Sciweavers

USS
2004
13 years 10 months ago
Copilot - a Coprocessor-based Kernel Runtime Integrity Monitor
Copilot is a coprocessor-based kernel integrity monitor for commodity systems. Copilot is designed to detect malicious modifications to a host's kernel and has correctly dete...
Nick L. Petroni Jr., Timothy Fraser, Jesus Molina,...
USS
2004
13 years 10 months ago
Avfs: An On-Access Anti-Virus File System
Viruses and other malicious programs are an everincreasing threat to current computer systems. They can cause serious damage and consume countless hours of system administrators&#...
Yevgeniy Miretskiy, Abhijith Das, Charles P. Wrigh...
USS
2004
13 years 10 months ago
Privacy-Preserving Sharing and Correlation of Security Alerts
Patrick Lincoln, Phillip A. Porras, Vitaly Shmatik...
USS
2004
13 years 10 months ago
Static Disassembly of Obfuscated Binaries
Disassembly is the process of recovering a symbolic representation of a program's machine code instructions from its binary representation. Recently, a number of techniques h...
Christopher Krügel, William K. Robertson, Fre...
USS
2004
13 years 10 months ago
Autograph: Toward Automated, Distributed Worm Signature Detection
Today's Internet intrusion detection systems (IDSes) monitor edge networks' DMZs to identify and/or filter malicious flows. While an IDS helps protect the hosts on its l...
Hyang-Ah Kim, Brad Karp
USS
2004
13 years 10 months ago
On Gray-Box Program Tracking for Anomaly Detection
Many host-based anomaly detection systems monitor a process ostensibly running a known program by observing the system calls the process makes. Numerous improvements to the precis...
Debin Gao, Michael K. Reiter, Dawn Xiaodong Song
USS
2004
13 years 10 months ago
Tor: The Second-Generation Onion Router
We present Tor, a circuit-based low-latency anonymous communication service. This second-generation Onion Routing system addresses limitations in the original design by adding per...
Roger Dingledine, Nick Mathewson, Paul F. Syverson
USS
2004
13 years 10 months ago
Fixing Races for Fun and Profit: How to Use access(2)
It is well known that it is insecure to use the access(2) system call in a setuid program to test for the ability of the program's executor to access a file before opening sa...
Drew Dean, Alan J. Hu