Kernel-mode rootkits represent a considerable threat to any computer system, as they provide an intruder with the ability to hide the presence of his malicious activity. These rootkits make changes to the operating system’s kernel, thereby providing particularly stealthy hiding techniques. This thesis addresses the problem of collecting reliable information from a system compromised by kernel-mode rootkits. It looks at the possibility of using virtualization as a means to facilitate kernel-mode rootkit detection through integrity checking. It describes several areas within the Linux kernel, which are commonly subverted by kernel-mode rootkits. Further, it introduces the reader to the concept of virtualization, before the kernel-mode rootkit threat is addressed through a description of their hiding methodologies. Some of the existing methods for malware detection are also described and analysed. A number of general requirements, which need to be satisfied by a general model enabling kernel-mode rootkit detection, are identified. A model addressing these requirements is suggested, and a framework implementing the model is set-up.

Knowledge management has become increasingly popular in the software industry. Knowledge is one of the software companies main asset, and large amounts of resources are being used to manage and re-use this knowledge. Management of architectural knowledge is also important, especially when dealing with software development. This is because a team with good architectural understanding will have a good chance at efficiently creating re-usable assets. In this thesis I will describe how a Scandinavian software company deals with knowledge management. I have also analyzed the management of architectural knowledge. These subjects have been viewed from both the managers and employees point of view, and I have compared the intentions of the managers, with how the employees actually perform. The research question: "How is domain- and architecture-knowledge managed in a Scandinavian software company?" is answered by describing and analyzing the data gathered by interviews in such a company. The thesis is concluded by summaries of the discussion and the analysis that has been done. My findings in the researched areas suggest that knowledge management practices are important but that they often are underestimated. The company wherein I have conducted my research does have a QA team and a re-use culture, this culture is described, however this thesis also points out areas in which the company can improve. The case-study is based upon qualitative analysis of the results from eight interviews conducted among managers and developers in the company. In the thesis I discuss the findings and report upon issues such as company culture, routines and goals in the areas of knowledge management. My findings have been generalized, and hopefully other companies can make use of them to improve their own knowledge management processes and goals.

A high amount of complex and urgent information needs timely attention in an operational environment. This requires specialized systems. These systems should provide immediate access to accurate and pertinent information when troubleshooting or controlling abnormal situations. This study is a collaboration between NTNU and Statoil Research Center. It aims at designing and developing a prototype to improve the operator's awareness of alarms, by means of a multi-modal virtual environment. This will be achieved by creating an extension to the virtual model SnøhvitSIM, using a spatial auditory display in addition to visual elements. The auditory display will provide (1) spatial information about new alarms and (2) information about the overall state of the facility. The system also offers (3) beacons to aid navigation within the virtual environment. To reach these goals, a comprehensive literature study was carried out, investigating similar concepts and various techniques for developing such systems. The development was prioritized in the following order, according to the main objectives: (1) design, (2) functionality and (3) architecture. Within the design-process, the main focus has been on the spatial auditory display. The development of the prototype proved successful. The feedback on the prototype reflects its value as a showcase for future development, containing new and potentially very effective solutions for tomorrow's alarm management systems.

The electronic patient record is primarily used as a way for clinicians to remember what has happened during the care of a patient. The electronic record also introduces an additional possibility, namely the use of computer based methods for searching, extracting and interpreting data patterns from the patient data. Potentially, such methods can help to reveal undiscovered medical knowledge from the patient record. This project aims to evaluate the usefulness of applying clustering methods to the patient record. Two clustering tasks are designed and accomplished, one that considers clustering of ICPC codes and one that considers medical certificates. The clusterings are performed by use of hierarchical clustering and k-means clustering. Distance measures used for the experiments are Lift correlation, the Jaccard coefficient and the Euclidian distance. Three indices for clustering validation are implemented and tested, namely the Dunn index, the modified Hubert $Gamma$ index and the Davies-Bouldin index. The work also points to the importance of dimensionality reduction for high dimensional data, for which PCA is utilised. The strategies are evaluated according to what degree they retrieve well-known medical knowledge owing to the fact that a strategy that retrieves a high degree of well-known knowledge are more likely to identify unknown medical information compared to a strategy that retrieves a lower degree of known information. The experiments show that, for some of the methods, clusters are formed that represent interesting medical knowledge, which indicates that clustering of a general practitioner's record can potentially constitute a contribution to further medical research.

Most people in the developed world depend on transportation, both privately and in business. Overpopulated roads lead to problems like traffic inefficiency, e.g. congestion, and traffic accidents. Intelligent Transport Systems (ITS) deals with the integration of information technology into the transport system. Through this, applications for improving traffic efficiency, traffic safety and the driving experience are introduced. This report is going to look at ITS systems in general, explore an international standard under development for communication systems designed for these kinds of applications (CALM), look at a project aimed to use this standard to create a international system for ITS applications (CVIS), and explore some of the proposed applications for this system. A few applications have been thoroughly described and analysed through the use of use cases. This has resulted in a set of test cases from which the applications can be evaluated. Through the execution of these test cases it would be possible to draw conclusions on whether or not the applications proposed will be viable in a real world situation.

As more and more sensitive information is entering web based applications, and thus are available through a web browser, securing these systems is of increasing importance. A software system accessible through the web is continuously exposed to threats, and is accessible to anyone who would like to attempt a break-in. These systems can not rely on only external measures like separate network zones and firewalls for security. Symantecs1 Internet Security Threat Report [34] is published every six months. Main findings in the last one published prove that there is an increase in threats to confidential information and more attacks aimed at web applications. Almost 48 percent of all vulnerabilities documented the last six months of 2004 were vulnerabilities in web applications. Security principles that one should pay attention to developing web applications do exist. This report have taken a look at existing guidelines, and provided an independent guide to developing secure web applications. These guidelines will be published at the homepage of The Centre for Information Security2 (SIS), www.norsis.no. The report also describes how a web application has been developed using the provided security guidelines as reference points. Relevant vulnerabilities and threats were identified and described. Misuse cases have related the various threats to specific system functionality, and a risk analysis ranks the threats in order to see which ones are most urgent. During the design phase, the application areas exposed to threats with a high rank from the risk analysis, have been at center of attention. This is also the case in the implementation phase, where countermeasures to some of these threats are provided on the Java platform. The implemented solutions can be adapted by others developing applications on this platform. The report comes to the conclusion, that the use of security guidelines throughout the entire development process is useful when developing a secure system. 1Symantec works with information security providing software, appliances and services designed to secure and manage IT infrastructures [33]. 2The Centre for Information Security (SIS) is responsible for coordinating activities related to Information and Communications Technology (ICT) security in Norway. The centre receives reports about security related incidents from companies and departments, and is working on obtaining an overall impression of threats towards Norwegian ICT systems [30].

This thesis presents a formal role-model based on a combination of approaches towards rolebased access control. This model is used both for access control and information ranking. Purpose: Healthcare information is required by law to be strictly secured. Thus an access control policy is needed, especially when this information is stored in a computer system. Roles, instead of just users, have been used for enforcing access control in computer systems. When a healthcare employee is granted access to information, only the relevant information should be presented by the system, providing better overview and highlighting critical information stored among less important data. The purpose of this thesis is to enable efficiency and quality improvements in healthcare by using IT-solutions that address both access control and information highlighting. Methods: We have developed a formal role model in a previous project. It has been manually tested, and some possible design choices were identified. The project report pointed out that more work was required, in the form of making design choices, implementing a prototype, and extending the model to comply with the Norwegian standard for electronic health records. In preparing this thesis, we reviewed literature about the extensions that we wanted to make to that model. This included deontic logic, delegation and temporal constraints. We made decisions on some of the possible design choices. Some of the topics that were presented in the previous project are also re-introduced in this thesis. The theories are explained through examples, which are later used as a basis for an illustrating scenario. The theory and scenario were used for requirement elicitation for the role-model, and for validating the model. Based on these requirements a formal role-model was developed. To comply with the Norwegian EHR standard the model includes delegation and context based access control. An access control list was also added to allow for patients to limit or deny access to their record information for any individual. To validate the model, we implemented parts of the model in Prolog and tested it with data from the scenario. Results: The test results show rankings for information and controls access to it correctly, thus validating the implemented parts of the model. Other results are a formal model, an executable implementation of parts of the model, recommendations for model design, and the scenario. Conclusions: Using the same role-model for access control and information ranking works, and allows using flexible ways to define policies and information needs.

With the emergence and growth of large databases of information, efficient methods for storage and processing are becoming increasingly important. The existence of a metric distance measure between data entities enables efficient index structures to be applied when storing the data. Unfortunately, this is often not the case. Amino acid substitution matrices, which are used to estimate similarities between proteins, do not yield metric distance measures. Finding efficient methods for converting a non-metric matrix into a metric one is therefore highly desirable. In this work, the problem of finding such conversions is approached by embedding the data contained in the non-metric matrix into a metric space. The embedding is optimized according to a quality measure which takes the original data into account, and a distance matrix is then derived using the metric distance function of the space. More specifically, an evolutionary scheme is proposed for constructing such an embedding. The work shows how a coevolutionary algorithm can be used to find a spatial embedding and a metric distance function which try to preserve as much of the proximity structure of the non-metrix matrix as possible. The evolutionary scheme is compared to three existing embedding algorithms. Some modifications to the existing algorithms are proposed, with the purpose of handling the data in the non-metric matrix more efficiently. At a higher level, the strategy of deriving a metric distance function from a spatial embedding is compared to an existing algorithm which enforces metricity by manipulating the data in the non-metric matrix directly (the triangle fixing algorithm). The methods presented and compared are general in the sense that they can be applied in any case where a non-metric matrix must be converted into a metric one, regardless of how the data in the non-metric matrix was originally derived. The proposed methods are tested empirically on amino acid substitution matrices, and the derived metric matrices are used to search for similarity in a database of proteins. The results show that the embedding approach outperforms the triangle fixing approach when applied to matrices from the PAM family. Moreover, the evolutionary embedding algorithms perform best among the embedding algorithms. In the case of the PAM250 scoring matrix, a metric distance matrix is found which is more sensitive than the mPAM250 matrix presented in a recent paper. Possible advantages of choosing one method over another are shown to be unclear in the case of matrices from the BLOSUM family.

This report describes a prototype middleware system for optimising transfer and processing times of XML based data between mobile, heterogeneous clients, supporting servers and context providers. The system will achieve these objectives by compressing or compacting the XML data in different ways, and using different parsing techniques. Two such techniques are examined more thoroughly, namely tag redundancy reduction, and binary compression. These optimisation techniques are implemented in a fully functioning XML data optimising system, and their effectiveness is tested and compared. A long term goal is discussed and considered in relation to these techniques: To develop a set of heuristic rules that will allow the system to determine dynamically which optimisation methods are most efficient at any given time based on available context data. The prototype system described is developed in Java, with a client for mobile devices written in Java2ME.

This report presents a three-step investigation conducted to identify problems and challenges experienced by small and medium sized organizations procuring software intensive systems. Archival research is carried out to see if the available procurement guidelines are applicable for small and medium sized organizations. Data has been collected through questionnaires and interviews with the organizations’ employees responsible for software procurements. The quantitative data has been analyzed using statistical methods, in an attempt to identify the main weaknesses in the current procurement procedures. In addition, the qualitative data are analyzed to complement the findings made from the quantitative data. Results indicate that the organizations who participated in the survey seldom follow a predefined procedure when they execute software procurements. However, organizations that do have a defined, formalized procurement procedure are significantly more satisfied with their procurements. In addition, risk management is seldom integrated in software procurements despite the fact that the organizations to some extent consider software procurement as a risky activity. Recommendations derived from the survey results are offered to increase the organization’s ability to procure and use software intensive systems.