An automated analysis system identifies the presence of malicious P-code or N-code programs in a manner that limits the possibility of the malicious code infecting a target computer. The target computer system initializes an analytical virtual P-code engine (AVPE). As initialized, the AVPE comprises software simulating the functionality of a P-code or intermediate language engine as well as machine language facilities simulating the P-code library routines that allow the execution of N-code programs. The AVPE executes a target program so that the target program does not interact with the target computer. The AVPE analyzes the behavior of the target program to identify occurrence of malicious code behavior and to indicate in a behavior pattern the occurrence of malicious code behavior. The AVPE is terminated at the end of the analysis process, thereby removing from the computer system the copy of the target program that was contained within the AVPE.

Computer immune system and method for detecting unwanted code in a P-code or partially compiled native-code program executing within a virtual machine

A survey of coordinated attacks and collaborative intrusion detection

An analytical virtual machine (AVM) analyzes computer code using a software processor including a register that stores behavior flags indicative of behaviors identified by virtually executing the code within the virtual machine. The AVM includes a sequencer that stores the sequence in which behavior flags are set in the behavior flags register. The AVM analyzes machine performance by emulating execution of the code being analyzed on a fully virtual machine and records the observed behavior. When emulation and analysis are complete, the AVM returns the behavior flags register and sequencer to the real machine and terminates.

Analytical virtual machine

From the Publisher:
The book studies modern concepts of Computer Security. It is selfcontained in the sense that it introduces the basic mathematical background necessary to follow computer security concepts. Next we examine modern developments in Cryptography starting from private-key and public-key encryption, going through hashing, digital signatures, authentication, secret sharing, group-oriented cryptography, pseudorandomness, key establishment protocols, zero-knowledge protocols, identification and finishing with an introduction to modern e-business systems based on digital cash. Intrusion detection and access control provide examples of security systems implemented as a part of operating system. Database and network security is also discussed.

Fundamentals of Computer Security

Providing a user with assurance that a computer is secure based on a vulnerability assessment completed by a browser-compatible scanner operating on the computer. If the scanner finds a vulnerability, the scanner can inform the user that the machine is or may be compromised, or repair the vulnerability. For example, the scanner may be able to repair the vulnerability of the workstation. In the alternative, the scanner can provide the scan results to a network server. If the vulnerability assessment shows that the workstation is compromised, or if the possibility of remote compromise is high, the network server can decline to provide network services to the workstation.

Vulnerability assessment and authentication of a computer by a local scanner

An implemented system for on-line analysis of multiple distributed data streams is presented. The system is conceptually universal since it does not rely on any particular platform feature and uses format adaptors to translate data streams into its own standard format. The system is as powerful as possible (from a theoretical standpoint) but still efficient enough for on-line analysis thanks to its novel rule-based language (RUSSEL) which is specifically designed for efficient processing of sequential unstructured data streams. The generic concepts are applied to security audit trail analysis. The resulting system provides powerful network security monitoring and sophisticated tools for intrusion/anomaly detection. The rule-based and command languages are described as well as the distributed architecture and the implementation. Performance measurements are reported, showing the effectiveness of the approach. >

Distributed audit trail analysis

Summary form only given; substantially as follows. Computing with sets of tuples (n-ary relations) is often required in programming, while being a major cause of performance degradation as the size of sets increases. The authors present a new data structure dedicated to the manipulation of large sets of tuples, dubbed a sharing tree. The main idea to reduce memory consumption is to share some sub-tuples of the set represented by a sharing tree. Various conditions are given. The authors have developed algorithms for common set operations: membership, insertion, equality, union, intersection, ... that have theoretical complexities proportional to the sizes of the sharing trees given as arguments, which are usually much smaller than the sizes of the represented sets.

Efficient handling of large sets of tuples with sharing trees

Computing all the reachable states of synchronized automata is important in the mechanical verification of concurrent programs. It is however a hard task because this set of states typically grows exponentially in the number of automata involved. We present a new approach that yields interesting experimental results, both an memory requirements and computation times. It uses a new data structure, the sharing tree, which allows to store large sets of states in a compact way. Moreover, we have designed algorithms that use global operations and caching on the data structure itself. >

D. Zampunieris

Papers

Distributed audit trail analysis

Efficient handling of large sets of tuples with sharing trees

An efficient algorithm to compute the synchronized product