The Experts below are selected from a list of 5862 Experts worldwide ranked by ideXlab platform
Ethan L. Miller - One of the best experts on this subject based on the ideXlab platform.
-
long term File Activity and inter reference patterns
1998Co-Authors: Dde Long, Ethan L. Miller, L T GibsonAbstract:Author(s): Long, DDE; Miller, EL; Gibson, LT | Abstract: We compare and contract long-term File System Activity for different Unix environments for periods of 120 to 280 days. Our focus is on finding common long-term Activity trends and reference patterns. Our analysis shows that 90% of all Files are not used after initial creation, those that are used are normally short-lived, and that if a File is not used in some manner the day after it is created, it will probably never be used. Additionally, we find approximately 1% of all Files are used daily. This information allows us to more accurately predict the Files which are never used. These Files can be compressed or moved to tertiary storage enabling either more users per disk or larger user disk quotas.
-
long term File Activity patterns in a unix workstation environment
IEEE Conference on Mass Storage Systems and Technologies, 1998Co-Authors: Timothy J. Gibson, Ethan L. MillerAbstract:As mass storage technology becomes more affordable for sites smaller than supercomputer centers, understanding their File access patterns becomes crucial for developing Systems to store rarely used data on tertiary storage devices such as tapes and optical disks. This paper presents a new way to collect and analyze File System statistics for UNIX-based File Systems. The collection System runs in user-space and requires no modification of the operating System kernel. The statistics package provides details about File System operations at the File level: creations, deletions, modifications, etc. The paper analyzes four months of File System Activity on a university File System. The results confirm previously published results gathered from supercomputer File Systems, but differ in several important areas. Files in this study were considerably smaller than those at supercomputer centers, and they were accessed less frequently. Additionally, the long-term creation rate on workstation File Systems is sufficiently low so that all data more than a day old could be cheaply saved on a mass storage device, allowing the integration of time travel into every File System.
-
Long-term unix File System Activity and the efficacy of automatic File migration
1998Co-Authors: Timothy J. Gibson, Ethan L. MillerAbstract:This dissertation studies long-term File System Activity in order to develop new migration algorithms for tertiary storage Systems (e.g., tape robots). To enable this study, I collected File traces from four different computing facilities and analyzed File Activity patterns in the areas of size, usage, access, creation, deletion, and modification rates and patterns, inter-reference periods, and lifetimes. My File Activity results include: most Files are never used, accesses dominate File Activity, Files which are modified grow or shrink very little, File Activity has reference locality, and there are significant differences between how the Unix operating System deals with Files and what users perceive the operating System does with their Files (i.e., the Unix operating System's numeric index versus the hierarchical name space used by people). I also analyzed the collected data for self-similar behavior, and was able to show that File System traffic is self-similar, or fractal. This has profound implications for computer simulations and modeling because normal simulation assumptions (i.e., Poisson models with finite variance arrival rates) are invalid for self-similar traffic. Thus, most existing File System simulators and models are probably inaccurate. Finally, I developed a new migration algorithm that is an order of magnitude more effective than any existing migration algorithm when measured using on-disk misses. Other measures of effectiveness, such as number of Files and bytes move to tertiary storage, and the number of forced mid-day migrations are also improved.
Timothy J. Gibson - One of the best experts on this subject based on the ideXlab platform.
-
long term File Activity patterns in a unix workstation environment
IEEE Conference on Mass Storage Systems and Technologies, 1998Co-Authors: Timothy J. Gibson, Ethan L. MillerAbstract:As mass storage technology becomes more affordable for sites smaller than supercomputer centers, understanding their File access patterns becomes crucial for developing Systems to store rarely used data on tertiary storage devices such as tapes and optical disks. This paper presents a new way to collect and analyze File System statistics for UNIX-based File Systems. The collection System runs in user-space and requires no modification of the operating System kernel. The statistics package provides details about File System operations at the File level: creations, deletions, modifications, etc. The paper analyzes four months of File System Activity on a university File System. The results confirm previously published results gathered from supercomputer File Systems, but differ in several important areas. Files in this study were considerably smaller than those at supercomputer centers, and they were accessed less frequently. Additionally, the long-term creation rate on workstation File Systems is sufficiently low so that all data more than a day old could be cheaply saved on a mass storage device, allowing the integration of time travel into every File System.
-
Long-term unix File System Activity and the efficacy of automatic File migration
1998Co-Authors: Timothy J. Gibson, Ethan L. MillerAbstract:This dissertation studies long-term File System Activity in order to develop new migration algorithms for tertiary storage Systems (e.g., tape robots). To enable this study, I collected File traces from four different computing facilities and analyzed File Activity patterns in the areas of size, usage, access, creation, deletion, and modification rates and patterns, inter-reference periods, and lifetimes. My File Activity results include: most Files are never used, accesses dominate File Activity, Files which are modified grow or shrink very little, File Activity has reference locality, and there are significant differences between how the Unix operating System deals with Files and what users perceive the operating System does with their Files (i.e., the Unix operating System's numeric index versus the hierarchical name space used by people). I also analyzed the collected data for self-similar behavior, and was able to show that File System traffic is self-similar, or fractal. This has profound implications for computer simulations and modeling because normal simulation assumptions (i.e., Poisson models with finite variance arrival rates) are invalid for self-similar traffic. Thus, most existing File System simulators and models are probably inaccurate. Finally, I developed a new migration algorithm that is an order of magnitude more effective than any existing migration algorithm when measured using on-disk misses. Other measures of effectiveness, such as number of Files and bytes move to tertiary storage, and the number of forced mid-day migrations are also improved.
L T Gibson - One of the best experts on this subject based on the ideXlab platform.
-
long term File Activity and inter reference patterns
1998Co-Authors: Dde Long, Ethan L. Miller, L T GibsonAbstract:Author(s): Long, DDE; Miller, EL; Gibson, LT | Abstract: We compare and contract long-term File System Activity for different Unix environments for periods of 120 to 280 days. Our focus is on finding common long-term Activity trends and reference patterns. Our analysis shows that 90% of all Files are not used after initial creation, those that are used are normally short-lived, and that if a File is not used in some manner the day after it is created, it will probably never be used. Additionally, we find approximately 1% of all Files are used daily. This information allows us to more accurately predict the Files which are never used. These Files can be compressed or moved to tertiary storage enabling either more users per disk or larger user disk quotas.
Akay Meltem - One of the best experts on this subject based on the ideXlab platform.
-
Detecting cryptographic ransomware by examining File System Activity
2019Co-Authors: Akay MeltemAbstract:Cryptographic ransomware, which locks a victim’s files and demands payment to reestablish access, is one of the most dangerous and popular cyber crimes of today as it gives attackers a golden opportunity to extort money. Although many different approaches are presented to detect and prevent this troublesome malware, recent research suggests that none of these approaches are flawless and they can be bypassed. In this thesis, we propose CryptoCop, a protection System that stops a ransomware attack in the early stages. The defense mechanism limits the applications’ capability of executing file write functions, which is excessively performed by a typical ransomware. We define an adaptive threshold mechanism for file write requests of each running process, which facilitates benign file System operations while terminating the malicious Activity. The results of experiments show that CryptoCop is able to stop 706 out of 736 (⇠96%) ransomware samples with minimal loss of files – less than 5 – and a negligible performance overhead.Declaration of Authorship ii Abstract iii Öz iv Acknowledgments v List of Figures viii List of Tables ix List of Listings x Abbreviations xi 1 Introduction 1 1.1 Problem Definition ............................... 2 1.2 Methodology .................................. 2 1.3 Organization .................................. 3 2 Background 4 2.1 Classification of Ransomware ......................... 4 2.2 The Evolution Process ............................. 5 3 Related Work 8 3.1 Practical Limitations of Backup Strategies .................. 8 3.2 Literature Review ................................ 8 4 CryptoCop Design 11 4.1 Design Principles ................................ 11 4.2 Security Model and Assumptions ....................... 14 4.3 Architecture ................................... 14 4.3.1 Controlling File Write API ...................... 14 4.3.2 Malice Score Computation ....................... 14 4.3.2.1 Determining Security Threshold .............. 15 5 Evaluation Process 16 5.1 CryptoCop Implementation ......................... 16 5.1.1 Intercepting WriteFile API Calls ................... 16 5.1.2 Maintaining Malice Score ....................... 17 5.1.3 Malicious Process Termination .................... 18 5.2 Test Environment ................................ 18 5.2.1 Hardening Windows 7 x86 on VirtualBox .............. 19 5.2.2 Making Virtual Machine Vulnerable ................. 20 5.2.3 Network Configuration ......................... 22 5.3 Cuckoo Sandbox ................................ 23 5.3.1 VM Snapshots ............................. 23 5.3.2 Configuration .............................. 23 5.3.3 Customization ............................. 24 5.3.4 Analysis ................................. 24 5.4 Experiments ................................... 24 5.4.1 Building the Ground Truth Set .................... 25 5.4.2 Assessment of CryptoCop Efficiency ................ 26 5.5 Tools Used In the Experiments ........................ 26 6 Results 28 6.1 Experimental Results .............................. 28 6.1.1 Detection Capability .......................... 28 6.1.2 Usability Tests ............................. 29 6.1.3 Performance Overhead ......................... 31 7 Discussion 33 7.1 Comparison with the Other Anti-Ransomware Systems ........... 33 7.2 Limitations ................................... 34 8 Conclusion 38 A Report of a Bitman Sample 40 B Active Ransomware Samples 42 Bibliography 5
Dde Long - One of the best experts on this subject based on the ideXlab platform.
-
long term File Activity and inter reference patterns
1998Co-Authors: Dde Long, Ethan L. Miller, L T GibsonAbstract:Author(s): Long, DDE; Miller, EL; Gibson, LT | Abstract: We compare and contract long-term File System Activity for different Unix environments for periods of 120 to 280 days. Our focus is on finding common long-term Activity trends and reference patterns. Our analysis shows that 90% of all Files are not used after initial creation, those that are used are normally short-lived, and that if a File is not used in some manner the day after it is created, it will probably never be used. Additionally, we find approximately 1% of all Files are used daily. This information allows us to more accurately predict the Files which are never used. These Files can be compressed or moved to tertiary storage enabling either more users per disk or larger user disk quotas.