Technical reports / Department Informatik
ISSN 2191-5008
Refine
Year of publication
Document Type
- Report (53)
- Working Paper (4)
- Conference Proceeding (2)
- Habilitation (1)
Language
- English (47)
- German (12)
- Multiple languages (1)
Has Fulltext
- yes (60)
Keywords
- - (3)
- Computerforensik (3)
- Digital forensics (3)
- Malware (3)
- Android <Systemplattform> (2)
- Betriebssystem (2)
- Cluster computing (2)
- Dateisystem (2)
- Elektronische Patientenakte (2)
- Empirische Studie (2)
CS-2023-03
Executing system calls requires switching the privilege level when entering the kernel. This switch is considered essential to secure the operating system from unwanted access but is also costly. In other contexts, on-demand rather than proactive action allows paying overhead costs only when necessary. For example, non-blocking synchronization forgoes proactive locking in favor of retries if a conflict occurs.
We propose that single-address-space operating systems allow for an on-demand approach for system calls. When the operating-system data is hidden by the sheer size of the address space, elevated privileges are only necessary when performing privileged hardware operations. We believe that single-address-space systems would benefit from such an on-demand approach.
We introduce a concept which allows to defer the privilege-level switch until it is actually needed, that is when the first privileged instruction is encountered. We present a prototype implementation of the concept as an adaption of the Linux kernel as a widespread single-address-space kernel does not exist.
CS-2023-01
Classical core memory was entirely non-
volatile and could keep at least part of the operating
system (OS) in main memory even across power cycles.
These days we can have terabytes of NVRAM to repeat
this approach, albeit on an entirely different scale and
with large parts of the OS state still kept in the volatile
CPU caches. In this paper, we discuss our experiences of
running large modern operating systems including their
applications entirely in NVRAM. We adapted stock Linux
and FreeBSD kernels to work exclusively with NVRAM by
hiding all DRAM from the kernels at boot time to establish
a realistic performance baseline without changing anything
else. Following this entirely NVRAM-agnostic approach,
we could observe an effective performance penalty of
a factor of about four, but only negligible increases in
whole-system power draw. For our system with two CPU
sockets and 56 cores total, we also observed a reduction
in power draw in several scenarios. Due to prolonged
execution times, the energy consumption increased as
well for these measured workloads. While this might be
discouraging at first sight, this result was achieved without
any performance tuning as to the specific characteristics
of today’s NVRAM technology. Therefore, we are also
discussing means to mitigate the observed shortcomings
by integrating NVRAM appropriately into the memory
hierarchy of future robust persistent systems.
CS-2022-01
Due to their ease of use and their reliability, managed storage services "in the cloud" have become a standard way to store personal files for many users. In fact, many apps on mobile devices use local storage on the client merely as a cache for data that is fully stored on a remote server. Consequently, data from cloud storage services is an increasingly valuable source of digital evidence in forensic investigations. This document presents the results of a student project that was performed at Friedrich-Alexander-Universität Erlangen-Nürnberg in the winter term 2021/22. Six groups of students analyzed the most relevant network storage technologies (Samba, Nextcloud, Dropbox, Google Drive, OneDrive, iCloud) regarding two questions: (1) What effect does data acquisition by the client have on the data stored on the server? (2) Does the technology support delayed verification of data acquisition in any way? The two questions refer to critical aspects of forensic evidence collection, namely in what way does evidence collection interfere with the evidence, and how easy is it to prove the provenance of data in a forensic investigation. In the concluding discussion we compare the different technologies and develop a taxonomy of storage services that can be used to assess other cloud storage services with regarding the evidental value of data acquired from them.
CS-2021-02
Writing well-maintainable parallel programs
that efficiently utilize many processor cores is still a
significant challenge. Threads are hard to use, and so are
event-based schemes. Furthermore, threads are affected by
the blocking anomaly, that is, the loss of parallelism when
threads execute a blocking system call—often resulting
in low core utilization and unnecessarily high response
times. This paper introduces pseudo-blocking system calls
built upon modern asynchronous queue-based system-call
techniques (like Linux’s io_uring) circumventing the
blocking anomaly. They are similar to Go’s programming
model, where one develops against a blocking interface to
keep the code structure clean. However, instead of using
synchronous non-blocking system calls as the underlying
technique, our approach internally uses an asynchronous
queue-based interface. We further present a novel architec-
ture for concurrency platforms, like Cilk and Go, enabling
low latencies and high throughput via pseudo-blocking
system calls. Finally, we discuss future OS enhancements
that would improve our proposed architecture. We imple-
mented and evaluated a concurrency platform based on
the concept of pseudo-blocking system calls. Our platform
can outperform state-of-the-art systems like Go by 1.17 ×
in a file-content search benchmark. It is able to increase
the throughput of a echo-server benchmark by 4 % when
compared to Go, and by 17.8 % when compared to Rust’s
Tokio while improving the tail latency.
CS-2020-02
The Code System of a Systematic Literature Review on Pre-Requirements Specification Traceability
(2020)
Tracing requirements back to their origin is important to understand the context and to identify all potential concerns or conflicts in the genesis of the requirements. The so-called pre-requirements specification (pre-RS) traceability is part of requirements traceability (RT) and is recognized as an important factor for long-term project success. Different approaches have been developed to connect requirements and their origin, but still, there is no general established solution. Mostly it is seen as an effort without significant benefits leading to resistance towards its implementation. To guide future research, a comprehensive understanding of the use cases, benefits, challenges, and existing approaches encountered is vital. However, the landscape of the scientific literature on this field remains somewhat fragmented, with pre-RS traceability often only considered in the periphery. We, therefore, conducted a systematic literature review, which identified 67 relevant papers. The literature was coded using qualitative data analysis (QDA) methods. In this technical report, we present the whole resulting code system of the QDA and describe the relationships between the identified themes, focusing on the relevance, problems, solutions, and techniques of pre-RS traceability.
CS-2020-01
Pattern discovery, the process of discovering previously unrecognized patterns, is usually performed as an ad-hoc process with little resulting certainty in the quality of the proposed patterns. Pattern validation, the process of validating the accuracy of proposed patterns, has rarely gone beyond the simple heuristic of "the rule of three". This article shows how to use established scientific research methods for the purpose of pattern discovery and validation. The result is an approach to pattern discovery and validation that can provide the same certainty that traditional scientific research methods can provide for the theories they are used to validate. This article describes our approach and explores its usefulness for pattern discovery and evaluation in a series of studies.
CS-2019-06
Der Marktanteil elektronischer Bucher (E-Books) am Buchmarkt wächst beständig. Um E-Books zu rezipieren, benötigt man spezielle Leseumgebungen, die als Software (im Browser oder als eigene Anwendung) oder als Spezialgerät (E-Reader) realisiert sein können. Diese Leseumgebungen sind geeignet, Daten über das Leseverhalten zu sammeln. Im Rahmen einer universitären Lehrveranstaltung wurden die Software-Leseumgebungen der beiden deutschen Marktführer Kindle und Tolino untersucht. Der vorliegende Bericht fasst die Ergebnisse dieser Analysen zusammen. Das Ergebnis ist eine umfassende Bestandsaufnahme der digitalen Spuren, die durch die Benutzung der Programme entstehen. Betrachtet wurden die zum Untersuchungszeitpunkt aktuellen Versionen der jeweiligen Webanwendungen und Android-Apps sowie des Kindle-Windows-Clients. Die Ergebnisse entstanden im Rahmen einer Übung zur Vorlesung "Fortgeschrittene forensische Informatik II" im Wintersemester 2018/19 an der Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), die gemeinsam durchgeführt wurde vom Lehrstuhl fur Informatik 1 und dem Institut für Buchwissenschaft an der FAU.
CS-2019-05
ReFS is a modern file system that is developed by Microsoft and its internal structures and behavior is not officially documented. Even so there exist some analysis efforts in deciphering its data structures, some of these findings have yet become deprecated and cannot be applied to current ReFS versions anymore. In this work, general concepts and internal structures found in ReFS are examined and documented. Based on the structures and the processes by which they are modified, approaches to recover (deleted) files from ReFS formatted file systems are shown. We also evaluated our implementation and the allocation strategy of ReFS with respect to accuracy, runtime and the ability to recover older file states. In addition, we extended The Sleuth Kit allowing it to parse ReFS partitions and build a carver based on that extend The Sleuth Kit.
CS-2019-03
Update systems that regularly distribute updates for installed
software systems to end users are an essential part of modern
security. Problems arise when the update system is misused and
malicious updates are sent to a small set of end users
only. Such situations can occur if the software supplier has been
successfully attacked or is coerced by government agencies to
distribute hand-crafted updates to a set of "suspects" containing
promiscuous functionality like back-doors. In this paper, we define a
set of general security requirements for update systems that
encompass protection against malicious updates. We then introduce
the design of an update system that satisfies all requirements and
present an implementation as an extension to the advanced
package tool (APT) for the Debian operating system. We
evaluate the strengths and weaknesses of the system and discuss its
large-scale applicability with respect to security and performance
overhead.
CS-2019-02
The analysis of various log files is an integral
part of digital forensic investigations. Despite their different
file formats and due to their common purpose, log files
generally contain similar structures. Based on the analysis
of three common log file types (syslog, windows event log
and SQLite browser histories), we present a simple yet
precise unified representation of log files that allows to
analyze such files independently of their format. We exemplify
the usefulness of our representation using two case
studies: Firstly, we show how our representation allows to
express consistency criteria used for the identification of
(ab)normal events in first-order logic. Secondly, we show
how—based on this unified representation—visualization
of log files can be used to find evidence or to test
hypotheses. For showing the latter, we have implemented
a simple log file visualization tool (SLogViz) and apply it
to identify evidence of a system time manipulation.
CS-2019-01
Log files provide essential information regarding
the actions of processes in critical computer systems.
If an attacker modifies log entries, critical digital evidence
is lost. Therefore, many algorithms for secure logging have
been devised, each achieving different security goals under
different assumptions. We analyze these algorithms and
identify their essential security features. Within a common
system and attacker model, we integrate these algorithms
into a single (parameterizable) “meta” algorithm called
LAVA that possesses the union of the security features
and can be parameterized to yield the set of former algorithms
(and many more). Apart from giving insight into
general structures of secure logging protocols, we present
an abstract efficiency analysis and practical performance
measurements of LAVA showing its usefulness.
CS-2018-05
The Uni1 Project (2016)
(2018)
The aim of this project outline is to describe how universities and other higher education institutions (HEIs) can work with businesses to conduct teaching projects for and with students. Both parties stand to benefit; the projects generate recruitment, outsourcing and innovation (ROI) for businesses and provide HEIs with new partners for cooperation, a source of funds, and a boost to the attractiveness of their teaching.
CS-2018-04
Data-stream processing has continuously
risen in importance as the amount of available data has
been steadily increasing over the last decade. Besides
traditional domains such as data-center monitoring and
click analytics, there is an increasing number of network-enabled production machines that generate continuous
streams of data.
Due to their continuous nature, queries on data-streams
can be more complex, and distinctly harder to under-
stand than database queries. As users have to consider
operational details, maintenance and debugging become
challenging.
Current approaches model data-streams as sequences,
because this is the way they are physically received. This
forces query authors to often consider unnecessary details.
We explore a different way of modeling data-streams by
focusing on time-slicing semantics. This results in a model
based on functions, which is better for abstract reasoning
about query semantics.
By adapting the given definitions of relevant concepts in
stream processing to our model, we illustrate the practical
use of our approach. To achieve this, we link data-streams
and query primitives to concepts in functional programming and mathematics. Most noteworthy, we prove that
data-streams are monads, and show how to derive monad
definitions for current data-stream models.
We provide an abstract, yet practical perspective on
data-stream-related subjects based on a sound, consistent
query model. Our work can serve as solid foundation for
future data-stream query languages.
CS-2018-03
Multi-core processors are ubiquitous. Even embedded systems nowadays use processors with multiple cores. Such use cases often impose latency requirements because they interact with physical objects.
One consequence is a need for synchronisation algorithms that provide predictable latency, in addition to high throughput. A promising approach are asynchronous critical sections that avoid waiting even when a resource is occupied.
This paper introduces two algorithms that allow for both synchronous and asynchronous critical sections. Both algorithms base on a novel wait-free queue. The evaluation shows that both algorithms outperform pre-existing synchronisation algorithms for asynchronous requests, and perform similarly to traditional lock-based algorithms for synchronous requests. In summary, our synchronisation algorithms can improve throughput and predictability of parallel applications.
CS-2018-02
The low share of women in computer science is documented by many surveys. Most of these studies are based on registrations or enrolments of universities or other scientific institutions. In this paper, we present a new approach to a) analyse the gender gap in the group of scientists that are currently active in research and b) classify differences for different fields of computer science. This group comprises professors, industrial researchers, senior lecturers, postdoctoral researchers, and doctoral students shortly before finishing their theses. The proportion of women in a specific scientific area of computer science might provide valuable information for strategies to recruit women as postdocs or professors.
CS-2018-01
Energy-efficient applications utilize just enough resources (e.g., threads, cores) to provide the performance required at the current point in time. Unfortunately, building such applications is inherently difficult in the face of varying workloads and further complicated by the fact that existing programming and execution platforms are not energy aware. Consequently, programmers are usually forced to choose between two unfavorable options: to lose performance and/or waste energy by relying on a static resource pool, or to significantly increase the complexity of their applications by implementing additional functionality to control resource usage at runtime.
In this paper we present Empya, an energy-aware programming and execution platform that frees application programmers from the need to take care of energy efficiency. During execution, Empya constantly monitors both the performance as well as the energy consumption of an application and dynamically adjusts the system configuration to achieve the best energy--performance tradeoff for the current workload. In contrast to existing approaches, Empya combines techniques from different software and hardware levels to effectively and efficiently minimize the resource footprint of an application during periods of low utilization. This allows Empya to enable significant energy savings, as shown by our evaluations of a key--value store and a variety of MapReduce and Spark applications.
CS-2017-05
Duales- vs. universitäres Studium Welche Bildungsabschlüsse werden von Unternehmen präferiert?
(2017)
In Deutschland studieren derzeit so viele Menschen wie nie zuvor. Dabei steht den Studienberechtigten eine Vielzahl von Optionen für das Studium offen. In dieser Studie wurde der Frage nachgegangen wie Unternehmen, die duale Studiengänge anbieten, verschiedene Bildungsabschlüsse hinsichtlich der Qualifikation der Bewerber in verschiedenen Bereichen beurteilen und wie im Speziellen dabei duale Ausbildungswege bewertet werden.
CS-2017-04
In Deutschland wird der Umgang mit der zunehmenden Digitalisierung des Alltags von Jugendlichen derzeit kontrovers diskutiert. Während das Bundesbildungsministerin eine Bildungsoffensive mit einem Fünf-Milliarden-Euro Programm für die digitale Vernetzung und den Einsatz digitaler Medien an Schulen fördert, warnt gleichzeitig die Drogenbeauftrage der Bundesregierung vor gesundheitlichen Risiken durch die zunehmende Digitalisierung und intensive Mediennutzung. In dieser Studie soll der Frage nachgegangen werden, wie der „digitale Alltag“ von Jugendlichen tatsächlich aussieht. Wie oft sind die Jugendlichen „online“ und welche Apps werden dabei vor allem genutzt? Sind Unterschiede zwischen den Geschlechtern, oder unter den von Schüle-rinnen und Schülern besuchten Schularten feststellbar?
CS-2017-03
CS-2017-02
The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation.
Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use the Glibc heap implementation.
Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside.
We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information.
Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes:
Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation.
These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process.
The remaining two plugins are a result of these user space process analyses and are extracting the command history for the zsh shell and password entry information for the password manager KeePassX.