grizzly/deneir
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

backup before SnP

Browse source
This commit is contained in:
grizzly 2025-06-05 10:07:53 -04:00
parent 201c62b97d
commit f5712a3a73
13 changed files with 7506 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

531
procver/SnP/images/ael_illustration.svg Normal file
View file

@ -0,0 +1,531 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="349.6778mm"
height="101.18298mm"
viewBox="0 0 349.6778 101.18298"
version="1.1"
id="svg1"
inkscape:version="1.4.1 (93de688d07, 2025-03-30)"
sodipodi:docname="ael_illustration.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg">
<sodipodi:namedview
id="namedview1"
pagecolor="#ffffff"
bordercolor="#eeeeee"
borderopacity="1"
inkscape:showpageshadow="0"
inkscape:pageopacity="0"
inkscape:pagecheckerboard="0"
inkscape:deskcolor="#505050"
inkscape:document-units="mm"
inkscape:zoom="0.72426347"
inkscape:cx="577.8284"
inkscape:cy="399.71642"
inkscape:window-width="1920"
inkscape:window-height="1022"
inkscape:window-x="0"
inkscape:window-y="0"
inkscape:window-maximized="1"
inkscape:current-layer="layer1" />
<defs
id="defs1">
<inkscape:path-effect
effect="tiling"
id="path-effect41"
is_visible="true"
lpeversion="1.3.1"
unit="px"
seed="1;1"
lpesatellites=""
num_rows="1"
num_cols="26"
gapx="15"
gapy="0"
offset="0"
offset_type="false"
scale="0"
rotate="0"
mirrorrowsx="false"
mirrorrowsy="false"
mirrorcolsx="false"
mirrorcolsy="false"
mirrortrans="false"
shrink_interp="false"
split_items="false"
link_styles="false"
interpolate_scalex="false"
interpolate_scaley="true"
interpolate_rotatex="false"
interpolate_rotatey="true"
random_scale="false"
random_rotate="false"
random_gap_y="false"
random_gap_x="false"
transformorigin="" />
<marker
style="overflow:visible"
id="Triangle"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="Triangle arrow"
markerWidth="1.5"
markerHeight="1.5"
viewBox="0 0 1 1"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path135" />
</marker>
<marker
style="overflow:visible"
id="marker19"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="Wide arrow"
markerWidth="1"
markerHeight="1"
viewBox="0 0 1 1"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
style="fill:none;stroke:context-stroke;stroke-width:1;stroke-linecap:butt"
d="M 3,-3 0,0 3,3"
transform="rotate(180,0.125,0)"
sodipodi:nodetypes="ccc"
id="path19" />
</marker>
<marker
style="overflow:visible"
id="ArrowWide"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="Wide arrow"
markerWidth="1"
markerHeight="1"
viewBox="0 0 1 1"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid">
<path
style="fill:none;stroke:context-stroke;stroke-width:1;stroke-linecap:butt"
d="M 3,-3 0,0 3,3"
transform="rotate(180,0.125,0)"
sodipodi:nodetypes="ccc"
id="path18" />
</marker>
<inkscape:path-effect
effect="tiling"
id="path-effect5"
is_visible="true"
lpeversion="1.3.1"
unit="px"
seed="1;1"
lpesatellites=""
num_rows="1"
num_cols="56"
gapx="7"
gapy="0"
offset="0"
offset_type="false"
scale="0"
rotate="0"
mirrorrowsx="false"
mirrorrowsy="false"
mirrorcolsx="false"
mirrorcolsy="false"
mirrortrans="false"
shrink_interp="false"
split_items="false"
link_styles="false"
interpolate_scalex="false"
interpolate_scaley="true"
interpolate_rotatex="false"
interpolate_rotatey="true"
random_scale="false"
random_rotate="false"
random_gap_y="false"
random_gap_x="false"
transformorigin="" />
</defs>
<g
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(7.6715867,-14.612546)">
<path
style="fill:none;stroke:#999999;stroke-width:0.4;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:3.2, 0.4;stroke-dashoffset:0"
d="M 7.068815,78.882337 H 166.8519"
id="path7"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#808080;stroke-width:0.746001;stroke-linecap:butt;stroke-linejoin:round"
d="M 7.068815,101.29964 V 43.116742"
id="path1"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#808080;stroke-width:0.746001;stroke-linecap:butt;stroke-linejoin:round"
d="M 4.471481,99.074395 H 142.27195"
id="path2" />
<path
style="fill:none;stroke:#808080;stroke-width:0.746001;stroke-linecap:butt;stroke-linejoin:round"
d="M 217.6747,99.838389 V 41.462177"
id="path3"
sodipodi:nodetypes="cc" />
<path
style="fill:none;stroke:#808080;stroke-width:0.746001;stroke-linecap:butt;stroke-linejoin:round"
d="M 215.63951,98.094758 H 323.6155"
id="path4" />
<path
style="fill:none;stroke:#0000ff;stroke-width:0.4;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none"
d="m 10.200644,96.02498 2.363655,-0.329666 2.363654,0.659335 2.363655,-0.989 2.363655,-20.933804 h 2.363655 l 2.363654,1.379641 2.363656,-2.972144 2.363655,1.592503 2.363654,21.834975 2.363654,-0.466218 2.363656,0.466218 2.363655,-2.680757 2.363654,-0.524495 2.363656,-2.389369 2.363654,2.156259 2.363655,-0.699329 2.363655,3.788028 2.363655,0.116557 2.363654,-0.932438 2.363656,-42.77554 2.363654,25.292349 2.363655,-17.483193 2.363655,1.748322 2.363655,0.116556 2.363654,2.214536 2.363655,31.236634 2.363656,-0.582773 2.363654,0.815883 2.363654,-1.165545 2.363656,0.699328 2.363655,-0.815884 2.363654,-19.9701 h 2.363656 l 2.363654,2.603464 2.363655,-2.603464 2.363655,-1.417669 2.363655,1.417669 2.363657,20.727707 2.36365,-0.291389 2.36366,0.466221 2.36365,0.116557 2.36366,-1.223823 2.36366,-19.795268 h 2.36365 l 2.36366,20.669429 2.36365,-2.797311 2.36365,-0.990712 2.36366,2.097982 2.36365,-2.039705 2.36366,1.223823 2.36366,3.554913 2.36365,-0.874158 2.36365,-0.349665 2.36366,-1.282101 2.36365,0.990716"
id="path6" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 19.266465,49.616466 V 78.627094"
id="path8"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 29.591652,49.616466 V 78.627094"
id="path10"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 56.006298,49.616466 V 78.627094"
id="path11"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 70.401934,49.616466 V 78.627094"
id="path12"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 85.310839,49.616466 V 78.627094"
id="path13"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 98.163377,49.616466 V 78.627094"
id="path14"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 111.3064,49.616466 V 78.627094"
id="path15"
sodipodi:nodetypes="cc" />
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 114.7104,49.616466 V 78.627094"
id="path16"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15903px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#ff7f2a;fill-opacity:1;stroke:none;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="169.04597"
y="80.558311"
id="text16"><tspan
sodipodi:role="line"
id="tspan16"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15903px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';fill:#ff7f2a;fill-opacity:1;stroke:none;stroke-width:0.3"
x="169.04597"
y="80.558311">Threshold</tspan></text>
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;marker-start:url(#ArrowWide);marker-end:url(#marker19)"
d="M 19.266465,47.020343 H 29.591652"
id="path17" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15905px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="23.057627"
y="44.432217"
id="text19"><tspan
sodipodi:role="line"
id="tspan19"
style="fill:#000000;stroke:none;stroke-width:0.200001"
x="23.057627"
y="44.432217">2</tspan></text>
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;marker-start:url(#ArrowWide);marker-end:url(#marker19)"
d="M 56.189081,47.020343 H 70.140596"
id="path20"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15905px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="61.92915"
y="44.432217"
id="text20"><tspan
sodipodi:role="line"
id="tspan20"
style="fill:#000000;stroke:none;stroke-width:0.200001"
x="61.92915"
y="44.432217">3</tspan></text>
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;marker-start:url(#ArrowWide);marker-end:url(#marker19)"
d="M 85.611791,47.020343 H 97.902403"
id="path21"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15905px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="88.875069"
y="44.432217"
id="text21"><tspan
sodipodi:role="line"
id="tspan21"
style="fill:#000000;stroke:none;stroke-width:0.200001"
x="88.875069"
y="44.432217">2.5</tspan></text>
<path
style="opacity:0.202361;fill:none;stroke:#000000;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;marker-start:url(#ArrowWide);marker-end:url(#marker19)"
d="m 111.31208,47.020343 h 3.2285"
id="path22"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15905px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="111.77805"
y="44.432217"
id="text22"><tspan
sodipodi:role="line"
id="tspan22"
style="fill:#000000;stroke:none;stroke-width:0.200001"
x="111.77805"
y="44.432217">1</tspan></text>
<circle
style="opacity:1;fill:none;stroke:#000000;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="path24"
cx="245.11917"
cy="58.49585"
r="1.6895757" />
<path
style="opacity:1;fill:none;stroke:#ff7f2a;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:1.5, 1.5;stroke-dashoffset:0"
d="m 245.11918,61.735318 v 38.16765"
id="path25"
sodipodi:nodetypes="cc" />
<path
style="opacity:1;fill:none;stroke:#cc00ff;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:1.5, 1.5;stroke-dashoffset:0"
d="M 241.75858,58.495849 H 215.80855"
id="path26"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:3.60176px;line-height:4.47931px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="167.82986"
y="43.970543"
id="text26"><tspan
sodipodi:role="line"
id="tspan26"
style="font-size:3.60176px;line-height:4.47931px;fill:#000000;stroke:none;stroke-width:0.5;stroke-dasharray:none"
x="167.82986"
y="43.970543" /><tspan
sodipodi:role="line"
style="font-size:3.60176px;line-height:4.47931px;fill:#000000;stroke:none;stroke-width:0.5;stroke-dasharray:none"
x="167.82986"
y="48.449852"
id="tspan31">Avg</tspan><tspan
sodipodi:role="line"
style="font-size:3.60176px;line-height:4.47931px;fill:#000000;stroke:none;stroke-width:0.5;stroke-dasharray:none"
x="167.82986"
y="52.929165"
id="tspan27">Med</tspan><tspan
sodipodi:role="line"
style="font-size:3.60176px;line-height:4.47931px;fill:#000000;stroke:none;stroke-width:0.5;stroke-dasharray:none"
x="167.82986"
y="57.408474"
id="tspan28">Max</tspan><tspan
sodipodi:role="line"
style="font-size:3.60176px;line-height:4.47931px;fill:#000000;stroke:none;stroke-width:0.5;stroke-dasharray:none"
x="167.82986"
y="61.887783"
id="tspan30">Min</tspan></text>
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15905px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#cc00ff;fill-opacity:1;stroke:none;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="161.71469"
y="43.362156"
id="text32"><tspan
sodipodi:role="line"
id="tspan32"
style="fill:#cc00ff;fill-opacity:1;stroke-width:0.5"
x="161.71469"
y="43.362156">Aggregation</tspan></text>
<path
style="opacity:1;fill:none;stroke:#000000;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
d="M 166.80902,45.051558 V 62.812326"
id="path32"
sodipodi:nodetypes="cc" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:5.85286px;line-height:7.27885px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="14.980807"
y="43.937721"
id="text33"><tspan
sodipodi:role="line"
id="tspan33"
style="font-size:5.85286px;line-height:7.27885px;fill:#000000;stroke:none;stroke-width:0.200001"
x="14.980807"
y="43.937721">(</tspan></text>
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:5.85286px;line-height:7.27885px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;stroke:none;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="119.32017"
y="43.937721"
id="text34"><tspan
sodipodi:role="line"
id="tspan34"
style="font-size:5.85286px;line-height:7.27885px;fill:#000000;stroke:none;stroke-width:0.200001"
x="119.32017"
y="43.937721">)</tspan></text>
<path
style="opacity:1;fill:#000000;stroke:#000000;stroke-width:0.200001;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;marker-end:url(#Triangle)"
d="m 121.73002,42.360314 h 34.82826"
id="path34"
sodipodi:nodetypes="cc" />
<path
style="opacity:1;fill:none;fill-opacity:1;stroke:#ff7f2a;stroke-width:0.2;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker-end:url(#Triangle)"
d="m 181.8543,82.509725 c 2.51098,33.463385 54.00084,29.234555 60.57504,19.115365"
id="path35"
sodipodi:nodetypes="cc" />
<path
style="opacity:1;fill:none;fill-opacity:1;stroke:#cc00ff;stroke-width:0.2;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1;marker-end:url(#Triangle)"
d="m 189.70854,42.548398 c 11.5525,0.03719 13.34672,12.091892 24.4063,15.412535"
id="path36"
sodipodi:nodetypes="cc" />
<rect
style="opacity:1;fill:none;fill-opacity:1;stroke:#000000;stroke-width:0.2;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
id="rect36"
width="146.98166"
height="75.686523"
x="2.0665262"
y="30.588257"
ry="3.1483846" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:6.98191px;line-height:8.68299px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
x="6.6319842"
y="28.727407"
id="text36"><tspan
sodipodi:role="line"
id="tspan36"
style="fill:#000000;stroke:none;stroke-width:0.2"
x="6.6319842"
y="28.727407">Residuals</tspan></text>
<rect
style="opacity:1;fill:none;fill-opacity:1;stroke:#000000;stroke-width:0.2;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
id="rect37"
width="116.75873"
height="75.686523"
x="210.78566"
y="30.588257"
ry="3.1483846" />
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:6.98191px;line-height:8.68299px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;opacity:1;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.2;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0;stroke-opacity:1"
x="213.54291"
y="28.727407"
id="text37"><tspan
sodipodi:role="line"
id="tspan37"
style="fill:#000000;stroke:none;stroke-width:0.2"
x="213.54291"
y="28.727407">Aggregated Error Length (AEL)</tspan></text>
<text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15903px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#ff7f2a;fill-opacity:1;stroke:none;stroke-width:0.3;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
x="302.56812"
y="103.75573"
id="text38"><tspan
sodipodi:role="line"
id="tspan38"
style="font-style:normal;font-variant:normal;font-weight:500;font-stretch:normal;font-size:4.95243px;line-height:6.15903px;font-family:'CMU Serif';-inkscape-font-specification:'CMU Serif Medium';fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.3"
x="302.56812"
y="103.75573">Threshold</tspan></text>
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle42"
cx="237.18169"
cy="53.112087"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle43"
cx="229.24419"
cy="50.4179"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle44"
cx="221.30669"
cy="44.070576"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle45"
cx="253.05669"
cy="67.689087"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle46"
cx="260.99417"
cy="77.246773"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle47"
cx="268.93167"
cy="83.91375"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle48"
cx="276.86917"
cy="87.658218"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle49"
cx="284.80667"
cy="88.023529"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle50"
cx="292.74417"
cy="88.754158"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle51"
cx="300.68167"
cy="91.448349"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle52"
cx="308.61917"
cy="91.494011"
r="1.6895757" />
<circle
style="opacity:1;fill:none;stroke:#b3b3b3;stroke-width:0.499999;stroke-linecap:butt;stroke-linejoin:round;stroke-dasharray:none;stroke-dashoffset:0"
id="circle53"
cx="316.55667"
cy="91.631004"
r="1.6895757" />
</g>
</svg>
Side by side

After

Width:  |  Height:  |  Size: 26 KiB

1292
procver/SnP/images/collection_pipeline.svg
View file

File diff suppressed because it is too large Load diff
Side by side Swipe Overlay

Before

Width:  |  Height:  |  Size: 78 KiB

After

Width:  |  Height:  |  Size: 137 KiB

Before After
Before After

BIN
procver/SnP/images/collection_pipeline_small.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 24 KiB

1251
procver/SnP/images/model.svg Normal file
View file

File diff suppressed because it is too large Load diff
Side by side

After

Width:  |  Height:  |  Size: 67 KiB

1162
procver/SnP/images/proposed_approach_overview.svg Normal file
View file

File diff suppressed because it is too large Load diff
Side by side

After

Width:  |  Height:  |  Size: 67 KiB

592
procver/SnP/images/related_work.svg Normal file
View file

@ -0,0 +1,592 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!-- Created with Inkscape (http://www.inkscape.org/) -->
<svg
width="792.42957mm"
height="259.8837mm"
viewBox="0 0 792.42956 259.88371"
version="1.1"
id="svg5"
inkscape:version="1.4.1 (93de688d07, 2025-03-30)"
xml:space="preserve"
sodipodi:docname="related_work.svg"
xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns="http://www.w3.org/2000/svg"
xmlns:svg="http://www.w3.org/2000/svg"><sodipodi:namedview
id="namedview7"
pagecolor="#ffffff"
bordercolor="#000000"
borderopacity="1"
inkscape:showpageshadow="0"
inkscape:pageopacity="0"
inkscape:pagecheckerboard="0"
inkscape:deskcolor="#b5b5b5"
inkscape:document-units="mm"
showgrid="false"
inkscape:zoom="2.7891246"
inkscape:cx="1683.6824"
inkscape:cy="281.98812"
inkscape:window-width="1920"
inkscape:window-height="1022"
inkscape:window-x="0"
inkscape:window-y="0"
inkscape:window-maximized="1"
inkscape:current-layer="layer1"><inkscape:page
x="0"
y="0"
width="792.42957"
height="259.8837"
id="page1"
margin="0"
bleed="0" /></sodipodi:namedview><defs
id="defs2"><marker
style="overflow:visible"
id="Dot"
refX="0"
refY="0"
orient="auto"
inkscape:stockid="Dot"
markerWidth="1"
markerHeight="1"
viewBox="0 0 1 1"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid"><path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:none"
d="M 5,0 C 5,2.76 2.76,5 0,5 -2.76,5 -5,2.76 -5,0 c 0,-2.76 2.3,-5 5,-5 2.76,0 5,2.24 5,5 z"
sodipodi:nodetypes="sssss"
id="path17" /></marker><marker
style="overflow:visible"
id="Triangle"
refX="0"
refY="0"
orient="auto-start-reverse"
inkscape:stockid="Triangle arrow"
markerWidth="1"
markerHeight="1"
viewBox="0 0 1 1"
inkscape:isstock="true"
inkscape:collect="always"
preserveAspectRatio="xMidYMid"><path
transform="scale(0.5)"
style="fill:context-stroke;fill-rule:evenodd;stroke:context-stroke;stroke-width:1pt"
d="M 5.77,0 -2.88,5 V -5 Z"
id="path135" /></marker></defs><g
inkscape:label="Layer 1"
inkscape:groupmode="layer"
id="layer1"
transform="translate(224.10697,45.791336)"><circle
style="fill:#e6e6e6;fill-opacity:1;stroke:#000000;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none"
id="path87"
cx="-328.62012"
cy="299.08551"
r="59.431034"
transform="rotate(-135)" /><circle
style="fill:#999999;fill-opacity:1;stroke:#000000;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none"
id="path78"
cx="-336.25137"
cy="291.13647"
r="42.21381"
transform="rotate(-135)" /><path
style="fill:none;stroke:#000000;stroke-width:1;stroke-linecap:butt;stroke-linejoin:miter;stroke-dasharray:none;stroke-opacity:1;marker-end:url(#Triangle)"
d="M -215.89073,87.23208 H 286.59341"
id="path1"
sodipodi:nodetypes="cc" /><text
xml:space="preserve"
style="font-size:3.88056px;line-height:1.25;font-family:'Monaspace Neon Var';-inkscape-font-specification:'Monaspace Neon Var';letter-spacing:-0.291042px;word-spacing:0px;stroke-width:0.264583"
x="327.862"
y="71.679672"
id="text36"><tspan
sodipodi:role="line"
style="stroke-width:0.264583"
x="327.862"
y="71.679672"
id="tspan37" /></text><path
id="path3"
style="color:#000000;fill:#000000;-inkscape-stroke:none"
d="m -147.72485,67.47964 v 15.777332 c -1.83131,0.128657 -3.28145,1.657668 -3.28145,3.521228 0,1.94765 1.5834,3.53157 3.53105,3.53157 1.94765,0 3.53156,-1.58392 3.53156,-3.53157 0,-1.86356 -1.45014,-3.392571 -3.28145,-3.521228 V 67.47964 Z m 0.2496,16.267224 c 1.67743,0 3.03134,1.353906 3.03134,3.031336 0,1.67743 -1.35391,3.03134 -3.03134,3.03134 -1.67743,0 -3.03082,-1.35391 -3.03082,-3.03134 0,-1.67743 1.35339,-3.031336 3.03082,-3.031336 z" /><text
xml:space="preserve"
style="font-size:3.88056px;line-height:1.25;font-family:'Monaspace Neon Var';-inkscape-font-specification:'Monaspace Neon Var';letter-spacing:-0.291042px;word-spacing:0px;stroke-width:0.264583"
x="-151.82608"
y="66.915802"
id="text50"><tspan
id="tspan50"
style="stroke-width:0.264583"
x="-151.82608"
y="66.915802"
sodipodi:role="line">1969</tspan></text><rect
style="fill:#cccccc;fill-opacity:1;stroke:#1a1a1a;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect50"
width="56.265244"
height="25.585007"
x="-173.95004"
y="37.277485"
ry="1.3401735" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.11667px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:54.6704;display:inline;stroke-width:0.264583"
x="190.02438"
y="196.82707"
id="text81"
transform="translate(-362.699,-146.55585)"><tspan
x="190.02438"
y="196.82707"
id="tspan44">Invented the term &quot;Covert Channel&quot;.
</tspan><tspan
x="190.02438"
y="199.47292"
id="tspan45">This is though of in the case of programms </tspan><tspan
x="190.02438"
y="202.11876"
id="tspan46">communicating on the same machine. It is the early days </tspan><tspan
x="190.02438"
y="204.7646"
id="tspan47">of the idea of covert channels in computer science.</tspan></text><rect
style="fill:#ffc6a0;fill-opacity:1;stroke:#ff6803;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect81"
width="56.26524"
height="10.447671"
x="-173.95004"
y="37.277485"
ry="1.3401735" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:88.3485;display:inline;stroke-width:0.264583"
x="320.76639"
y="166.06209"
id="text82"
transform="matrix(0.72076737,0,0,0.72076737,-402.47872,-76.749177)"><tspan
x="320.76639"
y="166.06209"
id="tspan48">A note on the confinement problem</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:16.9333px;line-height:21.059px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';text-align:center;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:middle;fill:#000000;stroke:none;stroke-width:0.746001;stroke-linecap:round;stroke-linejoin:round"
x="-184.64418"
y="-28.716087"
id="text83"><tspan
sodipodi:role="line"
id="tspan83"
style="stroke:none;stroke-width:0.746"
x="-184.64418"
y="-28.716087">General</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:16.9333px;line-height:21.059px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:0.746001;stroke-linecap:round;stroke-linejoin:round"
x="-220.59908"
y="210.33742"
id="text84"><tspan
sodipodi:role="line"
id="tspan84"
style="text-align:start;text-anchor:start;stroke:none;stroke-width:0.746"
x="-220.59908"
y="210.33742">Specific</tspan></text><path
id="path84"
style="color:#000000;fill:#000000;-inkscape-stroke:none"
d="M 202.50751,106.54263 V 90.76529 c -1.83131,-0.12865 -3.28145,-1.65766 -3.28145,-3.52122 0,-1.94765 1.5834,-3.531573 3.53105,-3.531573 1.94765,0 3.53156,1.583923 3.53156,3.531573 0,1.86356 -1.45014,3.39257 -3.28145,3.52122 v 15.77734 z m 0.2496,-16.26723 c 1.67743,0 3.03134,-1.3539 3.03134,-3.03133 0,-1.67743 -1.35391,-3.031343 -3.03134,-3.031343 -1.67743,0 -3.03082,1.353913 -3.03082,3.031343 0,1.67743 1.35339,3.03133 3.03082,3.03133 z" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;stroke-width:0.264583"
x="198.40628"
y="110.24815"
id="text85"><tspan
id="tspan85"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';stroke-width:0.264583"
x="198.40628"
y="110.24815"
sodipodi:role="line">2008</tspan></text><rect
style="fill:#cccccc;fill-opacity:1;stroke:#1a1a1a;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect85"
width="56.265244"
height="90.850403"
x="176.28232"
y="111.3315"
ry="1.3401735" /><rect
style="fill:#ffc6a0;fill-opacity:1;stroke:#ff6803;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect90"
width="59.49057"
height="11.870605"
x="174.66965"
y="111.3315"
ry="1.3401735" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:78.7407;display:inline;stroke-width:0.264583"
x="320.76639"
y="166.06209"
id="text91"
transform="matrix(0.72076737,0,0,0.72076737,-54.807652,-4.4026833)"><tspan
x="320.76639"
y="166.06209"
id="tspan49">Implicit Detection of Hidden Processes </tspan><tspan
x="320.76639"
y="170.91278"
id="tspan51">with aFeather-Weight Hardware-Assisted </tspan><tspan
x="320.76639"
y="175.76347"
id="tspan52">Virtual Machine Monitor</tspan></text><path
id="path93"
style="color:#000000;fill:#000000;-inkscape-stroke:none"
d="M -6.7755952,106.54263 V 90.76529 c -1.83131,-0.12865 -3.2814498,-1.65766 -3.2814498,-3.52122 0,-1.94765 1.5833998,-3.531573 3.5310498,-3.531573 1.94765,0 3.53156,1.583923 3.53156,3.531573 0,1.86356 -1.45014,3.39257 -3.28145,3.52122 v 15.77734 z m 0.2496,-16.26723 c 1.67743,0 3.03134,-1.3539 3.03134,-3.03133 0,-1.67743 -1.35391,-3.031343 -3.03134,-3.031343 -1.67743,0 -3.03082,1.353913 -3.03082,3.031343 0,1.67743 1.35339,3.03133 3.03082,3.03133 z" /><text
xml:space="preserve"
style="font-size:3.88056px;line-height:1.25;font-family:'Monaspace Neon Var';-inkscape-font-specification:'Monaspace Neon Var';letter-spacing:-0.291042px;word-spacing:0px;stroke-width:0.264583"
x="-10.876826"
y="110.24815"
id="text94"><tspan
id="tspan94"
style="stroke-width:0.264583"
x="-10.876826"
y="110.24815"
sodipodi:role="line">1969</tspan></text><rect
style="fill:#cccccc;fill-opacity:1;stroke:#1a1a1a;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect94"
width="56.265244"
height="25.585007"
x="-33.00079"
y="111.3315"
ry="1.3401735" /><rect
style="fill:#ffc6a0;fill-opacity:1;stroke:#ff6803;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect95"
width="56.265244"
height="11.870608"
x="-33.00079"
y="111.3315"
ry="1.3401735" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:78.7407;display:inline;stroke-width:0.264583"
x="320.76639"
y="166.06209"
id="text97"
transform="matrix(0.72076737,0,0,0.72076737,-262.9524,-4.4026833)"><tspan
x="320.76639"
y="166.06209"
id="tspan53">Microsoft / Kaspersky Reports on </tspan><tspan
x="320.76639"
y="170.91278"
id="tspan54">rootkits</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.11667px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:54.6704;display:inline;stroke-width:0.264583"
x="190.02438"
y="196.82707"
id="text101"
transform="translate(-12.552264,-70.087023)"><tspan
x="190.02438"
y="196.82707"
id="tspan55">- Their solution affect the performance. Yes it is only </tspan><tspan
x="190.02438"
y="199.47292"
id="tspan56">~5% but it is still a performance loss. Our solution </tspan><tspan
x="190.02438"
y="202.11876"
id="tspan57">cannot affect the performance because the data </tspan><tspan
x="190.02438"
y="204.7646"
id="tspan58">collection and analysis is separated.
</tspan><tspan
x="190.02438"
y="207.41045"
id="tspan59">- They claim to support &quot;Dynamic OS migration&quot; which </tspan><tspan
x="190.02438"
y="210.05629"
id="tspan60">means the solution can be applied to an existing </tspan><tspan
x="190.02438"
y="212.70213"
id="tspan61">running VM without restarting/recreating it. We also </tspan><tspan
x="190.02438"
y="215.34798"
id="tspan62">have that and it seems like a desirable property so </tspan><tspan
x="190.02438"
y="217.99382"
id="tspan63">let's mention it.
</tspan><tspan
x="190.02438"
y="220.63967"
id="tspan64">- They provide &quot;non-bypassable interfaces&quot; as a way for </tspan><tspan
x="190.02438"
y="223.28551"
id="tspan65">the OS to communicate with the monitoring system and </tspan><tspan
x="190.02438"
y="225.93135"
id="tspan66">retrieve the True Process List. They apparently use </tspan><tspan
x="190.02438"
y="228.5772"
id="tspan67">very low level mechanisms specific to Intel processor </tspan><tspan
x="190.02438"
y="231.22304"
id="tspan68">to establish this communication but I am not sure what </tspan><tspan
x="190.02438"
y="233.86888"
id="tspan69">makes them completely &quot;non-bypassable&quot;.
</tspan><tspan
x="190.02438"
y="236.51473"
id="tspan70">- They have a more comprehensive evaluation of the </tspan><tspan
x="190.02438"
y="239.16057"
id="tspan71">detection performances compared with other softwares. </tspan><tspan
x="190.02438"
y="241.80641"
id="tspan73">However the same comparison would be unfaire to ProcVer </tspan><tspan
x="190.02438"
y="244.45226"
id="tspan74">because its achievement lies in the fact that it is </tspan><tspan
x="190.02438"
y="247.0981"
id="tspan75">completely remote from the OS and the fact that it </tspan><tspan
x="190.02438"
y="249.74394"
id="tspan82">should work the same on known malwares and zero-days </tspan><tspan
x="190.02438"
y="252.38979"
id="tspan86">attacks. Moreover, it is an additional layer of </tspan><tspan
x="190.02438"
y="255.03563"
id="tspan87">defense, not a silver bullet.
</tspan><tspan
x="190.02438"
y="257.68147"
id="tspan88">- Their solution is very hardware specific in the sense </tspan><tspan
x="190.02438"
y="260.3273"
id="tspan89">that it is designed for a processor model/family/</tspan><tspan
x="190.02438"
y="262.97315"
id="tspan90">manufacturer and would require significant rework to be </tspan><tspan
x="190.02438"
y="265.61899"
id="tspan91">ported to another hardware. Our solution is hardware </tspan><tspan
x="190.02438"
y="268.26483"
id="tspan92">specific for training but hardware agnostic in its </tspan><tspan
x="190.02438"
y="270.91068"
id="tspan93">design and capabilities.</tspan></text><path
id="path101"
style="color:#000000;fill:#000000;-inkscape-stroke:none"
d="M 136.23453,106.54263 V 90.76529 c -1.83131,-0.12865 -3.28145,-1.65766 -3.28145,-3.52122 0,-1.94765 1.5834,-3.531573 3.53105,-3.531573 1.94765,0 3.53156,1.583923 3.53156,3.531573 0,1.86356 -1.45014,3.39257 -3.28145,3.52122 v 15.77734 z m 0.2496,-16.26723 c 1.67743,0 3.03134,-1.3539 3.03134,-3.03133 0,-1.67743 -1.35391,-3.031343 -3.03134,-3.031343 -1.67743,0 -3.03082,1.353913 -3.03082,3.031343 0,1.67743 1.35339,3.03133 3.03082,3.03133 z" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;stroke-width:0.264583"
x="132.1333"
y="110.24815"
id="text102"><tspan
id="tspan101"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';stroke-width:0.264583"
x="132.1333"
y="110.24815"
sodipodi:role="line">2005</tspan></text><rect
style="fill:#cccccc;fill-opacity:1;stroke:#1a1a1a;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect102"
width="56.667709"
height="41.683708"
x="110.00934"
y="111.3315"
ry="1.3401735" /><rect
style="fill:#ffc6a0;fill-opacity:1;stroke:#ff6803;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect103"
width="59.49057"
height="11.870605"
x="108.39667"
y="111.3315"
ry="1.3401735" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:78.7407;display:inline;stroke-width:0.264583"
x="320.76639"
y="166.06209"
id="text105"
transform="matrix(0.72076737,0,0,0.72076737,-121.08064,-4.4026833)"><tspan
x="320.76639"
y="166.06209"
id="tspan95">Detecting Stealth Software with </tspan><tspan
x="320.76639"
y="170.91278"
id="tspan96">Strider GhostBuster</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.11667px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:54.6704;display:inline;stroke-width:0.264583"
x="190.02438"
y="196.82707"
id="text106"
transform="translate(-78.825247,-54.909023)" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.11667px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:54.6704;display:inline;stroke-width:0.264583"
x="190.02438"
y="196.82707"
id="text72"
transform="translate(-79.14574,-70.087023)"><tspan
x="190.02438"
y="196.82707"
id="tspan97">- Their solution relies on the comparison of two </tspan><tspan
x="190.02438"
y="199.47292"
id="tspan98">snapshot made at the same time using two different </tspan><tspan
x="190.02438"
y="202.11876"
id="tspan99">mechanism, assuming one goes through the hidden malware </tspan><tspan
x="190.02438"
y="204.7646"
id="tspan100">and one does not. The method is called cross-view diff.
</tspan><tspan
x="190.02438"
y="207.41045"
id="tspan102">- In a sense, there is a parallel to be drawn between </tspan><tspan
x="190.02438"
y="210.05629"
id="tspan103">their approach an mine. I also doo a cross-view diff of </tspan><tspan
x="190.02438"
y="212.70213"
id="tspan104">the state ofthe machine but one of my view is the power </tspan><tspan
x="190.02438"
y="215.34798"
id="tspan105">and the other one is the process list.
</tspan><tspan
x="190.02438"
y="217.99382"
id="tspan106">- Our method only exposes CPU-consuming malware. The </tspan><tspan
x="190.02438"
y="220.63967"
id="tspan107">file-hiding malware are invisible to us.</tspan></text><path
id="path72"
style="color:#000000;fill:#000000;-inkscape-stroke:none"
d="m 185.43665,67.933517 v 15.77734 c -1.83131,0.12865 -3.28145,1.657663 -3.28145,3.521223 0,1.94765 1.5834,3.53157 3.53105,3.53157 1.94765,0 3.53156,-1.58392 3.53156,-3.53157 0,-1.86356 -1.45014,-3.392573 -3.28145,-3.521223 v -15.77734 z m 0.2496,16.26723 c 1.67743,0 3.03134,1.353903 3.03134,3.031333 0,1.67743 -1.35391,3.03134 -3.03134,3.03134 -1.67743,0 -3.03082,-1.35391 -3.03082,-3.03134 0,-1.67743 1.35339,-3.031333 3.03082,-3.031333 z" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;stroke-width:0.264583"
x="181.33542"
y="67.18058"
id="text73"><tspan
id="tspan72"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';stroke-width:0.264583"
x="181.33542"
y="67.18058"
sodipodi:role="line">2005</tspan></text><rect
style="fill:#cccccc;fill-opacity:1;stroke:#1a1a1a;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect73"
width="56.667709"
height="41.683708"
x="159.21146"
y="20.624043"
ry="1.3401735" /><rect
style="fill:#ffc6a0;fill-opacity:1;stroke:#ff6803;stroke-width:0.577775;stroke-dasharray:none;stroke-opacity:1"
id="rect74"
width="59.49057"
height="15.626968"
x="157.59879"
y="16.86768"
ry="1.3401735" /><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;font-size:3.88056px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono Bold';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:78.7407;display:inline;stroke-width:0.264583"
x="320.76639"
y="166.06209"
id="text75"
transform="matrix(0.72076737,0,0,0.72076737,-71.878518,-99.356979)"><tspan
x="320.76639"
y="166.06209"
id="tspan108">Stealthy Malware Detection Through </tspan><tspan
x="320.76639"
y="170.91278"
id="tspan109">VMM-BasedS“Out-of-the-Box” Semantic </tspan><tspan
x="320.76639"
y="175.76347"
id="tspan110">View Reconstructiontealthy Malware </tspan><tspan
x="320.76639"
y="180.61416"
id="tspan111">Detection Through VMM-Based</tspan></text><text
xml:space="preserve"
style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:2.11667px;line-height:1.25;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';letter-spacing:-0.291042px;word-spacing:0px;white-space:pre;inline-size:54.6704;display:inline;stroke-width:0.264583"
x="190.02438"
y="196.82707"
id="text76"
transform="translate(-29.943618,-160.79447)"><tspan
x="190.02438"
y="196.82707"
id="tspan112">Important paper in the field. Lots of citation.
</tspan><tspan
x="190.02438"
y="199.47292"
id="tspan113">
</tspan><tspan
x="190.02438"
y="202.11876"
id="tspan114">- They claim to have a method that is &quot;Out-of-the-Box&quot; </tspan><tspan
x="190.02438"
y="204.7646"
id="tspan115">opposit to the host-based methods. This follows the </tspan><tspan
x="190.02438"
y="207.41045"
id="tspan116">same idea that we have for independance but we take it </tspan><tspan
x="190.02438"
y="210.05629"
id="tspan117">one step further, making it &quot;out-of-the-case/rack&quot; for </tspan><tspan
x="190.02438"
y="212.70213"
id="tspan118">complete and undeniable independence. Their method only </tspan><tspan
x="190.02438"
y="215.34798"
id="tspan119">work on VM because there is a place between the VM and </tspan><tspan
x="190.02438"
y="217.99382"
id="tspan120">the hardware to install their detector. Our method is </tspan><tspan
x="190.02438"
y="220.63967"
id="tspan121">applicable to any hardware.</tspan></text><circle
style="fill:#cccccc;fill-opacity:1;stroke:#000000;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none"
id="path76"
cx="-404.80991"
cy="185.1604"
r="22.767"
transform="rotate(-150)" /><text
xml:space="preserve"
style="font-size:4.5861px;line-height:5.70346px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:2.1;stroke-linejoin:round"
id="text77"
transform="translate(-1.4757142,-1.8781817)"><textPath
xlink:href="#path76"
id="textPath86"><tspan
id="tspan77"
style="fill:#000000;stroke:none;stroke-width:2.1">Target OS</tspan></textPath></text><text
xml:space="preserve"
style="font-size:4.5861px;line-height:5.70346px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:2.1;stroke-linejoin:round"
x="424.49768"
y="43.393692"
id="text78"><tspan
sodipodi:role="line"
id="tspan78"
style="fill:#000000;stroke:none;stroke-width:2.1"
x="424.49768"
y="43.393692">Host-Based IDS</tspan></text><text
xml:space="preserve"
style="font-size:4.5861px;line-height:5.70346px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:2.1;stroke-linejoin:round"
id="text79"
transform="translate(-2.0123375,-1.2074025)"><textPath
xlink:href="#path78"
id="textPath87"><tspan
id="tspan79"
style="fill:#000000;stroke:none;stroke-width:2.1">Hardware</tspan></textPath></text><text
xml:space="preserve"
style="font-size:4.5861px;line-height:5.70346px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:2.1;stroke-linejoin:round"
x="430.40054"
y="4.8795161"
id="text80"><tspan
sodipodi:role="line"
id="tspan80"
style="fill:#000000;stroke:none;stroke-width:2.1"
x="430.40054"
y="4.8795161">VM Monitors</tspan></text><text
xml:space="preserve"
style="font-size:4.5861px;line-height:5.70346px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:2.1;stroke-linejoin:round"
x="421.81458"
y="-23.579235"
id="text86"><tspan
sodipodi:role="line"
id="tspan81"
style="fill:#000000;stroke:none;stroke-width:2.1"
x="421.81458"
y="-23.579235">Physics-Based IDS</tspan></text><text
xml:space="preserve"
style="font-size:4.5861px;line-height:5.70346px;font-family:'Adwaita Mono';-inkscape-font-specification:'Adwaita Mono';text-align:start;letter-spacing:0px;writing-mode:lr-tb;direction:ltr;text-anchor:start;fill:#000000;stroke:none;stroke-width:2.1;stroke-linejoin:round"
id="text88"
transform="translate(-1.8877159,-1.615455)"><textPath
xlink:href="#path87"
id="textPath88">Server Room</textPath></text><path
style="fill:none;fill-opacity:1;stroke:#ffb37e;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;marker-start:url(#Dot)"
d="M 427.02924,4.6755133 C 361.20707,11.587768 304.15054,22.636116 216.62419,24.122327"
id="path88"
sodipodi:nodetypes="cc" /><path
style="fill:none;fill-opacity:1;stroke:#ffb37e;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;marker-start:url(#Dot)"
d="M 420.38886,13.497726 C 378.0926,35.018806 321.13093,116.07567 233.60458,117.56189"
id="path89"
sodipodi:nodetypes="cc" /></g></svg>
Side by side

After

Width:  |  Height:  |  Size: 30 KiB