OS and Networks Commons^™

Large-Scale File Fragment Classification Via Multi-View Learning, Samuel Hildebrand

LSU Master's Theses

File reassembly is one of the most fundamental tasks in digital forensics, enabling recovery of data from potentially damaged storage media even when file system metadata is unavailable. This thesis reviews more than two decades of work in the realm of file carving, with a particular focus on fragmented file carving, which remains a focus of research, and file fragment classification, a principal component of fragmented file carving. This thesis serves a literature review of both file carving and fragmented file carving, surveys the massive amounts of data needed for the task of fragment classification and the datasets that serve …

From Network Packets To Physical Consequences: Network-Level Spoofing And Loss Of Visibility In Industrial Control Systems, Lillian B. Beck

LSU Master's Theses

Industrial Control Systems (ICS) are the foundation of critical infrastructure as they provide resources like clean water, electricity, and natural gas to support our everyday functions. Given their essential role in modern society, the failure or compromise of ICS systems can lead to significant negative consequences and public safety impacts. Understanding how these systems can be targeted and exploited by malicious actors is necessary to improve their security and resilience.

This research examines how an attacker could manipulate a real-world ICS network by targeting a fully functional Natural Gas (NG) Compressor Station Platform that emulates real operations. This research led …

Finding Forensic Evidence In The Operating System's Graphical User Interface, Edward X. Wilson Mr.

LSU Master's Theses

A branch of cyber security known as memory forensics focuses on extracting meaningful evidence from system memory. This analysis is often referred to as volatile memory analysis, and is generally performed on memory captures acquired from target systems. Inside of a memory capture is the complete state of a system under investigation, including the contents of currently running as well as previously executed applications. Analysis of this data can reveal a significant amount of activity that occurred on a system since the last reboot. For this research, the Windows operating system is targeted. In particular, the graphical user interface component …

Malware And Memory Forensics On M1 Macs, Charles E. Glass

LSU Master's Theses

As malware continues to evolve, infection mechanisms that can only be seen in memory are increasingly commonplace. These techniques evade traditional forensic analysis, requiring the use of memory forensics. Memory forensics allows for the recovery of historical data created by running malware, including information that it tries to hide. Memory analysis capabilities have lagged behind on Apple's new M1 architecture while the number of malicious programs only grows. To make matters worse, Apple has developed Rosetta 2, the translation layer for running x86_64 binaries on an M1 Mac. As a result, all malware compiled for Intel Macs is theoretically functional …

Improving Memory Forensics Capabilities On Apple M1 Computers, Raphaela Santos Mettig Rocha

LSU Master's Theses

Malware threats are rapidly evolving to use more sophisticated attacks. By abusing rich application APIs such as Objective-C’s, they are able to gather information about user activity, launch background processes without the user’s knowledge as well as perform other malicious activities. In some cases, memory forensics is the only way to recover artifacts related to this malicious activity, as is the case with memory-only execution. The introduction of the Rosetta 2 on the Apple M1 introduces a completely new attack surface by allowing binaries of both Intel x86 64 and ARM64 architecture to run in userland. For this reason it …

System Design And Optimization For Efficient Flash-Based Caching In Data Centers, Jian Liu

LSU Doctoral Dissertations

Modern data centers are the backbone of today’s Internet-based services and applications. With the explosive growth of the Internet data and a wider range of data-intensive applications being deployed, it is increasingly challenging for data centers to satisfy the ever-increasing demand for high-quality data services. To relieve the heavy burden on data center systems and accelerate data processing, a popular cost-efficient solution is to deploy high-speed, large-capacity flash-based cache systems. However, we are facing multiple critical challenges from device hardware, systems, to application workloads. In this dissertation, we focus on designing highly efficient caching solutions to cope with the explosive …

Characterizing And Optimizing Asynchronous Event-Driven Architecture For Modern Cloud Systems, Shungeng Zhang

LSU Doctoral Dissertations

Achieving good performance and high efficiency simultaneously is an essential requirement for emerging modern cloud systems such as e-commerce due to their business impact. For example, Akamai reported that every 100ms delay in website load time could lead to a 6% drop in sales. Unfortunately, achieving good performance (e.g., low latency) for modern cloud systems at high resource utilization is significantly challenging. Despite continuing efforts by cloud professionals, however, they have consistently experienced performance degradation problems (e.g., the long-tail latency problem) due to the bursty workload in the cloud. To resolve the performance degradation problems, many previous research efforts have …

Automated Extraction Of Network Activity From Memory Resident Code, Austin Nicholas Sellers

LSU Master's Theses

Advancements in malware development, including the use of file-less and memory-only payloads, have led to a significant interest in the use of volatile memory analysis by digital forensics practitioners. Memory analysis can uncover a wealth of information not available via traditional analysis, such as the discovery of injected code, hooked APIs, and more. Unfortunately, the process of analyzing such malicious code is largely left to analysts who must manually reverse engineer the code to discover its intent. This task is not only slow and error-prone, but is also generally left only to senior-level analysts to perform, given that significant reverse …