Search

The use of Ethernet and Linux is becoming common in industrial applications, even for those with real-time requirements, although neither of them were originally designed for this purpose. The emergence of Industry 4.0 (also known as Industrial Internet of Things, IIoT) has encouraged the evolution of these technologies to better handle real-time issues. On the one hand, Linux now supports mechanisms to configure certain real-time parameters, as well as core isolation and interrupt allocation facilities in multicore processors. On the other hand, the set of Ethernet standards IEEE 802.1 Time-Sensitive Networking (TSN) includes a high precision clock synchronization protocol (IEEE 802.1AS). The purpose of this work is to outline an execution framework for distributed systems based on TSN and Linux, which allows the execution of time-aware applications. We have studied and evaluated different configurations available for the proposed execution framework. In particular, a detailed characterization of the clock synchronization mechanism, from the application point of view, has been performed. Some conclusions about the current real-time capabilities of these technologies are also presented. [ABSTRACT FROM AUTHOR]

With the new personal data protection or export control regulations, the principle of least privilege is mandatory and must be applied even for system administrators. This article explores the different approaches implemented by the main operating systems (namely Linux, Windows, FreeBSD, and Solaris) to control the privileges of system administrators in order to enforce the principle of least privilege. We define a set of requirements to manage these privileges properly, striving to balance adherence to the principle of least privilege and usability. We also present a deep analysis of each administrative privilege system based on these requirements and exhibit their benefits and limitations. This evaluation also covers the efficiency of the currently available solutions to assess the difficulty of performing administrative privileges management tasks. Following the results, the article presents the RootAsRole project, which aims to simplify Linux privilege management. We describe the new features introduced by the project and the difficulties we faced. This concrete experience allows us to highlight research challenges. [ABSTRACT FROM AUTHOR]

Collecting digital evidence in Linux can be said to be an important research field because it is possible to collect and analyze evidence from a digital forensics perspective in the event of an infringement accident in Linux. However, in general, digital forensics performs digital forensics based on Windows, and because of the nature of Linux, each type of Linux operates slightly differently, there are many difficulties in collecting evidence. Even if evidence is collected, software problems that are not trusted from a digital forensics perspective arise. Based on this, the digital forensics technique in Linux has been studied, but when the studied results are confirmed, the possibility of modulation cannot but be ruled out due to the nature of digital data in order to use the built-in tool. Therefore, this paper proposes an effective digital evidence collection method in a Linux-based system by extending the digital forensics technique of Linux studied above. [ABSTRACT FROM AUTHOR]

Some of the most deployed infrastructures nowadays are Overlay Networks (ONs). They consist of hardware and software components designed to establish private and secure communication channels, typically over the Internet. ONs are among the most reliable technologies for achieving this objective and represent the next-generation solution for secure communication. In this paper, we analyze important network performance metrics (RTT, bandwidth) while varying the type of Overlay Network used for interconnecting traffic between two or more hosts (within the same data center, in different data centers in the same building, or over the Internet). These networks establish connections between KVM (Kernel-based Virtual Machine) instances rather than the typical Docker/LXC/Podman containers. The first analysis will assess network performance as it is, without any overlay channels. The second will establish various types of channels without encryption, and the final one will encapsulate overlay traffic via IPsec (Transport mode), where encrypted channels like VTI are not already available for use. The obtained performance is demonstrated through a comprehensive set of traffic-simulation campaigns.

In the context of the internet of things, and particularly within distributed measurement systems that are subject to high privacy risks, it is essential to emphasize the need for increasingly effective privacy protections. The idea presented in this work involves managing critical traffic through an architectural proposal aimed at solving the problem of communications between nodes by optimizing both the confidentiality to be guaranteed to the payload and the transmission speed. Specifically, data such as a typical sensor on/off signal could be sent via a standard encrypted channel, while a sensitive aggregate could be transmitted through a dedicated private channel. Additionally, this work emphasizes the critical importance of optimizing message sizes to 5 k-bytes (small payload messages) for transmission over the reserve channel, enhancing both privacy and system responsiveness, a mandatory requirement in distributed measurement systems. By focusing on small, encrypted payloads, the study facilitates secure, timely updates and summaries of network conditions, maintaining the integrity and privacy of communications in even the most challenging and privacy-sensitive environments. This study provides a comprehensive performance analysis of IoT networks using Dark Net technologies and MQTT protocols, with a focus on privacy and anonymity. It highlights the trade-offs between enhanced security and performance, noting increased latency, reduced bandwidth, and network instability when using TOR, particularly with cipher suites like AES256-GCM-SHA384 and DHE-RSA-CHACHA20-POLY1305. The research emphasizes the need for further exploration of alternative protocols like LWM2M in secure IoT environments and calls for optimization to balance privacy with performance in Dark-Net-based IoT deployments. [ABSTRACT FROM AUTHOR]

Some of the most deployed infrastructures nowadays are Overlay Networks (ONs). They consist of hardware and software components designed to establish private and secure communication channels, typically over the Internet. ONs are among the most reliable technologies for achieving this objective and represent the next-generation solution for secure communication. In this paper, we analyze important network performance metrics (RTT, bandwidth) while varying the type of Overlay Network used for interconnecting traffic between two or more hosts (within the same data center, in different data centers in the same building, or over the Internet). These networks establish connections between KVM (Kernel-based Virtual Machine) instances rather than the typical Docker/LXC/Podman containers. The first analysis will assess network performance as it is, without any overlay channels. The second will establish various types of channels without encryption, and the final one will encapsulate overlay traffic via IPsec (Transport mode), where encrypted channels like VTI are not already available for use. The obtained performance is demonstrated through a comprehensive set of traffic-simulation campaigns. [ABSTRACT FROM AUTHOR]

Nowadays, some of the most well-deployed infrastructures are Virtual Private Networks (VPNs) and Overlay Networks (ONs). They consist of hardware and software components designed to build private/secure channels, typically over the Internet. They are currently among the most reliable technologies for achieving this objective. VPNs are well-established and can be patched to address security vulnerabilities, while overlay networks represent the next-generation solution for secure communication. In this paper, for both VPNs and ONs, we analyze some important network performance components (RTT and bandwidth) while varying the type of overlay networks utilized for interconnecting traffic between two or more hosts (in the same data center, in different data centers in the same building, or over the Internet). These networks establish connections between KVM (Kernel-based Virtual Machine) instances rather than the typical Docker/LXC/Podman containers. The first analysis aims to assess network performance as it is, without any overlay channels. Meanwhile, the second establishes various channels without encryption and the final analysis encapsulates overlay traffic via IPsec (Transport mode), where encrypted channels like VTI are not already available for use. A deep set of traffic simulation campaigns shows the obtained performance. [ABSTRACT FROM AUTHOR]

In the last decade, the market share and user base of social media applications have witnessed significant growth. However, this surge in popularity has inadvertently drawn the attention of criminals aiming to exploit these platforms for illicit activities. The forensic examination of these applications emerges as a pivotal avenue for uncovering valuable insights into criminal behavior and identifying suspects. Discord, a social media platform, has become a significant focal point for such illicit activities. In this paper, we examine the remnants of Discord on both Windows and Linux operating systems, employing storage, memory, and network analysis techniques to review the remnants of Discord. Our investigation reveals a range of crucial artifacts that have been successfully recovered across all three areas of analysis, including login and payment details, chat history, account information, and much more. Collectively, these artifacts constitute a valuable resource for forensic investigations, allowing the reconstruction of most of the user's activity. [ABSTRACT FROM AUTHOR]

Filesystems are essential components in contemporary computer systems that organize and manage data. Their performance is crucial in various applications, from web servers to data storage systems. This paper helps to pick the suitable filesystem by comparing btrfs with ZFS by considering multiple situations and applications, ranging from sequential and random performance in the most common use cases to extreme use cases like high-performance computing (HPC). It showcases each option's benefits and drawbacks, considering different usage scenarios. The performance of btrfs and ZFS will be evaluated through rigorous testing. They will assess their capabilities in handling huge files, managing numerous small files, and the speed of data read and write across varied usage levels. The analysis indicates no definitive answer; the selection of the optimal filesystem is contingent upon individual data-access requirements. [ABSTRACT FROM AUTHOR]

The widespread adoption of Internet of Things (IoT) devices in home, industrial, and business environments has made available the deployment of innovative distributed measurement systems (DMS). This paper takes into account constrained hardware and a security-oriented virtual local area network (VLAN) approach that utilizes local message queuing telemetry transport (MQTT) brokers, transport layer security (TLS) tunnels for local sensor data, and secure socket layer (SSL) tunnels to transmit TLS-encrypted data to a cloud-based central broker. On the other hand, the recent literature has shown a correlated exponential increase in cyber attacks, mainly devoted to destroying critical infrastructure and creating hazards or retrieving sensitive data about individuals, industrial or business companies, and many other entities. Much progress has been made to develop security protocols and guarantee quality of service (QoS), but they are prone to reducing the network throughput. From a measurement science perspective, lower throughput can lead to a reduced frequency with which the phenomena can be observed, generating, again, misevaluation. This paper does not give a new approach to protect measurement data but tests the network performance of the typically used ones that can run on constrained hardware. This is a more general scenario typical for IoT-based DMS. The proposal takes into account a security-oriented VLAN approach for hardware-constrained solutions. Since it is a worst-case scenario, this permits the generalization of the achieved results. In particular, in the paper, all OpenSSL cipher suites are considered for compatibility with the Mosquitto server. The most used key metrics are evaluated for each cipher suite and QoS level, such as the total ratio, total runtime, average runtime, message time, average bandwidth, and total bandwidth. Numerical and experimental results confirm the proposal's effectiveness in foreseeing the minimum network throughput concerning the selected QoS and security. Operating systems yield diverse performance metric values based on various configurations. The primary objective is identifying algorithms to ensure suitable data transmission and encryption ratios. Another aim is to explore algorithms that ensure wider compatibility with existing infrastructures supporting MQTT technology, facilitating secure connections for geographically dispersed DMS IoT networks, particularly in challenging environments like suburban or rural areas. Additionally, leveraging open firmware on constrained devices compatible with various MQTT protocols enables the customization of the software components, a crucial necessity for DMS. [ABSTRACT FROM AUTHOR]

Copyright of Computer Measurement & Control is the property of Magazine Agency of Computer Measurement & Control and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This paper presents an empirical study on the application of Large Language Model (LLM)-based AI agents for automating server management tasks in Linux environments. We aim to evaluate the effectiveness, efficiency, and adaptability of LLM-based AI agents in handling a wide range of server management tasks, and to identify the potential benefits and challenges of employing such agents in real-world scenarios. We present an empirical study where a GPT-based AI agent autonomously executes 150 unique tasks across 9 categories, ranging from file management to editing to program compilations. The agent operates in a Dockerized Linux sandbox, interpreting task descriptions and generating appropriate commands or scripts. Our findings reveal the agent’s proficiency in executing tasks autonomously and adapting to feedback, demonstrating the potential of LLMs in simplifying complex server management for users with varying technical expertise. This study contributes to the understanding of LLM applications in server management scenarios, and paves the foundation for future research in this domain.

When developing IoT devices, technologies that automatically plug and play sensor/actuator into the device have been studied. They are the IEEE1451 standard, ETRI standard, and our techniques. There are studies that have qualitatively analyzed each characteristic, but none have quantitatively compared and analyzed them. The problem is that the cost analysis is complicated because the Plug & Play techniques include standard system development, sensor/actuator module development, and application development. In this paper, Platform based Cost Analysis Scheme was proposed, and the cost of each method was analyzed based on this. For cost analysis, a number of experts estimated the development complexity and analyzed the cost based on the national standard cost table. As a result, it was shown that the cost of our techniques was the smallest. [ABSTRACT FROM AUTHOR]

The data transmission of the heaven and the earth integrated network based on IP(Internet Protocol) technology is vulnerable to illegal attacks. The traditional network security device based on IPSec(Internet Protocol Security) is designed by connecting a single host to both internal and external network processing units, which has the risk of unauthorized users directly accessing the protected intranet through the extranet. A new scheme for a network security device based on a red-black isolation architecture is proposed. The scheme adopts the design concept of red-black partition and VPN technology based on IPSec framework under Linux. It implements the validity verification of the transmitted data based on the "quintuple" security and security rules and the encapsulation and decapsulation transformation of the IPSec ESP protocol in the red zone, and implements the public network sending and receiving of the ESP encapsulated and encrypted data in the black zone. In this scheme, the security service module implements dynamic switching of encryption algorithms and encryption and decryption of ESP encapsulated data according to external instructions, and uses the security service module as a data exchange channel between the red and black zones to achieve isolation between the internal and external networks and effectively ensure Intranet security. The experimental results show that the network security device based on red-black isolation architecture has the advantages of strong anti-attack capability, replaceable encryption algorithm, and encryption rate of 1 024 bytes packet length greater than 50 Mbit·s-1 under 100 megabit bandwidth. [ABSTRACT FROM AUTHOR]

The novel dataset called Linux-APT Dataset 2024 captures Advanced Persistent Threat (APT) attacks along with other latest and sophisticated payloads. Existing datasets lacks latest attacker's techniques and procedures, APTs tactics and configuration to capture maximum Linux log sources to observe the working and behaviour of an APT in a detailed manner. The environment which supported us in capturing the logs is composed of Linux machines and a centralized logging system configured appropriately to captures and detect all possible events and logs for an APT and other complex intrusion. Unlike Microsoft Windows, Linux logging system are investigated enough and usually systems relies on limited log sources but for an APT, all possible log sources should be evaluated and added to completely analyse the behaviour, trajectory, and operation of an APT. To keep the dataset up to date and realistic, recent payloads and APTs are emulated in the environment. A well-known cyber-security framework ‘MITRE ATT&CK’ is utilised to map the behaviour and operation in a generalized manner after capturing the events and logs. This dataset can be used for training and conducting a variety of experiments to build as well as design the solutions for detecting most recent intrusions and APT attacks for Linux System.

The surge in big data and analytics has catalysed the proliferation of cybercrime, largely driven by organisations’ intensified focus on gathering and processing personal data for profit while often overlooking security considerations. Hadoop and its derivatives are prominent platforms for managing big data; however, investigating security incidents within Hadoop environments poses intricate challenges due to scale, distribution, data diversity, replication, component complexity, and dynamicity. This paper proposes a big data digital forensics readiness framework and an incident response script for Linux–Hadoop environments, streamlining preliminary investigations. The framework offers a novel approach to digital forensics in the domains of big data and Hadoop environments. A prototype of the incident response script for Linux–Hadoop environments was developed and evaluated through comprehensive functionality and usability testing. The results demonstrated robust performance and efficacy.

In the context of the internet of things, and particularly within distributed measurement systems that are subject to high privacy risks, it is essential to emphasize the need for increasingly effective privacy protections. The idea presented in this work involves managing critical traffic through an architectural proposal aimed at solving the problem of communications between nodes by optimizing both the confidentiality to be guaranteed to the payload and the transmission speed. Specifically, data such as a typical sensor on/off signal could be sent via a standard encrypted channel, while a sensitive aggregate could be transmitted through a dedicated private channel. Additionally, this work emphasizes the critical importance of optimizing message sizes to 5 k-bytes (small payload messages) for transmission over the reserve channel, enhancing both privacy and system responsiveness, a mandatory requirement in distributed measurement systems. By focusing on small, encrypted payloads, the study facilitates secure, timely updates and summaries of network conditions, maintaining the integrity and privacy of communications in even the most challenging and privacy-sensitive environments. This study provides a comprehensive performance analysis of IoT networks using Dark Net technologies and MQTT protocols, with a focus on privacy and anonymity. It highlights the trade-offs between enhanced security and performance, noting increased latency, reduced bandwidth, and network instability when using TOR, particularly with cipher suites like AES256-GCM-SHA384 and DHE-RSA-CHACHA20-POLY1305. The research emphasizes the need for further exploration of alternative protocols like LWM2M in secure IoT environments and calls for optimization to balance privacy with performance in Dark-Net-based IoT deployments.

Nowadays, some of the most well-deployed infrastructures are Virtual Private Networks (VPNs) and Overlay Networks (ONs). They consist of hardware and software components designed to build private/secure channels, typically over the Internet. They are currently among the most reliable technologies for achieving this objective. VPNs are well-established and can be patched to address security vulnerabilities, while overlay networks represent the next-generation solution for secure communication. In this paper, for both VPNs and ONs, we analyze some important network performance components (RTT and bandwidth) while varying the type of overlay networks utilized for interconnecting traffic between two or more hosts (in the same data center, in different data centers in the same building, or over the Internet). These networks establish connections between KVM (Kernel-based Virtual Machine) instances rather than the typical Docker/LXC/Podman containers. The first analysis aims to assess network performance as it is, without any overlay channels. Meanwhile, the second establishes various channels without encryption and the final analysis encapsulates overlay traffic via IPsec (Transport mode), where encrypted channels like VTI are not already available for use. A deep set of traffic simulation campaigns shows the obtained performance.

In this scientific paper concealing text and executable files in JPG format files with a steganographic command-line tool in the Kali Linux operating system is presented. Among the myriad of steganographic tools, Steghide has gained prominence for its robust features and ease of use. Primarily focused on embedding and extracting secret messages within image files, the software tool Steghide enables users to encode text data within JPEG and BMP image formats while maintaining data integrity and minimizing visual alterations. This paper provides an in-depth examination of Steghide's functionality, workflow, and security considerations in the context of digital steganography. It is also discussed the algorithms underpinning Steghide's operations, its strengths, limitations and common use cases. [ABSTRACT FROM AUTHOR]

Copyright of Problems of Mechatronics. Armament, Aviation, Safety Engineering / Problemy Mechatroniki. Uzbrojenie, lotnictwo, Inżynieria Bezpieczeństwa is the property of Index Copernicus International and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

The Weather Research and Forecasting-Multi Operating System Installation Toolkit (WRF-MOSIT) is a set of scripting packages primarily developed for the automation, configuration, and installation of the standard Weather Research and Forecasting model (WRF), and other WRF applications: hurricane (HWRF), hydrological (WRF-Hydro) and chemical (WRF-Chem). The package consists of many tools for importing, configuring, and installing libraries, and undertaking a wide range of analyses to enhance scalability, performance, interoperability, and ease of use within a parallel computing environment. WRF-MOSIT is a cross-platform modular tool simplifies the installation process, automates configuration, and reduces the risk of errors during installation. It provides a simple and intuitive interface, which makes it easier for users who are not familiar with the installation process. This toolkit can be installed on the four main computer systems used in the atmospheric community: Debian Kernels, Darwin Kernels, Fedora & CentOS Kernels, and Windows Sub-System Linux Kernels, allowing users to install WRF on different systems without having to manually configure the system. The WRF-MOSIT toolkit is freely available on GitHub (https://github.com/HathewayWill/WRF-MOSIT). The toolkit improves efficiency by automating many of the steps involved in the WRF installation process, enabling users to spend less time on the installation process and more time on their research. Finally, insights are given for future developments. The purpose of the WRF-MOSIT is to alleviate the installation hurdles of installing all the requirements and supplementary files, software packages, and pre/post-processing tools to run the different WRF models. The WRF-MOSIT toolkit simplifies the installation process, automates configuration, and reduces errors when installing the WRF model. It is a cross-platform tool that can be installed on multiple operating systems, including Debian Kernels, Darwin Kernels, Fedora & CentOS Kernels, and Windows Sub-System Linux Kernels. The WRF-MOSIT toolkit provides an intuitive interface that makes it easier for users who are not familiar with the installation process to install the WRF model. This toolkit is freely available on GitHub and improves efficiency by automating many of the steps involved in the installation process, enabling users to spend more time on their research. The paper provides insights into future developments of the WRF-MOSIT toolkit, including the addition of more features and support for other coupled model packages. [ABSTRACT FROM AUTHOR]

The increase in online retail sales (e-commerce) in recent years is a trend that will hardly stop. Those systems need an infrastructure consisting of web servers, data stores, network equipment, and more, which can be costly to maintain. Cloud computing offers a wide variety of solutions for these infrastructure needs. However, the vast amount of cloud services, plans, and associated costs usually makes the choice difficult. A critical factor that needs to be considered in this decision is the overall system performance. For Brazilian websites, it is also essential that the service resides in the country to mitigate network communication latency. This paper presents a performance evaluation of Linux distributions offered by cloud computing services in Brazil. The experiments were conducted using the same web system hosted by different Linux distributions. We considered the requests served per second and the consumption of resources. The results demonstrate that a Linux distribution can influence a shopping portal’s performance.

Filesystems are essential components in contemporary computer systems that organize and manage data. Their performance is crucial in various applications, from web servers to data storage systems. This paper helps to pick the suitable filesystem by comparing btrfs with ZFS by considering multiple situations and applications, ranging from sequential and random performance in the most common use cases to extreme use cases like high-performance computing (HPC). It showcases each option’s benefits and drawbacks, considering different usage scenarios. The performance of btrfs and ZFS will be evaluated through rigorous testing. They will assess their capabilities in handling huge files, managing numerous small files, and the speed of data read and write across varied usage levels. The analysis indicates no definitive answer; the selection of the optimal filesystem is contingent upon individual data-access requirements.

In the current era of prevailing information technology, the requirement for high availability and reliability of various types of services is critical. This paper focusses on the comparison and analysis of different high-availability solutions for Linux container environments. The objective was to identify the strengths and weaknesses of each solution and to determine the optimal container approach for common use cases. Through a series of structured experiments, basic performance metrics were collected, including average service recovery time, average transfer rate, and total number of failed calls. The container platforms tested included Docker, Kubernetes, and Proxmox. On the basis of a comprehensive evaluation, it can be concluded that Docker with Docker Swarm is generally the most effective high-availability solution for commonly used Linux containers. Nevertheless, there are specific scenarios in which Proxmox stands out, for example, when fast data transfer is a priority or when load balancing is not a critical requirement. [ABSTRACT FROM AUTHOR]

In view of the diverse edge computing requirements of the 6G era, reconfigurable technology based on FPGAs can achieve lower latency and provide diversified services. Based on the idea of local dynamic reconfiguration, the ICAP interface is used to reconfigure FPGA resources, so as to realize the local dynamic reconfigurable scheme on the FPGA logic. Drawing on the idea of software process management in the operating system, based on the concept of introducing hardware processes in the Linux operating system, it is possible to divide a whole block of FPGA resources into multiple small FPGA resource blocks, each small reconfigurable FPGA resource block can be abstracted into a hardware process, the hardware process is actually not running on the CPU but running in the FPGA logical resource area, and is only a software language description of the hardware process on the operating system. As a result, the hardware scheme of CPU plus FPGA is designed to achieve partial reconfigurable system, and verified on Xilinx Zynq series chips, and the FPGA hardware resources are scheduled and allocated in a process manner, which greatly improves the utilization and flexibility of FPGA hardware resources.

An operating system kernel has the highest privilege in most computer systems, making its code integrity critical to the entire system’s security. Failure to protect the kernel code integrity allows an attacker to modify the kernel code pages directly or trick the kernel into executing instructions stored outside the kernel code pages. Existing prevention mechanisms rely on the memory management unit in which certain memory pages are marked as not-executable in supervisor mode to prevent such attacks. However, an attacker can bypass these existing mechanisms by directly manipulating the page table contents to mark the memory pages with malicious code as supervisor-executable. This paper shows that a small architectural extension enables a physical address-level mechanism to stop this threat without relying on page table integrity. PRIV LOCK lets, at boot time, the kernel specifies the physical address ranges containing its code. At run time, PRIV LOCK ensures that the content within the range is not manipulated and that only the instructions from those pages are executed while the processor runs in supervisor mode. Despite this protection, the kernel can still create new code pages (e.g., for loadable kernel modules) and make them executable with the help of PRIV LOCK ’s secure loader. The experimental results show that PRIV LOCK incurs low performance (