Intrusion Analysis

14,000,000 Leading Edge Experts on the ideXlab platform

Scan Science and Technology

Contact Leading Edge Experts & Companies

Scan Science and Technology

Contact Leading Edge Experts & Companies

The Experts below are selected from a list of 34824 Experts worldwide ranked by ideXlab platform

Marc W Howard - One of the best experts on this subject based on the ideXlab platform.

  • effects of age on contextually mediated associations in paired associate learning
    Psychology and Aging, 2007
    Co-Authors: Jennifer P Provyn, Martin J Sliwinski, Marc W Howard
    Abstract:

    Older and younger participants learned single-function lists of paired associates with no contextual overlap (e.g., J-K, L-M) and double-function lists of paired associates consisting of chains of pairs (e.g., A-B, B-C). Although younger adults out-performed older adults on both pair types, there was a robust pair-type by age interaction. Evidence from Intrusion analyses argues that older adults performed better than would be expected on the contextually overlapping double-function pairs because they were less subject to response competition for the double-function pairs. Younger adults made a larger proportion of backward and remote Intrusions to double-function probes than did older adults. Thus, group differences in both correct recall probabilities and Intrusion Analysis suggest that backward and transitive associations are sensitive to aging. The results are discussed within the theoretical framework of the temporal context model and the hypothesis that older adults are impaired at forming new item-context associations.

Jennifer P Provyn - One of the best experts on this subject based on the ideXlab platform.

  • effects of age on contextually mediated associations in paired associate learning
    Psychology and Aging, 2007
    Co-Authors: Jennifer P Provyn, Martin J Sliwinski, Marc W Howard
    Abstract:

    Older and younger participants learned single-function lists of paired associates with no contextual overlap (e.g., J-K, L-M) and double-function lists of paired associates consisting of chains of pairs (e.g., A-B, B-C). Although younger adults out-performed older adults on both pair types, there was a robust pair-type by age interaction. Evidence from Intrusion analyses argues that older adults performed better than would be expected on the contextually overlapping double-function pairs because they were less subject to response competition for the double-function pairs. Younger adults made a larger proportion of backward and remote Intrusions to double-function probes than did older adults. Thus, group differences in both correct recall probabilities and Intrusion Analysis suggest that backward and transitive associations are sensitive to aging. The results are discussed within the theoretical framework of the temporal context model and the hypothesis that older adults are impaired at forming new item-context associations.

Martin J Sliwinski - One of the best experts on this subject based on the ideXlab platform.

  • effects of age on contextually mediated associations in paired associate learning
    Psychology and Aging, 2007
    Co-Authors: Jennifer P Provyn, Martin J Sliwinski, Marc W Howard
    Abstract:

    Older and younger participants learned single-function lists of paired associates with no contextual overlap (e.g., J-K, L-M) and double-function lists of paired associates consisting of chains of pairs (e.g., A-B, B-C). Although younger adults out-performed older adults on both pair types, there was a robust pair-type by age interaction. Evidence from Intrusion analyses argues that older adults performed better than would be expected on the contextually overlapping double-function pairs because they were less subject to response competition for the double-function pairs. Younger adults made a larger proportion of backward and remote Intrusions to double-function probes than did older adults. Thus, group differences in both correct recall probabilities and Intrusion Analysis suggest that backward and transitive associations are sensitive to aging. The results are discussed within the theoretical framework of the temporal context model and the hypothesis that older adults are impaired at forming new item-context associations.

George W Dunlap - One of the best experts on this subject based on the ideXlab platform.

  • execution replay for Intrusion Analysis
    2006
    Co-Authors: Peter M Chen, George W Dunlap
    Abstract:

    Computer Intrusions are inevitable. When an Intrusion happens, forensic Analysis is critical to understanding the attack. An administrator needs to determine how the attacker broke in, what he changed, and what privileged information he may have seen. Unfortunately, current security logging systems are incomplete, leaving large gaps in the knowledge of what happened. Execution replay is a practical way to add completeness to forensic logging. To show this, we describe ReVirt, a virtual machine execution replay system capable of security-grade logging. ReVirt can reconstruct the entire past state of the system at any point in time, including memory and disk, and can re-execute. This enables security tools that use ReVirt to gather arbitrarily detailed information about the system before, during, and after an attack. ReVirt adds 0-12% runtime overhead during logging. A single 100 GB disk can log continuously from weeks to years. We also describe SMP-ReVirt, an execution replay system that can log and replay multiprocessor virtual machines. Races between the processors are detected using a concurrent-read, exclusive-write (CREW) protocol enforced with hardware page protections transparently to the virtual machine. This is the first execution replay system to log and replay a multiprocessor kernel outside of simulation. Performance depends heavily on the sharing rate of the workload. Some parallel applications run with overhead around 1%, while some run an order of magnitude slower with the logging enabled. Logging rates depend upon sharing rates. A 300GB disk can log workloads with low sharing rates for several years, and can even log workloads with very high sharing rates for several days.

  • revirt enabling Intrusion Analysis through virtual machine logging and replay
    Operating Systems Design and Implementation, 2002
    Co-Authors: George W Dunlap, Samuel T King, Sukru Cinar, Murtaza A Basrai, Peter M Chen
    Abstract:

    Current system loggers have two problems: they depend on the integrity of the operating system being logged, and they do not save sufficient information to replay and analyze attacks that include any non-deterministic events. ReVirt removes the dependency on the target operating system by moving it into a virtual machine and logging below the virtual machine. This allows ReVirt to replay the system's execution before, during, and after an intruder compromises the system, even if the intruder replaces the target operating system. ReVirt logs enough information to replay a long-term execution of the virtual machine instruction-by-instruction. This enables it to provide arbitrarily detailed observations about what transpired on the system, even in the presence of non-deterministic attacks and executions. ReVirt adds reasonable time and space overhead. Overheads due to virtualization are imperceptible for interactive use and CPU-bound workloads, and 13--58% for kernel-intensive workloads. Logging adds 0--8% overhead, and logging traffic for our workloads can be stored on a single disk for several months.

David L. - One of the best experts on this subject based on the ideXlab platform.

  • Using a systems-theoretic approach to analyze cyber attacks on cyber-physical systems
    Massachusetts Institute of Technology, 2017
    Co-Authors: David L.
    Abstract:

    Thesis: S.M. in Engineering and Management, Massachusetts Institute of Technology, School of Engineering, System Design and Management Program, 2017.Cataloged from PDF version of thesis.Includes bibliographical references (pages 113-118).With increased Internet connectivity and the advent of the industrial Internet, cyber-physical systems are increasingly being targeted by cyber attacks. Unlike, cyber attacks on IT networks, successfully compromising a cyber-physical environment takes considerably more time, motivation, expertise, and operational costs to the adversary. This thesis explores how a systems-theoretic approach, the Systems-Theoretic Accident Model and Processes (STAMP), can be used by an organization to complement intelligence-driven models of Intrusion Analysis to provide both additional insight and prioritize defensive countermeasures in order to guard against cyber-physical attacks and compromises. Specifically, in this thesis we analyze two real-world use cases of well publicized cyber-physical attacks using traditional intelligence-driven models of Intrusion Analysis as well as apply the Causal Analysis based on STAMP (CAST) model on one of the use cases. The STAMP/CAST based Analysis afforded us deeper insights into the system causal factors that led to the successful compromise. In turn, this allowed for the generation of specific recommendations to safeguard the cyber-physical systems within the network in order to increase the overall organizational security posture. This included a recommendation to modify the existing organizational structure (i.e., the addition of a Security Operations Centre function) such that clearly defined security roles and responsibilities could be effectively implemented thus significantly improving an organization's ability to respond to cyber attacks.by David Whyte.S.M. in Engineering and Managemen