Typescript. Includes bibliographical references (leaves 63-66).

Thesis (M.S.)--Brigham Young University. Dept. of Computer Science, 2005. / Includes bibliographical references (p. 69-71).

Thesis (M.S. in Computer Science)--Naval Postgraduate School, March 2005. / Thesis Advisor(s): Wen Su. Includes bibliographical references (p. 77-79). Also available online.

Thesis (Ph.D.)--University of Delaware, 2006. / Principal faculty advisor: Gonzalo R. Arce, Dept. of Electrical and Computer Engineering. Includes bibliographical references.

Thesis (Ph. D.)--Florida State University, 2006. / Advisor: Daniel G. Schwartz, Florida State University, College of Arts and Sciences, Dept. of Computer Science. Title and description from dissertation home page (viewed Sept. 18, 2006). Document formatted into pages; contains xii, 114 pages. Includes bibliographical references.

Thesis (M.S.)--Wake Forest University. Dept. of Computer Science, 2005. / Vita. Includes bibliographical references (leaves 66-68)

Within the World Wide Web (WWW), malware is considered one of the most serious threats to system security with complex system issues caused by malware and spam. Networks and systems can be accessed and compromised by various types of malware, such as viruses, worms, Trojans, botnet and rootkits, which compromise systems through coordinated attacks. Malware often uses anti-forensic techniques to avoid detection and investigation. Moreover, the results of investigating such attacks are often ineffective and can create barriers for obtaining clear evidence due to the lack of sufficient tools and the immaturity of forensics methodology. This research addressed various complexities faced by investigators in the detection and analysis of malware. In this thesis, the author identified the need for a new approach towards malware detection that focuses on a robust framework, and proposed a solution based on an extensive literature review and market research analysis. The literature review focussed on the different trials and techniques in malware detection to identify the parameters for developing a solution design, while market research was carried out to understand the precise nature of the current problem. The author termed the new approaches and development of the new framework the triple-tier centralised online real-time environment (tri-CORE) malware analysis (TCMA). The tiers come from three distinctive phases of detection and analysis where the entire research pattern is divided into three different domains. The tiers are the malware acquisition function, detection and analysis, and the database operational function. This framework design will contribute to the field of computer forensics by making the investigative process more effective and efficient. By integrating a hybrid method for malware detection, associated limitations with both static and dynamic methods are eliminated. This aids forensics experts with carrying out quick, investigatory processes to detect the behaviour of the malware and its related elements. The proposed framework will help to ensure system confidentiality, integrity, availability and accountability. The current research also focussed on a prototype (artefact) that was developed in favour of a different approach in digital forensics and malware detection methods. As such, a new Toolkit was designed and implemented, which is based on a simple architectural structure and built from open source software that can help investigators develop the skills to critically respond to current cyber incidents and analyses.

Ph.D. / This thesis is a theoretical treatise on a proposed new computer security system, based on a biological immune system. Modem day network-centric computing is fast approaching the density and complexity of biological organisms, making biological and computer analogies relevant and meaningful. The success of biological immune systems in protecting life over countless millennia is well known. It is therefore postulated that a highly effective defensive mechanism can be developed, to transparently enforce an acceptable level of security in very extensive and complex computer networks and systems. It can be done by building very basic, but specialized autonomous software agents, functioning in a hierarchical system, that follow basic rules that can be deduced from biological immune systems. The computer security model proposed in this thesis does not require radical new technologies and it is extremely simple. The complexity however, lies in the effective implementation of the model. Three building blocks support the computer immune model: Biology, software agent technology and nanotechnology. The main features of the model are: • Firstly, it allows computer systems to automatically and transparently protect themselves, by using mobile autonomous intelligent software agents in an artificial immune system, based on biological immune systems. • Secondly, it allows computer systems to be pro-active in protecting themselves by being able to discern between which components are part of themselves (trusted system), and which components are foreign and may thus be harmful. Although part of the model relies on specialist human collaboration and international security standards, the main thrust is the heuristic ability of the proposed computer immune system. It allows systems to learn to recognize and cope with previously unknown cyber-antigens, automatically share the information amongst the participating computer systems, and thus 'inoculate' them to render them immune to similar attacks.

M.Com. (Computer Science) / Please refer to full text to view abstract

M.Com. (Computer Auditing) / Please refer to full text to view abstract