diff --git a/PhD/seminar/images/processes.svg b/PhD/seminar/images/processes.svg
index 389768c..8bd3c28 100644
--- a/PhD/seminar/images/processes.svg
+++ b/PhD/seminar/images/processes.svg
@@ -23,9 +23,9 @@
inkscape:pagecheckerboard="0"
inkscape:deskcolor="#d1d1d1"
inkscape:document-units="mm"
- inkscape:zoom="0.5070922"
- inkscape:cx="5249.5384"
- inkscape:cy="490.04895"
+ inkscape:zoom="0.71713667"
+ inkscape:cx="10954.676"
+ inkscape:cy="300.5006"
inkscape:window-width="1920"
inkscape:window-height="1011"
inkscape:window-x="0"
@@ -81,14 +81,6 @@
margin="0"
bleed="0"
inkscape:label="6" />ps -e -o5512R.../firefox639T.../[kworker]15623I.../vimpidstatecommand1583793S.../ssh1110000000000012022798798
-
-
-
diff --git a/PhD/seminar/images/processes_7.svg b/PhD/seminar/images/processes_7.svg
index 3738d67..882d1b6 100644
--- a/PhD/seminar/images/processes_7.svg
+++ b/PhD/seminar/images/processes_7.svg
@@ -25,332 +25,345 @@
style="fill:context-stroke;fill-rule:evenodd;stroke:none"
id="path8" />ps -e -o5512RR.../firefox.../firefox639TT.../[kworker].../[kworker]15623II.../vim.../vimpidstatestatecommandcommand1583793SS.../ssh.../ssh1583711S.../vim11110000000000010
+ x="2273.6155"
+ y="80.974525">2
diff --git a/PhD/seminar/images/processes_8.svg b/PhD/seminar/images/processes_8.svg
index 5e3badb..62cfa52 100644
--- a/PhD/seminar/images/processes_8.svg
+++ b/PhD/seminar/images/processes_8.svg
@@ -10,369 +10,2213 @@
xml:space="preserve"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">ps -e -o5512R.../firefox639T.../[kworker]15623I.../vimpidstatecommand1583793S.../ssh11110000000000021583711S.../vim1111111100000000000000000000002
+ x="2540.4092"
+ y="51.602951">21011000000010012101100000001001200110000000111120010000000011213001000000001121300000000000213120000000000021312processespower657666854845844802801805798
diff --git a/PhD/seminar/images/processes_9.svg b/PhD/seminar/images/processes_9.svg
index 62cfa52..c188806 100644
--- a/PhD/seminar/images/processes_9.svg
+++ b/PhD/seminar/images/processes_9.svg
@@ -12,2211 +12,2404 @@
xmlns:svg="http://www.w3.org/2000/svg">1111000000000002111100000000000210110000000100121011000000010012001100000001111200100000000112130010000000011213000000000002131200000000000213122~450 x 2processesprocessespowerpower657666854845844802801805798
+ x="2894.5615"
+ y="126.40987">7983.8 days ~ 660000
diff --git a/PhD/seminar/images/wein.svg b/PhD/seminar/images/wein.svg
index b154ad5..422446d 100644
--- a/PhD/seminar/images/wein.svg
+++ b/PhD/seminar/images/wein.svg
@@ -8,8 +8,8 @@
version="1.1"
id="svg1"
xml:space="preserve"
- inkscape:version="1.3.2 (091e20ef0f, 2023-11-25, custom)"
sodipodi:docname="wein.svg"
+ inkscape:version="1.3.2 (091e20ef0f, 2023-11-25, custom)"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
@@ -23,81 +23,180 @@
inkscape:pagecheckerboard="0"
inkscape:deskcolor="#d1d1d1"
inkscape:document-units="mm"
- inkscape:zoom="1.0141844"
- inkscape:cx="380.1084"
- inkscape:cy="204.59791"
+ inkscape:zoom="0.48898373"
+ inkscape:cx="1387.5717"
+ inkscape:cy="64.419321"
inkscape:window-width="1920"
inkscape:window-height="1011"
inkscape:window-x="0"
inkscape:window-y="0"
inkscape:window-maximized="1"
- inkscape:current-layer="layer1" />IndependanceRelevanceActionability
+ inkscape:current-layer="svg1">IndependanceRelevanceIndependanceRelevanceIndependanceRelevancePower Side-Channel
diff --git a/PhD/seminar/images/wein_1.svg b/PhD/seminar/images/wein_1.svg
index 78eb0ee..e410424 100644
--- a/PhD/seminar/images/wein_1.svg
+++ b/PhD/seminar/images/wein_1.svg
@@ -10,87 +10,34 @@
xml:space="preserve"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">IndependanceRelevanceActionabilityIndependanceRelevanceActionability
+ id="defs1" />IndependanceRelevance
diff --git a/PhD/seminar/images/wein_2.svg b/PhD/seminar/images/wein_2.svg
index 76be605..62d1cf5 100644
--- a/PhD/seminar/images/wein_2.svg
+++ b/PhD/seminar/images/wein_2.svg
@@ -10,141 +10,55 @@
xml:space="preserve"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">IndependanceRelevanceActionabilityIndependanceRelevanceActionabilityIndependanceRelevanceActionabilitySide-Channel
+ id="defs1" />IndependanceRelevanceSide-Channel
diff --git a/PhD/seminar/images/wein_3.svg b/PhD/seminar/images/wein_3.svg
index 44eede4..e85c10b 100644
--- a/PhD/seminar/images/wein_3.svg
+++ b/PhD/seminar/images/wein_3.svg
@@ -10,157 +10,55 @@
xml:space="preserve"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">IndependanceRelevanceActionabilityIndependanceRelevanceActionabilityIndependanceRelevanceActionabilityPower
+ id="defs1" />IndependanceRelevancePower
diff --git a/PhD/seminar/seminar.typ b/PhD/seminar/seminar.typ
index 839d63b..7ce72da 100644
--- a/PhD/seminar/seminar.typ
+++ b/PhD/seminar/seminar.typ
@@ -12,7 +12,7 @@
#title-slide(
author: [Arthur Grisel-Davy],
- title: "Seminar: Process-Power Consistency as Sanity Check",
+ title: "Process List Verification with Power Analysis",
subtitle: "Subtitle",
date: "September 2024",
extra: ""
@@ -29,28 +29,15 @@
#slide(title:"State of the IDS")[
// Process masquerading is trivialy posible and used by many attacks (Mitre AttCK list)
-#line-by-line[
-- #text(weight:"bold")[Known Attacks] #cite(label("mitre_masquerade"), supplement:"MITRE"): AcroRD32.exe (Adobe), kb-10233.exe (Windows Update), mfevtpse.exe (McAfee).
-- #text(weight:"bold")[Technics:]
- - #box(baseline: 60%, height:2em, image("images/linux.svg", height:100%)): Bind Mounts @mount, #text(fill:red)[find more]
-
-
- - #box(baseline: 60%, height:2em, image("images/windows.svg", height:100%)): msdtc.exe , #text(fill:red)[find more]
+#text(weight:"bold")[Known Attacks:]
+- AcroRD32.exe (Adobe), kb-10233.exe (Windows Update), mfevtpse.exe (McAfee).
+- Azazel Rootkit
+- Adore-ng Rootkit
+- DLL Injections (in explorer.exe)
+- Direct Kernel Object Manipulation (FU Rootkit)
+- Hooking System Calls (t0rn Rootkit)
]
-]
-
-
-#slide(title:"State of the IDS")[
- // Countermeasure to process masquerading
-Listed by MITRE|ATT&CK:
-- Monitor OS API Calls (e.g. forks)
-- Monitor process creation source.
-Listed by Red Canary:
-- Heuristic on process properties (name, location, etc.)
-
-#uncover(2)[#align(center)[#text(fill:red, weight:"bold")[All Host-Based Methods!]]]
-]
#slide(title:"State of the IDS")[
#align(center)[
@@ -78,10 +65,10 @@ You should not trust data comming from a the device to protect, it might have be
// Why is it correlated with the process list
// Why is it the best/most practical side-channel
Power is:
-- Easy to measure (at high sampling rate)
+- Easy & cheap to measure (at high sampling rate)
- Position independant
-- Ubiquitus
-- Scaling from global to granular
+- Ubiquitous
+// - Scaling from global to granular
]
#slide(title: "Problem Statement")[
@@ -101,7 +88,7 @@ Power is:
#slide(title:"Input Data - Power")[
- Cable current #sym.arrow current clamp #sym.arrow ADC #sym.arrow server
- Capure: 10ksps
-- Downsample: 2 SPS with average and median aggregation. #text(red)[check the specifics]
+- Downsample: 2 SPS with average and median aggregation.
]
@@ -111,7 +98,7 @@ Power is:
#slide(title: "Input Data - Processes")[
-#for i in range(10){
+#for i in range(9){
[#only(i+1)[#image("images/processes_"+str(i+1)+".svg", height:100%)]]
}
@@ -171,11 +158,20 @@ Power is:
#only(2)[#align(center)[#image("images/states_ts.svg", height:100%)]]
]
-#slide(title:"Future Works")[
- - Collect more and better data.
- - Developp a benchmark for attack detection.
-]
+#slide(title:"Conclusion and Future Works")[
-#slide(title:"Bibliography")[
- #bibliography("biblio.yml")
+#text(weight:"bold")[Conclusion:]
+ - Exploitable relationship processes-power
+ - Many applicable methods #sym.arrow robustness
+ - Large range of targets
+
+#uncover(2)[
+#text(weight:"bold")[Next Steps:]
+ - Collect more and better data
+ - Try methods on other devices
+ - Developp a benchmark for attack detection
+ - Decomposition Approach
+ - Extract process information from decomposed abnormal time series
+ - Benchmark against MLP approach
+]
]