I3FS: An in-kernel integrity checker and intrusion detection file system

LISA 2004 - 18th Large Installation System Administration Conference

Volumn , Issue , 2004, Pages 67-77

  Patil, Swapnil ^a   Kashyap, Anand ^a   Sivathanu, Gopalan ^a   Zadok, Erez ^a  

^a STONY BROOK UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER OPERATING SYSTEMS; FILE ORGANIZATION; INTRUSION DETECTION; NETWORK SECURITY;

ATTACK DETECTION; DETECTING ATTACKS; INTEGRITY CHECKING; OPEN SOURCES; PERFORMANCE DEGRADATION; STACKABLE FILE SYSTEM; SYSTEM ADMINISTRATORS; UNAUTHORIZED MODIFICATION;

OPEN SYSTEMS;

EID: 84889668111     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (28)

1. Aranya, A., C. P. Wright, and E. Zadok, "Tracefs: A File System to Trace Them All, " Proceedings of the Third USENIX Conference on File and Storage Technologies (FAST 2004), pp. 129-143, March/April 2004.
2. CERT Coordination Center, CERT/CC Overview incident and Vulnerability Tre n d s Te c h n i c a l Report, http://www.cert.org/present/cert-overviewtrends.
3. Craig, W. and P. McNeal, "Radmind: The Integration of Filesystem Integrity Checking with File System Management, " Proceedings of the 17th USENIX Large Installation System Administration Conference (LISA 2003), October 2003.
4. DesAutels, P. A., SHA1: Secure Hash Algorithm, http://www.w3.org/PICS/DSig/SHA1_1_0.html, 1997.
5. Deutsch, P., Independent Implementation of MD5 (RFC 1321), http://www.opensource.apple.com/ darwinsource/10.2.3/cups-30/cups.
6. Garfinkel, T. and M. Rosenblum, "A Virtual Machine Introspection Based Architecture for Intrusion Detection, Proceedings of the Network and Distributed System Security Symposium, February 2003.
7. Ghemawat, S., H. Gobioff, and S.-T. Leung, "The Google File System, " Proceedings of the 19th ACM Symposium on Operating Systems Principles (SOSP '03), pages 29-43, October 2003.
8. Kashyap, A., J. Dave, M. Zubair, C. P. Wright, and E. Zadok, Using Berkeley Database in the Linux kernel, http://www.fsl.cs.sunysb.edu/project-kbdb. html, 2004.
9. Kim, G. and E. Spafford, "Experiences with Tripwire: Using Integrity Checkers for Intrusion Detection, " Proceedings of the Usenix System Administration, Networking and Security (SANS III), 1994.
10. Kim, G. and E. Spafford, "The Design and Implementation of Tripwire: A File System Integrity Checker, " Proceedings of the Second ACM Conference on Computer Communications and Society (CCS), November 1994.
11. King, S. and P. Chen, "Backtracking Intrusions, " Proceedings of the 19th ACM Symposium on Operating Systems Principles (SOSP '03), October 2003.
12. LIDS Project, Linux Intrusion Detection System, http://www.lids.org.
13. Muniswamy-Reddy, K., C. P. Wright, A. Himmer, and E. Zadok, "A Versatile and User-Oriented Versioning File System, " Proceedings of the Third USENIX Conference on File and Storage Technologies (FAST 2004), pp. 115-128, March/April 2004.
14. Nechvatal, J., E. Barker, L. Bassham, W. Burr, M. Dworkin, J. Foti, and E. Roback, Report on the Development of the Advanced Encryption Standard (AES), Technical report, Department of Commerce: National Institute of Standards and Technology, October 2000.
15. Osiris, Osiris: Host Integrity Management Tool, http://www.osiris.com.
16. Pendry, J. S., N. Williams, and E. Zadok, Am-utils User Manual, 6.1b3 edition, http;//www.am-utils. org, July 2003.
17. Provos, N., "Improving Host Security with System Call Policies, " Proceedings of the 12th Annual USENIX Security Symposium, August 2003.
18. Reed, J., File Integrity Checking with AIDE, http:// www.ifokr.org/bri/presentations/aide_gslug-2003/, 2003.
19. Rivest, R. L., "RFC 1321: The MD5 Message- Digest Algorithm, " Internet Activities Board, April 1992.
20. Samhain Labs, Samhain: File System Integrity Checker, http://samhain.sourceforge.net.
21. Seltzer, M. and O. Yigit, "A New Hashing Package for UNIX, " Proceedings of the Winter USENIX Te c h n i c a l Conference, pp. 173-84, http://www. sleepycat.com, January 1991.
22. Tripwire Inc, Tripwire Software, http://www.tripwire. com.
23. VERITAS Software, VERITAS File Server Edition Performance Brief: A PostMark 1.11 Benchmark Comparison, Technical Report, Veritas Software Corporation, http://eval.veritas.com/webfiles/docs/ fsedition-postmark.pdf, June 1999.
24. Wright, C., C. Cowan, J. Morris, S. Smalley, and G. Kroah Hartman, "Linux Security Modules: General Security Support for the Linux Kernel, " Proceedings of the 11th USENIX Security Symposium, August 2002.
25. Wright, C. P., M. Martino, and E. Zadok, "Cryptfs: A Secure and Convenient Cryptographic File System, " Proceedings of the Annual USENIX Technical Conference, pp. 197-210, June 2003.
26. Zadok, E. and I. Badulescu, "A Stackable File System Interface for Linux, " LinuxExpo Conference Proceedings, pages 141-151, May 1999.
27. Zadok, E., I. Badulescu, and A. Shender, "Cryptfs: A Stackable Vnode Level Encryption File System, " Technical Report CUCS-021-98, Computer Science Department, Columbia University, http://www.cs.columbia.edu/library, June 1998.
28. Zadok, E. and J. Nieh, "FiST: A Language for Stackable File Systems, " Proceedings of the Annual USENIX Technical Conference, pp. 55-70, June 2000.