically, ULFS is developed as a lightweight file system embracing Unikernel design principles. It streamlines system calls, removes unnecessary locks, and omits permission checks for multiple users, utilizing a non-hypervisor architecture. This approach significantly reduces the memory footprint of the file system and enhances performance. Through measurement studies, we assess the performance and memory requirements of various file systems from major Unikernel projects. Our findings demonstrate that ULFS surpasses several existing Unikernel file systems, including Rumpvfs, Ramfs-u, Ramfs-q, 9pfs, and Hcfs.

Detecting Android Malware by Mining Enhanced System Call Graphs

The persistent threat of malicious applications targeting Android devices has been growing in numbers and severity. Numerous techniques have been utilized to defend against this thread, including heuristic-based ones, which are able to detect unknown malware. Among the many features that this technique uses are system calls. Researchers have used several representation methods to capture system calls, such as histograms. However, some information may be lost if the system calls as a feature is only represented as a 1-dimensional vector. Graphs can represent the interaction of different system calls in an unusual or suspicious way, which can indicate malicious behavior. This study uses machine learning algorithms to recognize malicious behavior represented in a graph. The system call graph was fed into machine learning algorithms such as AdaBoost, Decision Table, Naïve Bayes, Random Forest, IBk, J48, and Logistic regression. We further employ a series feature selection method to improve detection accuracy and eliminate computational complexity. Our experiment results show that the proposed method has reduced feature dimension to 91.95% and provides 95.32% detection accuracy.

NorthGreen: unlocking records from sea to land in Northeast Greenland

Abstract. The increasing anthropogenic CO2 forcing of the climate system calls for a better understanding of how polar ice sheets may respond to accelerating global warming. The sensitivity of the Greenland ice sheet to polar amplification, changes in ocean heat transport, and deteriorating perennial sea ice conditions makes the Northeast Greenland margin a pertinent location with respect to understanding the impact of climate change on ice sheet instability and associated sea level rise. Throughout the Cenozoic, ocean heat fluxes toward and along Northeast Greenland have been controlled by water mass exchanges between the Arctic and Atlantic oceans. A key element here is the current flow through oceanic gateways, notably the Fram Strait and the Greenland–Scotland Ridge. To gain a long-term (million-year) perspective of ice sheet variability in this region, it is essential to understand the broader context of ice–ocean–tectonic interactions. Coupling between the ice sheet, the subsurface, the ocean, and sea ice are readily observable today in Northeast Greenland, but geological records to illuminate long-term trends and their interplay with other parts of the global climate system are lacking. Consequently, the NorthGreen workshop was organized by the Geological Survey of Denmark and Greenland in collaboration with Aarhus (Denmark) and Stockholm (Sweden) universities in November 2022 to develop mission-specific platform (MSP) proposals for drilling the Northeast Greenland margin under the umbrella of the MagellanPlus Workshop Series Programme of the European Consortium for Ocean Research Drilling (ECORD). Seventy-one participants representing a broad scientific community discussed key scientific questions and primary targets that could be addressed through scientific drilling in Northeast Greenland. Three pre-proposals were initiated during the workshop targeting Morris Jesup Rise, the Northeast Greenland continental shelf, and Denmark Strait.

System call frequency analysis-based generative adversarial network model for zero-day detection on mobile devices

In today's digital age, mobile applications have become essential in connecting people from diverse domains. They play a crucial role in enabling communication, facilitating business transactions, and providing access to a range of services. Mobile communication is widespread due to its portability and ease of use, with an increasing number of mobile devices projected to reach 18.22 billion by the end of 2025. However, this convenience comes at a cost, as cybercriminals are constantly looking for ways to exploit security vulnerabilities in mobile applications. Among the several varieties of malicious applications, zero-day malware is particularly dangerous since it cannot be removed by antivirus software. To detect zero-day Android malware, this paper introduces a novel approach based on generative adversarial networks (GANs), which generates new frequencies of feature vectors from system calls. In the proposed approach, the generator is fed with a mixture of real samples and noise, and then trained to create new samples, while the discriminator model aims to classify these samples as either real or fake. We assess the performance of our model through different measures, including loss functions, the Frechet Inception distance, and the inception score evaluation metrics.

Optimus: association-based dynamic system call filtering for container attack surface reduction

While container adoption has witnessed significant growth in facilitating the operation of large-scale applications, this increased attention has also attracted adversaries who exploit numerous vulnerabilities present in contemporary containers. Unfortunately, existing security solutions largely overlooked the need to restrict container access to the shared host kernel, particularly exhibiting critical limitations in enforcing the least privilege for containers during runtime. Hence, we propose Optimus, an automated and comprehensive system that confines container operations and governs their interactions with the host kernel using an association-based system call filtering. Optimus efficiently identifies the essential system calls required by containers and enhances their security posture by dynamically enforcing the minimal set of system calls for each container during runtime. This is achieved through (1) lightweight system call monitoring leveraging eBPF, (2) system call validation via association analysis, and (3) dynamic system call filtering by adopting covert container renewal. Our evaluation shows that Optimus effectively minimizes the necessary system calls for containers while maintaining their serviceability and operational efficiency during runtime.

Decentralized Scheduling for Data-Parallel Tasks in the Cloud

For latency-sensitive data processing applications in the cloud, concurrent data-parallel tasks need to be scheduled and processed quickly. A data-parallel task usually consists of a set of sub-tasks, generating a set of flows that are collectively referred to as coflows . The state-of-the-art schedulers collect coflow information in the cloud to optimize coflow-level performance. However, most of the coflows, classified as small coflows because they consist of only short flows, have been largely overlooked. This paper presents OptaX , a decentralized network scheduling service that collaboratively schedules data-parallel tasks’ small coflows. OptaX adopts a cross-layer, COTS (commercial off-the-shelf) switch-compatible design that leverages the sendbuffer information in the kernel to adaptively optimize flow scheduling in the network. Specifically, OptaX (i) monitors the system calls (syscalls) in the hosts to obtain their sendbuffer footprints, and (ii) recognizes small coflows and assigns high priorities to their flows. OptaX transfers these flows in a FIFO manner by adjusting TCP’s two attributes: window size and round-trip time. We have implemented OptaX as a Linux kernel module. The evaluation shows that OptaX is at least 2.2 × faster than fair sharing and 1.2 × faster than only assigning small coflows with the highest priority. We further apply OptaX to improve the small I/O performance of Ursa , a distributed block storage system that provides virtual disks where small I/O is dominant. URSA with OptaX achieves significant improvement compared to the original URSA for small I/O latency.

Real-time system call-based ransomware detection

AbstractRansomware, particularly crypto ransomware, has emerged as the go-to malware for threat actors aiming to compromise data on Android devices as well as in general. In this paper, we present a ransomware detection technique based on behaviours observed in the system calls performed by the malware. We first describe our repeatable and extensible methodology for extracting the system call log and patterns. We then identify and present some common high-level system call behavioural patterns exhibited by crypto ransomware, and evaluate these patterns. We further describe the implementation of a streaming implementation that utilises regular expressions for modelling malware behaviours and finite state machines for detecting crypto ransomware behaviours in real time. The success of our proof of concept evaluation allows us to envision our proposed technique applied as part of a self-protection system on Android phones against malware.

Preservation of β-Cells as a Therapeutic Strategy for Diabetes.

The preservation of pancreatic islet β-cells is crucial in diabetes mellitus, encompassing both type 1 and type 2 diabetes. β-cell dysfunction, reduced mass, and apoptosis are central to insufficient insulin secretion in both types. Research is focused on understanding β-cell characteristics and the factors regulating their function to develop novel therapeutic approaches. In type 1 diabetes (T1D), β-cell destruction by the immune system calls for exploring immunosuppressive therapies, non-steroidal anti-inflammatory drugs, and leukotriene antagonists. Islet transplantation, stem cell therapy, and xenogeneic transplantation offer promising strategies for type 1 diabetes treatment. For type 2 diabetes (T2D), lifestyle changes like weight loss and exercise enhance insulin sensitivity and maintain β-cell function. Additionally, various pharmacological approaches, such as cytokine inhibitors and protein kinase inhibitors, are being investigated to protect β-cells from inflammation and glucotoxicity. Bariatric surgery emerges as an effective treatment for obesity and T2D by promoting β-cell survival and function. It improves insulin sensitivity, modulates gut hormones, and expands β-cell mass, leading to diabetes remission and better glycemic control. In conclusion, preserving β-cells offers a promising approach to managing both types of diabetes. By combining lifestyle modifications, targeted pharmacological interventions, and advanced therapies like stem cell transplantation and bariatric surgery, we have a significant chance to preserve β-cell function and enhance glucose regulation in diabetic patients.

Program Behavior Dynamic Trust Measurement and Evaluation Based on Data Analysis

Industrial control terminals play an important role in industrial control scenarios. Due to the special nature of industrial control networks, industrial control terminal systems are vulnerable to malicious attacks, which can greatly threaten the stability and security of industrial production environments. Traditional security protection methods for industrial control terminals have coarse detection granularity, and are unable to effectively detect and prevent attacks, lacking real-time responsiveness to attack events. Therefore, this paper proposes a real-time dynamic credibility evaluation mechanism based on program behavior, which integrates the matching and symmetry ideas of credibility evaluation. By conducting a real-time dynamic credibility evaluation of function call sequences and system call sequences during program execution, the credibility of industrial control terminal application program behavior can be judged. To solve the problem that the system calls generated during program execution are unstable and difficult to measure, this paper proposes a partition-based dynamic credibility evaluation method, dividing program behavior during runtime into function call behavior and system call behavior within function intervals. For function call behavior, a sliding window-based function call sequence benchmark library construction method is proposed, which matches and evaluates real-time measurement results based on the benchmark library, thereby achieving symmetry between the benchmark library and the measured data. For system call behavior, a maximum entropy system call model is constructed, which is used to evaluate the credibility of system call sequences. Experiment results demonstrate that our method performs better in both detection success rate and detection speed compared to the existing methods.

Analysis of Wind Turbine Wake Dynamics by a Gaussian-Core Vortex Lattice Technique

The development and deployment of the next generation of wind energy systems calls for simulation tools that model the entire wind farm while balancing accuracy and computational cost. A full-system wind farm simulation must consider the atmospheric inflow, the wakes and consequent response of the multiple turbines, and the implementation of the appropriate farm-collective control strategies that optimize the entire wind farm’s output. In this article, we present a novel vortex lattice model that enables the effective representation of the complex vortex wake dynamics of the turbines in a farm subject to transient inflow conditions. This work extends the capabilities of our multi-physics suite, CODEF, to include the capability to simulate the wakes and the high-fidelity aeroelastic response of multiple turbines in a wind farm. Herein, we compare the results of our GVLM technique with the LiDAR measurements obtained at Sandia National Laboratories’ SWiFT facility. The comparison shows remarkable similarities between the simulation and field measurements of the wake velocity. These similarities demonstrate our model’s capabilities in capturing the entire wake of a wind turbine at a significantly reduced computational cost as compared to other techniques.

Detection and Analysis of Android Ransomware Using the Support Vector Machines

Abstract: Ransomware is a malicious code designed to encrypt and lock personal data such as documents and photos, in order to create opportunity for extorting money from the victims. Android operating systems are particularly targeted due to their large market share. Previous studies have primarily relied on signature-based detection methods, which require sufficient data samples and labelled signatures. However, modern ransomware utilizes obfuscation techniques that make it challenging to analyse using static methods. This project proposes a hybrid analysis approach for Android ransomware, employing the SVM algorithm for detection. The novelty lies in the limited exploration of SVM algorithms for ransomware analysis. The dataset used in the study was obtained from CICA and Mal 2017. Static features, including permissions, intents, encoding methods, and API calls were used, along with dynamic features such as network activities and system calls. The SVM model achieved good performance, with 81% accuracy and 90% precision using static features, and 100% accuracy with dynamic features

Machine learning at the mesoscale: A computation-dissipation bottleneck.

The cost of information processing in physical systems calls for a trade-off between performance and energetic expenditure. Here we formulate and study a computation-dissipation bottleneck in mesoscopic systems used as input-output devices. Using both real data sets and synthetic tasks, we show how nonequilibrium leads to enhanced performance. Our framework sheds light on a crucial compromise between information compression, input-output computation and dynamic irreversibility induced by nonreciprocal interactions.

Hardware-hardened Sandbox Enclaves for Trusted Serverless Computing

In cloud-based serverless computing, an application consists of multiple functions provided by mutually distrusting parties. For secure serverless computing, the hardware-based trusted execution environment (TEE) can provide strong isolation among functions. However, not only protecting each function from the host OS and other functions, but also protecting the host system from the functions, is critical for the security of the cloud servers. Such an emerging trusted serverless computing poses new challenges: Each TEE must be isolated from the host system bi-directionally, and the system calls from it must be validated. In addition, the resource utilization of each TEE must be accountable in a mutually trusted way. However, the current TEE model cannot efficiently represent such trusted serverless applications. To overcome the lack of such hardware support, this article proposes an extended TEE model called Cloister , designed for trusted serverless computing. Cloister proposes four new key techniques. First, it extends the hardware-based memory isolation in SGX to confine a deployed function only within its TEE (enclave). Second, it proposes a trusted monitor enclave that filters and validates system calls from enclaves. Third, it provides a trusted resource accounting mechanism for enclaves that is agreeable to both service developers and cloud providers. Finally, Cloister accelerates enclave loading by redesigning its memory verification for fast function deployment. Using an emulated Intel SGX platform with the proposed extensions, this article shows that trusted serverless applications can be effectively supported with small changes in the SGX hardware.

3D Phased Array Enabling Extended Field of View in Mobile Satcom Applications

Satellite communication (satcom) is experiencing increased interest to cover the connectivity gaps of terrestrial networks. To ensure high performance and throughput for the user—and even more so in Communications-On-The-Move(COTM) systems, e.g., in aeronautics—steerable antennas such as phased arrays are required to adjust the beam so as to follow the satellite’s trajectory. The mutual movement of terminals and satellite in COTM systems calls for a broad Field of View (FoV) and, hence, poses a challenge to common planar systems. For improving the FoV, common solutions require ad hoc designs, such as multi-mode antennas, wide half-power-beamwidth antennas or metasurfaces. By contrast, 3D arrays are able to cover a wider angular region by the 3D allocation of the antennas. In this paper, the benefits and drawbacks of moving from 2D (planar) arrays to 3D phased arrays are investigated. Multiple geometrical configurations are analyzed, keeping in mind the size requirements of aeronautic terminals. The best configuration is, hence, an array capable of enhancing the FoV of the terminal. The proposed antenna architecture offers a good trade-off between design complexity and performance, and it could be further developed to become an aeronautic-grade terminal aperture.

Temporal Patterns of Utilization of Constructed Water Pans by Different Mammal Species: A Study of Mount Kenya Wildlife Conservancy, Kenya

Climate change induced risks like prolonged dry spells are exacerbating water scarcity especially, in the wildlife conservancies calling for alternative water supply systems for wildlife. In Mount Kenya Wildlife Conservancy, water pans were constructed to provide water to animals during wet and dry seasons. The study aim was to establish patterns of water pans utilization by different mammal species in different seasons and times of the day. Study was conducted on the mammals visiting water pans in the dry season (June 2022) and wet season (October 2022) at two water pans in Mount Kenya Wildlife Conservancy. Mammal utilization of water pans was studied using observations and camera traps. Pearson correlation and t-test were used to analyze data. Impala had the highest water pan visitations (36.7%) followed by zebra (22.2%) while eland and reedbuck had the lowest (0.7%) visitations. Morning (0900hrs-1000hrs) was a period of peak visitations, followed by midday while dusk recorded the least visitations. Mammals utilized water pans for drinking, wallowing, grazing, socialization, and soil licking. There were significant differences in the number of visitations between the dry and wet seasons (df =7, t = 2.739, p=0.029) where dry season had high visitations (64.6%) while wet season had 35.4%. There was also a strong negative correlation between mammal visitations to the water pans and the time of the day.  The study shows that constructed water pans provide important source of water in protected areas where natural water sources are absent, inaccessible due to fencing, or during the dry season when water is limited. Therefore, water provisioning during the dry season in areas lacking water to increase dispersal ranges in the conservancy reducing mammal concentration around water pans.

Risk-Based System-Call Sequence Grouping Method for Malware Intrusion Detection

Malware intrusion is a serious threat to cybersecurity; that is why new and innovative methods are constantly being developed to detect and prevent it. This research focuses on malware intrusion detection through the usage of system calls and machine learning. An effective and clearly described system-call grouping method could increase the various metrics of machine learning methods, thereby improving the malware detection rate in host-based intrusion-detection systems. In this article, a risk-based system-call sequence grouping method is proposed that assigns riskiness values from low to high based on function risk value. The application of the newly proposed grouping method improved classification accuracy by 23.4% and 7.6% with the SVM and DT methods, respectively, compared to previous results obtained on the same methods and data. The results suggest the use of lightweight machine learning methods for malware attack can ensure detection accuracy comparable to deep learning methods.

Level of stress among first line nurses in East Jeddah Hospital, Saudi Arabia during COVID-19 pandemic

Objective: To determine the level of occupational stress and the associated factors among first line nurses in East Jeddah Hospital, Saudi Arabia, during COVID-19. Methodology: Data were collected from 250 first line nurses working in East Jeddah Hospital using survey questionnaires. The questionnaires consisted of occupational stress scale. The collected data were analyzed using Chi-square and descriptive statistical tools of SPSS. Results: We found that 82.8% of the nurses had high level of stress and only 17.2% had moderate stress. The level of occupational stress was affected by various demographic factors, including nurses’ age (p=0.000; r=.713), level of education (p=0.000; r=.655) marital status (p=0.014; r=.624), and whether the nurses stayed alone or with others (p=0.000; r=.507). Many work-related factors affect the level of occupational stress, including department of work (p=0.040; r=.756), hours of working (p=.000; r=.542), years of experience (p=.002; r=.734), access to PPEs (p=0.000; r=.594), nature of relationship with the other coworkers (p=0.000; r=.594) and nature of work relationship (p=0.000; r=.597). Conclusion: The high level of stress among the first line nurses varies with sociodemographic and work factors. This calls for the healthcare systems to implement devise measures to address the propagating factors around stress among these nurses.

Stories from a Customized Honeypot for the IoT

<p>Since the inception of the Internet of Things (IoT), the security measures implemented on its devices have been too weak to ensure the appropriate protection of the data that they handle. Appealed by this, cybercriminals continuously seek out for vulnerable units to control, leading to attacks spreading through networks and infecting a high number of devices. On top of that, while the IoT has evolved to provide a higher degree of security, the techniques used by attackers have done so as well, which has led to the need of continuously studying the way in which these attacks are performed to gather significant knowledge for the development of the pertinent security measures. In view of this, we analyze the state of IoT attacks by developing a high-interaction honeypot for SSH and Telnet services that simulates a custom device with the ARM architecture. This study is carried out in two steps. Firstly, we analyze and classify the interaction between the attacker and the devices by clustering the commands that they sent in the compromised Telnet and SSH sessions. Secondly, we study the malware samples that are downloaded and executed in each session and classify them based on the sequence of system calls that they execute at runtime. In addition, apart from studying the active data generated by the attacker, we extract the information that is left behind after a connection with the honeypot by inspecting the metadata associated with it. In total, more than 1,578 malicious samples were collected after 9,926 unique IP addresses interacted with the system, with the most downloaded malware family being Hajime, with 70.5% of samples belonging to it, and also detecting others such as Mirai, Gafgyt, Dofloo and Xorddos.</p> <p> </p>

DL-AMDet: Deep learning-based malware detector for android

The Android operating system, with its market share leadership and open-source nature in smartphones, has become the primary target of malware. However, detecting malicious Android processes has become a significant challenge because of the complexity of size, length, and associations of various important and distinctive elements of Android applications, such as API calls and system calls. In this paper DL-AMDet, a deep learning architecture is proposed to detect Android malware applications based on its static and dynamic features. DL-AMDet consists of two main detection models the first one uses CNN-BiLSTM deep learning method for detecting malware using static analysis. The other model utilizes deep Autoencoders as an anomaly detection model to identify the malware based on dynamic analysis. The performance of the DL-AMDet architecture is evaluated using two different datasets. The results show that DL-AMDet achieves a competitive malware detection accuracy of 99.935 % for static and dynamic analysis models combined. Additionally, the results emphasize the significance of CNN-BiLSTM and Deep Autoencoders models used in DL-AMDet to outperform the existing state-of-the-art techniques.

Formalizing complexity in the life sciences: systems, emergence, and metafluxes

AbstractCurrent plant sciences (as the life sciences in general) tend to follow an empirical rationale focussing on the molecular scale (genes, proteins), which is supposed to causally dominate processes at higher levels of organization (cellular, organismic). This rather simplistic view on the complexity of living systems calls for a more adequate and elaborate theoretical approach, to which I want to contribute three main cornerstones here. Systems theory is the first one, mostly referring to Mario Bunge’s CESM (Composition, Environment, Structure, Mechanism) approach and its biological application. More than half of this article is dedicated to the philosophical concept of emergence, denoting the fact that systems have specific properties not shared or provided by their parts. Different viewpoints on emergence and definitions are contrasted and their potential suitability for the life sciences is discussed. An interesting historical case study is the genesis of the ‘ecosystem’ concept in plant ecology. Subsequently two widely accepted subtypes, ‘weak’ and ‘strong’ emergence are introduced and their quantitative formalization is briefly outlined referring to recent work on this issue. Finally, the metaflux concept is presented for the first time. Living systems are characterized by a network of coupled fluxes of matter, free energy, and entropy, adequately formalized by the thermodynamics of irreversible processes. Dynamical phenomena in organisms emerging from these flux networks which are, in contrast to process philosophy/metaphysics, defined on a scientific (physicochemical) basis will be called ‘metafluxes’. Metafluxes and weak and strong emergence are non-exclusive concepts to be employed in a dialectic scientific process.