Find results with:

Add another field

Search by date

to

Searching collections:

Dartmouth Dissertations

Add or remove collections

Home Dartmouth Dissertations Page 1

Reference URL

To link to the entire object, paste this link in email, IM or document

To embed the entire object, paste this HTML in website

To link to this page, paste this link in email, IM or document

To embed this page, paste this HTML in website

Automated forensic techniques for locating zero-day exploits / by Stephen Kuhn.

you wish to report:

Your comment:

Your Name:

Submit

Cancel

...

Back to top

Powered by CONTENTdm®

Author	Kuhn, Stephen (Stephen J.)
Title	Automated forensic techniques for locating zero-day exploits / by Stephen Kuhn.
Date	2013
Abstract	This thesis approaches the problem of locating zero-day exploits used in network attacks. The hypothesis is that the advent of high-performance virtualization presents a unique opportunity to both discover these events and increase the attacker's workload. Much of the traffic in modern computer networks is conducted between clients and servers, rather than client-to-client. As a result, servers represent a high-value target for collection and analysis of network traffic. The observe, orient, decide, and act (OODA) loop for computer network attack involves surveillance, to determine if a vulnerability is present, selection of an appropriate exploit, use of the exploit to gain access, and persistence for a time sufficient enough to carry out some effect. The time spent in surveillance and persistence may range from seconds to months depending upon the intent of the attacker. In contrast, exploitation of the system can occur in milliseconds. The difficultly in generating a suitable exploit and its potential for reuse, dictates that an attacker's first on-host action is likely to be the removal of any on-host trace associated with the exploit. Therefore, the first notice that an intrusion has occurred may well be several months later when an effect is eventually perpetrated. The intervening period is populated by terabytes of network traffic, reboots, upgrades, and changes of operating system state obfuscating the analysis after the fact. This thesis approaches the problem of locating the initial exploit through a novel coarse-grained forensics technique facilitated by virtualization. This new capability simultaneously increases the attacker's workload associated with conducting surveillance and maintaining persistence on host systems. In addition, it provides mechanisms to identify network traffic corresponding with the initial intrusion and any subsequent communication within the operating system and within the network. These goals are accomplished by enhancing non-determinism in operating systems: utilizing a hy
Description	xi, 136 leaves : ill. (mostly col.) 28 cm.
Format	application/pdf
Advisor	Stephen Taylor, Eugene Santos, George Cybenko, Sarah Muccio
College	Thayer School of Engineering.
Issuing Body	Dartmouth Dissertations are made available through the Dartmouth Digital Library.
Degree	Thesis (Ph.D.)--Dartmouth College.
Copyright	All rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means without permission in writing from the author.
DOI	http://dx.doi.org/10.1349/ddlp.980

Find results with:

Searching collections:

Home Dartmouth Dissertations Page 1

Automated forensic techniques for locating zero-day exploits / by Stephen Kuhn.

Object Description

Description

Automated forensic techniques for locating zero-day...

Automated forensic techniques for locating zero-day...

	All
	Pages Enter page numbers or page ranges separated by commas. For example: 1,3,5-12