From 6d19c80e386b2a991b9d8f07c6b5b9dbc4431cc3 Mon Sep 17 00:00:00 2001 From: Arthur Grisel-Davy Date: Mon, 23 Sep 2024 12:10:25 -0400 Subject: [PATCH] update --- PhD/seminar/images/processes.svg | 438 +---- PhD/seminar/images/processes_10.svg | 2415 -------------------------- PhD/seminar/images/processes_7.svg | 341 ++-- PhD/seminar/images/processes_8.svg | 2422 ++++++++++++++++++++++---- PhD/seminar/images/processes_9.svg | 2437 +++++++++++++++------------ PhD/seminar/images/wein.svg | 247 ++- PhD/seminar/images/wein_1.svg | 115 +- PhD/seminar/images/wein_2.svg | 190 +-- PhD/seminar/images/wein_3.svg | 206 +-- PhD/seminar/seminar.typ | 60 +- 10 files changed, 3990 insertions(+), 4881 deletions(-) delete mode 100644 PhD/seminar/images/processes_10.svg diff --git a/PhD/seminar/images/processes.svg b/PhD/seminar/images/processes.svg index 389768c..8bd3c28 100644 --- a/PhD/seminar/images/processes.svg +++ b/PhD/seminar/images/processes.svg @@ -23,9 +23,9 @@ inkscape:pagecheckerboard="0" inkscape:deskcolor="#d1d1d1" inkscape:document-units="mm" - inkscape:zoom="0.5070922" - inkscape:cx="5249.5384" - inkscape:cy="490.04895" + inkscape:zoom="0.71713667" + inkscape:cx="10954.676" + inkscape:cy="300.5006" inkscape:window-width="1920" inkscape:window-height="1011" inkscape:window-x="0" @@ -81,14 +81,6 @@ margin="0" bleed="0" inkscape:label="6" />ps -e -o5512R.../firefox639T.../[kworker]15623I.../vimpidstatecommand1583793S.../ssh1110000000000012022798798 - - -111100000000000211110000000000021011000000010012101100000001001200110000000111120010000000011213001000000001121300000000000213120000000000021312~450 x 2processespower6576668548458448028018057983.8 days ~ 660000 diff --git a/PhD/seminar/images/processes_7.svg b/PhD/seminar/images/processes_7.svg index 3738d67..882d1b6 100644 --- a/PhD/seminar/images/processes_7.svg +++ b/PhD/seminar/images/processes_7.svg @@ -25,332 +25,345 @@ style="fill:context-stroke;fill-rule:evenodd;stroke:none" id="path8" />ps -e -o5512RR.../firefox.../firefox639TT.../[kworker].../[kworker]15623II.../vim.../vimpidstatestatecommandcommand1583793SS.../ssh.../ssh1583711S.../vim11110000000000010 + x="2273.6155" + y="80.974525">2 diff --git a/PhD/seminar/images/processes_8.svg b/PhD/seminar/images/processes_8.svg index 5e3badb..62cfa52 100644 --- a/PhD/seminar/images/processes_8.svg +++ b/PhD/seminar/images/processes_8.svg @@ -10,369 +10,2213 @@ xml:space="preserve" xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg">ps -e -o5512R.../firefox639T.../[kworker]15623I.../vimpidstatecommand1583793S.../ssh11110000000000021583711S.../vim1111111100000000000000000000002 + x="2540.4092" + y="51.602951">21011000000010012101100000001001200110000000111120010000000011213001000000001121300000000000213120000000000021312processespower diff --git a/PhD/seminar/images/processes_9.svg b/PhD/seminar/images/processes_9.svg index 62cfa52..c188806 100644 --- a/PhD/seminar/images/processes_9.svg +++ b/PhD/seminar/images/processes_9.svg @@ -12,2211 +12,2404 @@ xmlns:svg="http://www.w3.org/2000/svg"> + x="2894.5615" + y="126.40987">7983.8 days ~ 660000 diff --git a/PhD/seminar/images/wein.svg b/PhD/seminar/images/wein.svg index b154ad5..422446d 100644 --- a/PhD/seminar/images/wein.svg +++ b/PhD/seminar/images/wein.svg @@ -8,8 +8,8 @@ version="1.1" id="svg1" xml:space="preserve" - inkscape:version="1.3.2 (091e20ef0f, 2023-11-25, custom)" sodipodi:docname="wein.svg" + inkscape:version="1.3.2 (091e20ef0f, 2023-11-25, custom)" xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" xmlns="http://www.w3.org/2000/svg" @@ -23,81 +23,180 @@ inkscape:pagecheckerboard="0" inkscape:deskcolor="#d1d1d1" inkscape:document-units="mm" - inkscape:zoom="1.0141844" - inkscape:cx="380.1084" - inkscape:cy="204.59791" + inkscape:zoom="0.48898373" + inkscape:cx="1387.5717" + inkscape:cy="64.419321" inkscape:window-width="1920" inkscape:window-height="1011" inkscape:window-x="0" inkscape:window-y="0" inkscape:window-maximized="1" - inkscape:current-layer="layer1" />IndependanceRelevanceActionability + inkscape:current-layer="svg1">IndependanceRelevanceIndependanceRelevanceIndependanceRelevancePower Side-Channel diff --git a/PhD/seminar/images/wein_1.svg b/PhD/seminar/images/wein_1.svg index 78eb0ee..e410424 100644 --- a/PhD/seminar/images/wein_1.svg +++ b/PhD/seminar/images/wein_1.svg @@ -10,87 +10,34 @@ xml:space="preserve" xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg">IndependanceRelevanceActionabilityIndependanceRelevanceActionability + id="defs1" />IndependanceRelevance diff --git a/PhD/seminar/images/wein_2.svg b/PhD/seminar/images/wein_2.svg index 76be605..62d1cf5 100644 --- a/PhD/seminar/images/wein_2.svg +++ b/PhD/seminar/images/wein_2.svg @@ -10,141 +10,55 @@ xml:space="preserve" xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg">IndependanceRelevanceActionabilityIndependanceRelevanceActionabilityIndependanceRelevanceActionabilitySide-Channel + id="defs1" />IndependanceRelevanceSide-Channel diff --git a/PhD/seminar/images/wein_3.svg b/PhD/seminar/images/wein_3.svg index 44eede4..e85c10b 100644 --- a/PhD/seminar/images/wein_3.svg +++ b/PhD/seminar/images/wein_3.svg @@ -10,157 +10,55 @@ xml:space="preserve" xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg">IndependanceRelevanceActionabilityIndependanceRelevanceActionabilityIndependanceRelevanceActionabilityPower + id="defs1" />IndependanceRelevancePower diff --git a/PhD/seminar/seminar.typ b/PhD/seminar/seminar.typ index 839d63b..7ce72da 100644 --- a/PhD/seminar/seminar.typ +++ b/PhD/seminar/seminar.typ @@ -12,7 +12,7 @@ #title-slide( author: [Arthur Grisel-Davy], - title: "Seminar: Process-Power Consistency as Sanity Check", + title: "Process List Verification with Power Analysis", subtitle: "Subtitle", date: "September 2024", extra: "" @@ -29,28 +29,15 @@ #slide(title:"State of the IDS")[ // Process masquerading is trivialy posible and used by many attacks (Mitre AttCK list) -#line-by-line[ -- #text(weight:"bold")[Known Attacks] #cite(label("mitre_masquerade"), supplement:"MITRE"): AcroRD32.exe (Adobe), kb-10233.exe (Windows Update), mfevtpse.exe (McAfee). -- #text(weight:"bold")[Technics:] - - #box(baseline: 60%, height:2em, image("images/linux.svg", height:100%)): Bind Mounts @mount, #text(fill:red)[find more] - - - - #box(baseline: 60%, height:2em, image("images/windows.svg", height:100%)): msdtc.exe , #text(fill:red)[find more] +#text(weight:"bold")[Known Attacks:] +- AcroRD32.exe (Adobe), kb-10233.exe (Windows Update), mfevtpse.exe (McAfee). +- Azazel Rootkit +- Adore-ng Rootkit +- DLL Injections (in explorer.exe) +- Direct Kernel Object Manipulation (FU Rootkit) +- Hooking System Calls (t0rn Rootkit) ] -] - - -#slide(title:"State of the IDS")[ - // Countermeasure to process masquerading -Listed by MITRE|ATT&CK: -- Monitor OS API Calls (e.g. forks) -- Monitor process creation source. -Listed by Red Canary: -- Heuristic on process properties (name, location, etc.) - -#uncover(2)[#align(center)[#text(fill:red, weight:"bold")[All Host-Based Methods!]]] -] #slide(title:"State of the IDS")[ #align(center)[ @@ -78,10 +65,10 @@ You should not trust data comming from a the device to protect, it might have be // Why is it correlated with the process list // Why is it the best/most practical side-channel Power is: -- Easy to measure (at high sampling rate) +- Easy & cheap to measure (at high sampling rate) - Position independant -- Ubiquitus -- Scaling from global to granular +- Ubiquitous +// - Scaling from global to granular ] #slide(title: "Problem Statement")[ @@ -101,7 +88,7 @@ Power is: #slide(title:"Input Data - Power")[ - Cable current #sym.arrow current clamp #sym.arrow ADC #sym.arrow server - Capure: 10ksps -- Downsample: 2 SPS with average and median aggregation. #text(red)[check the specifics] +- Downsample: 2 SPS with average and median aggregation. ] @@ -111,7 +98,7 @@ Power is: #slide(title: "Input Data - Processes")[ -#for i in range(10){ +#for i in range(9){ [#only(i+1)[#image("images/processes_"+str(i+1)+".svg", height:100%)]] } @@ -171,11 +158,20 @@ Power is: #only(2)[#align(center)[#image("images/states_ts.svg", height:100%)]] ] -#slide(title:"Future Works")[ - - Collect more and better data. - - Developp a benchmark for attack detection. -] +#slide(title:"Conclusion and Future Works")[ -#slide(title:"Bibliography")[ - #bibliography("biblio.yml") +#text(weight:"bold")[Conclusion:] + - Exploitable relationship processes-power + - Many applicable methods #sym.arrow robustness + - Large range of targets + +#uncover(2)[ +#text(weight:"bold")[Next Steps:] + - Collect more and better data + - Try methods on other devices + - Developp a benchmark for attack detection + - Decomposition Approach + - Extract process information from decomposed abnormal time series + - Benchmark against MLP approach +] ]