Information Security Commons^™

Large-Scale File Fragment Classification Via Multi-View Learning, Samuel Hildebrand

LSU Master's Theses

File reassembly is one of the most fundamental tasks in digital forensics, enabling recovery of data from potentially damaged storage media even when file system metadata is unavailable. This thesis reviews more than two decades of work in the realm of file carving, with a particular focus on fragmented file carving, which remains a focus of research, and file fragment classification, a principal component of fragmented file carving. This thesis serves a literature review of both file carving and fragmented file carving, surveys the massive amounts of data needed for the task of fragment classification and the datasets that serve …

Design Of Long-Distance Entanglement Distribution Protocols For Quantum Networks, Stav Haldar

LSU Doctoral Dissertations

Future quantum technologies such as quantum communication, quantum sensing, and distributed quantum computation, will rely on networks of shared entanglement between spatially separated nodes. Distributing entanglement between these nodes, especially over long distances, currently remains a challenge, due to limitations resulting from the fragility of quantum systems, such as photon losses, non-ideal measurements, and quantum memories with short coherence times. In the absence of full-scale fault-tolerant quantum error correction, which can in principle overcome these limitations, we should understand the extent to which we can circumvent these limitations. In this work, we provide improved protocols and policies for entanglement distribution …

An Analysis And Ontology Of Teaching Methods In Cybersecurity Education, Sarah Buckley

LSU Master's Theses

The growing cybersecurity workforce gap underscores the urgent need to address deficiencies in cybersecurity education: the current education system is not producing competent cybersecurity professionals, and current efforts are not informing the non-technical general public of basic cybersecurity practices. We argue that this gap is compounded by a fundamental disconnect between cybersecurity education literature and established education theory. Our research addresses this issue by examining the alignment of cybersecurity education literature concerning educational methods and tools with education literature.

In our research, we endeavor to bridge this gap by critically analyzing the alignment of cybersecurity education literature with education theory. …

Evaluating Attack Surface Management In An Industrial Control System (Ics) Environment: Leveraging A Recon Ftw For Threat Classification And Incident Response, Nathalia De Sa Soares

LSU Master's Theses

Protecting Industrial Control Systems (ICS) from cyber threats is paramount to
ensure the reliability and security of critical infrastructure. Organizations must proactively identify vulnerabilities and strengthen their incident response capabilities as attack vectors evolve. This research explores implementing an Attack Surface Management (ASM) approach, utilizing Recon FTW, to assess an operating ICS environment’s security posture comprehensively.
The primary objective of this research is to develop a tool for performing recon-
naissance in an ICS environment with a non-intrusive approach, enabling the realistic simulation of potential threat scenarios and the identification of critical areas requiring immediate attention and remediation. We aim …

Finding Forensic Evidence In The Operating System's Graphical User Interface, Edward X. Wilson Mr.

LSU Master's Theses

A branch of cyber security known as memory forensics focuses on extracting meaningful evidence from system memory. This analysis is often referred to as volatile memory analysis, and is generally performed on memory captures acquired from target systems. Inside of a memory capture is the complete state of a system under investigation, including the contents of currently running as well as previously executed applications. Analysis of this data can reveal a significant amount of activity that occurred on a system since the last reboot. For this research, the Windows operating system is targeted. In particular, the graphical user interface component …

Improving Kernel Artifact Extraction In Linux Memory Samples Using The Slub Allocator, Daniel A. Donze

LSU Master's Theses

Memory forensics allows an investigator to analyze the volatile memory (RAM) of a computer, providing a view into the system state of the machine as it was running. Examples of items found in memory samples that are of interest to investigators are kernel data structures which can represent processes, files, and sockets. The SLUB allocator is the default small-request memory allocator for modern Linux systems. SLUB allocates “slabs”, which are contiguous sections of pre-allocated memory that are used to efficiently service allocation requests. The predecessor to SLUB, the SLAB allocator, tracked every slab it allocated, allowing extraction of allocated slabs …

Malware And Memory Forensics On M1 Macs, Charles E. Glass

LSU Master's Theses

As malware continues to evolve, infection mechanisms that can only be seen in memory are increasingly commonplace. These techniques evade traditional forensic analysis, requiring the use of memory forensics. Memory forensics allows for the recovery of historical data created by running malware, including information that it tries to hide. Memory analysis capabilities have lagged behind on Apple's new M1 architecture while the number of malicious programs only grows. To make matters worse, Apple has developed Rosetta 2, the translation layer for running x86_64 binaries on an M1 Mac. As a result, all malware compiled for Intel Macs is theoretically functional …

Improving Memory Forensics Capabilities On Apple M1 Computers, Raphaela Santos Mettig Rocha

LSU Master's Theses

Malware threats are rapidly evolving to use more sophisticated attacks. By abusing rich application APIs such as Objective-C’s, they are able to gather information about user activity, launch background processes without the user’s knowledge as well as perform other malicious activities. In some cases, memory forensics is the only way to recover artifacts related to this malicious activity, as is the case with memory-only execution. The introduction of the Rosetta 2 on the Apple M1 introduces a completely new attack surface by allowing binaries of both Intel x86 64 and ARM64 architecture to run in userland. For this reason it …

Performing Memory Forensics For Object Recovery From Android Application Memory, Sneha Sudhakaran

LSU Doctoral Dissertations

The analysis of application-specific behavior has become an increasingly important technique in cyber forensics and incident response. The ability to determine the precise actions taken by a user can be the difference between a successful analysis and one that fails to meet its goals. The precise actions includes URLs visited, files downloaded, messages sent and received, images viewed, and data accessed. Evidence extraction from application memory at runtime is an effective solution to successfully extract valuable objects allocated by each application, and it is evident that there is a need for more Android forensics analysis tools that support recovering evidence …

Using Memory Forensics To Analyze Programming Language Runtimes, Modhuparna Manna

LSU Doctoral Dissertations

The continued increase in the use of computer systems in recent times has led to a significant rise in the capabilities of malware and attacker toolkits that target different operating systems and their users. Over the last several years, cybersecurity threat reports have documented numerous instances of users that were targeted by governments, intelligence agencies, and criminal groups, and the result was that the victims ended up having highly sophisticated malware installed on their systems. Unfortunately, the rise of these threats has not been met with equal research and development of defensive mechanisms that can detect and analyze such malware. …

Memory Forensics Comparison Of Apple M1 And Intel Architecture Using Volatility Framework, Joshua Duke

LSU Master's Theses

Memory forensics allows an investigator to get a full picture of what is occurring on-device at the time that a memory sample is captured and is frequently used to detect and analyze malware. Malicious attacks have evolved from living on disk to having persistence mechanisms in the volatile memory (RAM) of a device and the information that is captured in memory samples contains crucial information for full forensic analysis by cybersecurity professionals. Recently, Apple unveiled computers containing a custom designed system on a chip (SoC) called the M1 that is based on ARM architecture. Our research focused on the differences …

Improving Memory Forensics Through Emulation And Program Analysis, Ryan Dominick Maggio

LSU Doctoral Dissertations

Memory forensics is an important tool in the hands of investigators. However, determining if a computer is infected with malicious software is time consuming, even for experts. Tasks that require manual reverse engineering of code or data structures create a significant bottleneck in the investigative workflow. Through the application of emulation software and symbolic execution, these strains have been greatly lessened, allowing for faster and more thorough investigation. Furthermore, these efforts have reduced the barrier for forensic investigation, so that reasonable conclusions can be drawn even by non-expert investigators. While previously Volatility had allowed for the detection of malicious hooks …

Automated Extraction Of Network Activity From Memory Resident Code, Austin Nicholas Sellers

LSU Master's Theses

Advancements in malware development, including the use of file-less and memory-only payloads, have led to a significant interest in the use of volatile memory analysis by digital forensics practitioners. Memory analysis can uncover a wealth of information not available via traditional analysis, such as the discovery of injected code, hooked APIs, and more. Unfortunately, the process of analyzing such malicious code is largely left to analysts who must manually reverse engineer the code to discover its intent. This task is not only slow and error-prone, but is also generally left only to senior-level analysts to perform, given that significant reverse …

Bipartite Quantum Interactions: Entangling And Information Processing Abilities, Siddhartha Das

LSU Doctoral Dissertations

The aim of this thesis is to advance the theory behind quantum information processing tasks, by deriving fundamental limits on bipartite quantum interactions and dynamics. A bipartite quantum interaction corresponds to an underlying Hamiltonian that governs the physical transformation of a two-body open quantum system. Under such an interaction, the physical transformation of a bipartite quantum system is considered in the presence of a bath, which may be inaccessible to an observer. The goal is to determine entangling abilities of such arbitrary bipartite quantum interactions. Doing so provides fundamental limitations on information processing tasks, including entanglement distillation and secret key …

Entropic Bounds On Two-Way Assisted Secret-Key Agreement Capacities Of Quantum Channels, Noah Anthony Davis

LSU Doctoral Dissertations

In order to efficiently put quantum technologies into action, we must know the characteristics of the underlying quantum systems and effects. An interesting example is the use of the secret-key-agreement capacity of a quantum channel as a guide and measure for the implementation of quantum key distribution (QKD) and distributed quantum computation. We define the communication task of establishing a secret key over a quantum channel subject to an energy constraint on the input state and while allowing for unlimited local operations and classical communication (LOCC) between a sender and receiver. We then use the energy-constrained squashed entanglement to bound …

Information Theoretic Study Of Gaussian Graphical Models And Their Applications, Ali Moharrer

LSU Doctoral Dissertations

In many problems we are dealing with characterizing a behavior of a complex stochastic system or its response to a set of particular inputs. Such problems span over several topics such as machine learning, complex networks, e.g., social or communication networks; biology, etc. Probabilistic graphical models (PGMs) are powerful tools that offer a compact modeling of complex systems. They are designed to capture the random behavior, i.e., the joint distribution of the system to the best possible accuracy. Our goal is to study certain algebraic and topological properties of a special class of graphical models, known as Gaussian graphs. First, …