No description available.

Proactive approaches for preventing attacks through security measurements are crucial for preventing sophisticated attacks. However, proactive measures must employ qualitative security metrics and systemic measurement methodologies to assess security guarantees, as some metrics (e.g., entropy) used for evaluating security guarantees may not capture the capabilities of advanced attackers. Also, many proactive measures (e.g., data pointer protection or data flow integrity) suffer performance bottlenecks. This dissertation identifies and represents attack vectors as metrics using the knowledge from advanced exploits and demonstrates the effectiveness of the metrics by quantifying attack surface and enabling ways to tune performance vs. security of existing defenses by identifying and prioritizing key attack vectors for protection. We measure attack surface by quantifying the impact of fine-grained Address Space Layout Randomization (ASLR) on code reuse attacks under the Just-In-Time Return-Oriented Programming (JITROP) threat model. We conduct a comprehensive measurement study with five fine-grained ASLR tools, 20 applications including six browsers, one browser engine, and 25 dynamic libraries. Experiments show that attackers only need several seconds (1.5-3.5) to find various code reuse gadgets such as the Turing Complete gadget set. Experiments also suggest that some code pointer leaks allow attackers to find gadgets more quickly than others. Besides, the instruction-level single-round randomization can restrict Turing Complete operations by preventing up to 90% of gadgets. This dissertation also identifies and prioritizes critical data pointers for protection to enable the capability to tune between performance vs. security. We apply seven rule-based heuristics to prioritize externally manipulatable sensitive data objects/pointers. Our evaluations using 33 ground truths vulnerable data objects/pointers show the successful detection of 32 ground truths with a 42% performance overhead reduction compared to AddressSanitizer. Our results also suggest that sensitive data objects are as low as 3%, and on average, 82% of data objects do not need protection for real-world applications. / Doctor of Philosophy / Proactive approaches for preventing attacks through security measurements are crucial to prevent advanced attacks because reactive measures can become challenging, especially when attackers enter sophisticated attack phases. A key challenge for the proactive measures is the identification of representative metrics and measurement methodologies to assess security guarantees, as some metrics used for evaluating security guarantees may not capture the capabilities of advanced attackers. Also, many proactive measures suffer performance bottlenecks. This dissertation identifies and represents attack elements as metrics using the knowledge from advanced exploits and demonstrates the effectiveness of the metrics by quantifying attack surface and enabling the capability to tune performance vs. security of existing defenses by identifying and prioritizing key attack elements. We measure the attack surface of various software applications by quantifying the available attack elements of code reuse attacks in the presence of fine-grained Address Space Layout Randomization (ASLR), a defense in modern operating systems. ASLR makes code reuse attacks difficult by making the attack components unavailable. We perform a comprehensive measurement study with five fine-grained ASLR tools, real-world applications, and libraries under an influential code reuse attack model. Experiments show that attackers only need several seconds (1.5-3.5) to find various code reuse elements. Results also show the influence of one attack element over another and one defense strategy over another strategy. This dissertation also applies seven rule-based heuristics to prioritize externally manipulatable sensitive data objects/pointers – a type of attack element – to enable the capability to tune between performance vs. security. Our evaluations using 33 ground truths vulnerable data objects/pointers show the successful identification of 32 ground truths with a 42% performance overhead reduction compared to AddressSanitizer, a memory error detector. Our results also suggest that sensitive data objects are as low as 3% of all objects, and on average, 82% of objects do not need protection for real-world applications.

Le but de cette thèse est de spécifier et prouver des programmes avec pointeurs, tels que des programmes C, en utilisant des techniques de raffinement. L’approche proposée permet de faire un compromis entre les techniques complexes qui existent dans la littérature et ce qui est utilisable dans l’industrie, en conciliant légèreté des annotations et restrictions sur les alias. Nous définissons, dans un premier temps, un langage d’étude, qui s’inspire du langage C, et dans lequel le seul type de données mutable possible est le type des structures, auquel on accède uniquement à travers des pointeurs. Afin de structurer nos programmes, nous munissons notre langage d’une notion de module et des concepts issus de la théorie du raffinement tels que les variables abstraites que nous formalisons par des champs modèle, et les invariants de collage. Ceci nous permet d’écrire des programmes structurés en composants. L’introduction des invariants de données dans notre langage soulève des problématiques liées au partage de pointeurs. En effet, en cas d’alias, on risque de ne plus pouvoir garantir la validité de l’invariant de données d’une structure. Nous interdisons, alors l’aliasing (le partage de référence) dans notre langage. Pour contrôler les accès à la mémoire, nous définissons un système de type, basé sur la notion de régions. Cette contribution s’inspire de la théorie du raffinement et a pour but, de rendre les programmes les plus modulaires possible et leurs preuves les plus automatiques possible. Nous définissons, sur ce langage, un mécanisme de génération d’obligations de preuve en proposant un calcul de plus faible précondition incorporant du raffinement. Nous prouvons ensuite, la correction de ce mécanisme de génération d’obligations de preuve par une méthode originale, fondée sur la notion de sémantique bloquante, qui s’apparente à une preuve de type soundness et qui consiste donc, à prouver la préservation puis le progrès de ce calcul. Nous étendons, dans un deuxième temps, notre langage en levant partiellement la restriction liée au partage de références. Nous permettons, notamment, le partage de références lorsqu’aucun invariant de données n’est associé au type structure référencé. De plus, nous introduisons le type des tableaux, ainsi que les variables globales et l’affectation qui ne font pas partie du langage noyau. Pour chacune des extensions citées ci-dessus, nous étendons la définition et la preuve de correction du calcul de plus faible précondition en conséquence. Nous proposons enfin, une implantation de cette approche sous forme d’un greffon de Frama-C (http://frama-c.com/). Nous expérimentons notre implantation sur des exemples de modules implantant des structures de données complexes, en particulier des défis issus du challenge VACID0 (http://vacid. codeplex.com/), à savoir les tableaux creux (Sparse Array) et les tas binaires. / The purpose of this thesis is to specify and prove programs with pointers, such as C programs, using refinement techniques. The proposed approach allows a compromise between the complexe methods that exist in the literature and what is used in industry, reconciling lightness annotations and restrictions on the alias. We define, firstly, a language study, based on the C language, in which the only type of mutable data allowed is the type of structures, which can be accessed only through pointers. In order to structure our programs, we bring our language with a module notion and concepts issue from a refinement theory such as abstract variables that we formalize by model fields and gluing invariants. This allows us to write programs structured by components. Introducing invariants in our language raises issues related to aliasing. Indeed, in presence of alias, we might not be able to guarantee the validity of the invariant data structure. We forbid then the aliasing in our language. To control memory access, we define a type system based on the concept of regions. This contribution is based on the theory and refinement. It aims to make programs as modular as possible and proofs as automatic as possible. We define on this language, a mechanism for generation of proof obligations by proposing a weakest precondition calculus incorporating refinement. Next we prove the correction of this proof obligations generation mechnaism by an original method based on the concept of blocking semantic, which is similar to a proof of type soundness, and consists therefore, to proove the preservation and the progress of the defined calculus. Secondly, we extend our language by, partially, lifting the restrictions related to aliasing. We allow, in particular, sharing when no invariant is associated to the referenced data structure. In addition, we introduce the type of arrays, global variables, and assignment that are not part of the core language. For each of the extensions mentioned above, we extend the definition and correctness proof of the weakest precondition calculus accordingly. Finally, we propose an implementation of this approach as a Frama-C plugin(http ://frama-c.com/). We experimente our implantation on examples of modules implementing complex data structures, especially the challenges from the challenge VACID0 (http ://vacid. Codeplex.com /), namely sparse srrays and binary heaps.

Made available in DSpace on 2016-12-12T20:32:04Z (GMT). No. of bitstreams: 1 77555.pdf: 1715329 bytes, checksum: 656a561d8d9a0f7cc0b898a64218e4b6 (MD5) Previous issue date: 2007-10-16 / Coordenação de Aperfeiçoamento de Pessoal de Nível Superior / The current established world-wide economic order from the last decade of the XX century extended the competitive environment of the organizations for a phenomenon that was known as globalization. Their efects were feeled by national enterprises, who had drastic adaptation times. In this circunstances had stand out that one which had overcome these challenges and had obtained success while others have failed. The first five years of the XXI century consolidated this process and raise questions of how much and which had been the pointers that make the success or what induce to failure those enterprises. A sector of great economic importance to the Joinville and Jaraguá do Sul cities is the metal-mechanical; only a critic evaluation of the recent past of this sector is a study source and can guide the future decisions. In this meaning, this work, using sampling, starting from a exploratory survey relating to the enterprises of the metal-mechanical sector from the north region of the State Santa Catarina, develop a technique through economical and financials pointers and extend the possibilities of the matter analysis. During the meeting, the data gather and presentation examine points of view relating the capital structure, immobilizaton politics, liquidity, debt payment capacity, financial cycle, working capital, bonus politic, profitability, financial leverage rate and debt cost, to which are assign importance, concepts and notes which allow the unambiguous identification of the financial management pointers that award success or not to these organizations. The study practically identify the success pointers, mesasures their performances and promote a correct demonstration of the financial economical structure of the surveyed enterprises / A atual ordem econômica mundial estabelecida a partir da última década do século XX ampliou o ambiente competitivo das organizações por um fenômeno que ficou conhecido como globalização. Seus efeitos foram sentidos pelas empresas nacionais que viveram momentos de adaptação drásticos. Neste contexto sobressaíram-se as que superaram estes desafios e obtiveram sucesso enquanto outras fracassaram. O primeiro qüinqüênio do século XXI consolida esse processo e acende questionamentos quanto e quais teriam sido os fatores que possibilitaram o êxito ou que compeliram ao insucesso essas companhias. Um setor de grande relevância econômica para as cidades de Joinville e Jaraguá do Sul é o metalmecânico, assim a apreciação critica do passado recente desse segmento é fonte de estudo e pode balizar as decisões de futuro. Neste sentido, este trabalho, a partir de um estudo exploratório acerca de empresas do setor metal-mecânico da região norte do estado de Santa Catarina, desenvolve uma técnica por meio dos quocientes econômicos e financeiros e amplia as possibilidades de análise da questão. Durante a reunião, a compilação e a apresentação de dados, aborda aspectos relativos à estrutura de capital, política de imobilização, liquidez, capacidade de pagamento de dívidas, ciclo financeiro, necessidade de capital de giro, política de dividendos, rentabilidade, grau de alavancagem e custo da dívida, aos quais são atribuídos pesos, conceitos e notas, que permitem a identificação clara dos indicadores de gestão financeira que conferiram sucesso ou não às estas organizações. Na prática o estudo identifica os indicadores de sucesso, mede seus desempenhos e promove a demonstração correta da situação econômica financeira das empresas pesquisadas.

Educators in many disciplines are too often forced to rely on intuition about how students learn and the effectiveness of teaching to guide changes and improvements to their curricula. In computer science, systems that perform automated collection and assessment of programming assignments are seeing increased adoption, and these systems generate a great deal of meaningful intermediate data and statistics during the grading process. Continuous collection of these data and long-term retention of collected data present educators with a new resource to assess both learning (how well students understand a topic or how they behave on assignments) and teaching (how effective a response, intervention, or assessment instrument was in evaluating knowledge or changing behavior), by basing their decisions on evidence rather than intuition. It is only possible to achieve these goals, however, if such data are easily accessible. I present an infrastructure that has been added to one such automated grading system, Web-CAT, in order to facilitate routine data collection and access while requiring very little added effort by instructors. Using this infrastructure, I present three case studies that serve as representative examples of educational questions that can be explored thoroughly using pre-existing data from required student work. The first case study examines student time management habits and finds that students perform better when they start earlier but that offering extra credit for finishing earlier did not encourage them to do so. The second case study evaluates a tool used to improve student understanding of manual memory management and finds that students made fewer errors when using the tool. The third case study evaluates the reference tests used to grade student code on a selected assignment and confirms that the tests are a suitable instrument for assessing student ability. In each case study, I use a data-driven, evidence-based approach spanning multiple semesters and students, allowing me to answer each question in greater detail than was possible using previous methods and giving me significantly increased confidence in my conclusions. / Ph. D.

The knowledge economy has brought about some new challenges for organisations. Accessing data and information in a logical manner is a critical component of information and knowledge management. Taxonomies are viewed as a solution to facilitate ease of access to information in a logical manner. The aim of this research was to investigate the role of taxonomies within organisations which utilise a knowledge management framework or strategy. An interview process was utilised to gain insight from leading organisations as to the use of taxonomies within the knowledge management environment. Organisations are starting to use taxonomies to manage multi-sourced environments and facilitate the appropriate sourcing of the organisations intellectual capital. Based on the research it is clear that taxonomies will play a central role in the coming years to help manage the complexity of the organisation's environment and ease the access to relevant information. / Information Science / M.Inf.

The present research paper deals with the comparison of static and dynamic data structures: static array, dynamic array, pointers array - class TList (Delphi) and dynamic doubly linked list, created with the help of recursive record.To compare the above mentioned structures, sorting (Bubble) and convex hull creation algorithms (Graham, Endrew) are realized, with the time of their implementation analysed. The algorithm of sorting (Bubble) is realized by four ways: static array, dynamic array, pointers array (class TList) and a dynamic doubly linked list, created with the help of recursive record.The algorithms of convex hull creation (Graham, Endrew) is realized by three ways: static array, dynamic array and pointers array (TList).The research paper also describes the pointers array class TList (Delphi), its properties and methods. The sorting method Sort of this class is compared with the sorting method of a “Bubble”. Using class templates, a universal class MList (C++) was created for work with dynamic linear linked lists.

The knowledge economy has brought about some new challenges for organisations. Accessing data and information in a logical manner is a critical component of information and knowledge management. Taxonomies are viewed as a solution to facilitate ease of access to information in a logical manner. The aim of this research was to investigate the role of taxonomies within organisations which utilise a knowledge management framework or strategy. An interview process was utilised to gain insight from leading organisations as to the use of taxonomies within the knowledge management environment. Organisations are starting to use taxonomies to manage multi-sourced environments and facilitate the appropriate sourcing of the organisations intellectual capital. Based on the research it is clear that taxonomies will play a central role in the coming years to help manage the complexity of the organisation's environment and ease the access to relevant information. / Information Science / M.Inf.

MAIA, Tania Maria Lacerda. Planejamento e gestão estratégica para o restaurante universitário da UFC em um cenário de expansão do número de alunos. 2008. 107 f. Dissertação (Mestrado em Políticas Públicas e Gestão da Educação Superior) – Universidade Federal do Ceará, Programa de Pós-Graduação em Políticas Públicas e Gestão da Educação Superior, Fortaleza-CE, 2008. / Submitted by moises gomes (celtinha_malvado@hotmail.com) on 2012-06-25T13:46:33Z No. of bitstreams: 1 2008_dis_TMLMaia.pdf: 344236 bytes, checksum: 714acc538d28b6ec2c8671ff2a52d5cd (MD5) / Approved for entry into archive by Maria Josineide Góis(josineide@ufc.br) on 2012-06-25T14:23:35Z (GMT) No. of bitstreams: 1 2008_dis_TMLMaia.pdf: 344236 bytes, checksum: 714acc538d28b6ec2c8671ff2a52d5cd (MD5) / Made available in DSpace on 2012-06-25T14:23:35Z (GMT). No. of bitstreams: 1 2008_dis_TMLMaia.pdf: 344236 bytes, checksum: 714acc538d28b6ec2c8671ff2a52d5cd (MD5) Previous issue date: 2008 / The present work focuses on the analysis of the impacts of the Federal University of Ceará affiliation proposal to the Reuni, concerning attendance to the University Restaurant on a result of the increasing demand, in the perspective of strategic planning and management, based on the actions carried out from 2003 to 2008. For such end, the postulates of Strategic administration and of Learning School have been adopted, having as a reference the present and future scenario and the strategic diagnosis based on the SWOT analysis. The present research (study) adopted the bibliographical, documental and action-research methods. The research shows that the foreseen expansion in the number of meals per day, from 3000 to 6000, will have an impact on the quality of the services delivered to the users, due to the present limitations in infra-structure, equipments, qualified personnel, and, above all, the need for implementing a pattern of management aimed at results. For this new scenario the following measures have been suggested, including a Strategic Plan for 2009-2020, a Tatic Plan for 2009-2012, a performance marker matrix focused on the Balanced scorecard method, besides management pattern guidelines, oriented towards results and users in the specific context of the University restaurant. The actions and management patterns proposed in the strategic plans, when adopted , will allow the University restaurant to have operational infra-structure, staff support and management excellence to assure and contribute to the approval in the service quality from the present percentage of 60.3% aiming to reach the concepts of good and excellent. / Neste trabalho, analisam-se os impactos da Proposta de Adesão da UFC ao REUNI no atendimento do Restaurante Universitário, decorrentes do grande aumento na demanda, sob o prisma do planejamento e da gestão estratégica, focando-se nas ações realizadas no período de 2003 a 2008. Para tanto, utilizam-se como suporte teórico-empírico os postulados da Administração Estratégica e da Escola de Aprendizado, tendo como referencial o cenário atual e futuro e o diagnóstico estratégico formulado com base na análise SWOT. Foram utilizados os métodos de pesquisa bibliográfica, documental e pesquisa-ação. O estudo mostra que a expansão prevista de 3.000 para 6.000 refeições/dia afetará a qualidade dos serviços e do atendimento aos usuários em função das limitações atuais de infra-estrutura física, de equipamentos, de pessoal qualificado e, sobretudo, da necessidade de implantação de um modelo da gestão focada em resultados. Para esse novo cenário, sugere-se um Plano Estratégico para o período 2009-2020, um Plano Tático 2009-2012, uma matriz de indicadores de desempenho focada no método do Balanced scorecard, além das diretrizes do modelo da gestão orientado para resultados e aderentes às peculiaridades do Restaurante Universitário da UFC. As propostas de ação e do modelo de gerenciamento contidos nos planos estratégicos, quando adotadas, darão ao RU condições objetivas de infra-estrutura operacional, suporte de pessoal e excelência da gestão para assegurar e até aumentar a aprovação da qualidade dos serviços que hoje é 60,3% para os atributos Bom e Ótimo.