# embeddings_queue

created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e2f378bf-917c-4e57-800a-beee356598b6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 81, "full_page_content": "82 \n \nmessage and not a replay (Na) and it provides A with a session key (Ks) and the time limit on its  \nuse (Tb).  \n4. A transmits the ticket to B, together with the B's nonce, the latter encrypted with the session key.  \nThe ticket provides B with the secret key that is used to decrypt E(Ks, Nb) to recover the nonce.  \nThe fact that B's nonce is encrypted with the session key authenticates that the message came  \nfrom A and is not a replay. \nThis protocol provides an effective, secure means for A and B to establish a session with a secure  \nsession key.  Furthermore, the protocol leaves A in possession of a key that can be used for subsequent \nauthentication to B, avoiding the need to contact the authentication server repeatedly. Suppose that \nA and B establish a session using the aforementioned protocol and then conclude that session. \nSubsequently, but within the time limit established by the protocol, A desires a new session with B. \nThe following protocol ensues: \n \nWhen B receives the message in step 1, it verifies that the ticket has not expired. The newly generated  \nnonces N'a and N'b assure each party that there is no replay attack. \n2.9.2 One-Way Authentication \nWith some refinement, the KDC strategy is a candidate for encrypted electronic mail.  \nBecause we wish to avoid requiring that the recipient (B) be on line at the same time as the sender \n(A), steps 4 and 5 must be eliminated. \n For a message with content M, the sequence is as follows: \n \nThis approach guarantees that only the intended recipient of a message will be able to read it. \n It also provides a level of authentication that the sender is A. \nReferences: \n\u2022 William Stallings, \u201c Cryptography and Network Security\u201d, 4th Edition, Pearson, 2009. \n\u2022 Behrouz A. Forouzan, \u201c Cryptography and Network Security\u201d, Tata McGraw-Hill, 2008.", "chunk_id": "9b8fad35-795e-4c85-8fb4-528d1a97b3aa", "chroma:document": "authentication to B, avoiding the need to contact the authentication server repeatedly. Suppose that \nA and B establish a session using the aforementioned protocol and then conclude that session. \nSubsequently, but within the time limit established by the protocol, A desires a new session with B. \nThe following protocol ensues:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ee4340e8-06aa-47f6-8986-43ce15eaa217
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 81, "full_page_content": "82 \n \nmessage and not a replay (Na) and it provides A with a session key (Ks) and the time limit on its  \nuse (Tb).  \n4. A transmits the ticket to B, together with the B's nonce, the latter encrypted with the session key.  \nThe ticket provides B with the secret key that is used to decrypt E(Ks, Nb) to recover the nonce.  \nThe fact that B's nonce is encrypted with the session key authenticates that the message came  \nfrom A and is not a replay. \nThis protocol provides an effective, secure means for A and B to establish a session with a secure  \nsession key.  Furthermore, the protocol leaves A in possession of a key that can be used for subsequent \nauthentication to B, avoiding the need to contact the authentication server repeatedly. Suppose that \nA and B establish a session using the aforementioned protocol and then conclude that session. \nSubsequently, but within the time limit established by the protocol, A desires a new session with B. \nThe following protocol ensues: \n \nWhen B receives the message in step 1, it verifies that the ticket has not expired. The newly generated  \nnonces N'a and N'b assure each party that there is no replay attack. \n2.9.2 One-Way Authentication \nWith some refinement, the KDC strategy is a candidate for encrypted electronic mail.  \nBecause we wish to avoid requiring that the recipient (B) be on line at the same time as the sender \n(A), steps 4 and 5 must be eliminated. \n For a message with content M, the sequence is as follows: \n \nThis approach guarantees that only the intended recipient of a message will be able to read it. \n It also provides a level of authentication that the sender is A. \nReferences: \n\u2022 William Stallings, \u201c Cryptography and Network Security\u201d, 4th Edition, Pearson, 2009. \n\u2022 Behrouz A. Forouzan, \u201c Cryptography and Network Security\u201d, Tata McGraw-Hill, 2008.", "chunk_id": "4b00327e-64b5-4092-8fd2-88fbd478c22c", "chroma:document": "When B receives the message in step 1, it verifies that the ticket has not expired. The newly generated  \nnonces N'a and N'b assure each party that there is no replay attack. \n2.9.2 One-Way Authentication \nWith some refinement, the KDC strategy is a candidate for encrypted electronic mail."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e199fa06-f789-4c4d-8b3c-8d1f56dd6959
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 81, "full_page_content": "82 \n \nmessage and not a replay (Na) and it provides A with a session key (Ks) and the time limit on its  \nuse (Tb).  \n4. A transmits the ticket to B, together with the B's nonce, the latter encrypted with the session key.  \nThe ticket provides B with the secret key that is used to decrypt E(Ks, Nb) to recover the nonce.  \nThe fact that B's nonce is encrypted with the session key authenticates that the message came  \nfrom A and is not a replay. \nThis protocol provides an effective, secure means for A and B to establish a session with a secure  \nsession key.  Furthermore, the protocol leaves A in possession of a key that can be used for subsequent \nauthentication to B, avoiding the need to contact the authentication server repeatedly. Suppose that \nA and B establish a session using the aforementioned protocol and then conclude that session. \nSubsequently, but within the time limit established by the protocol, A desires a new session with B. \nThe following protocol ensues: \n \nWhen B receives the message in step 1, it verifies that the ticket has not expired. The newly generated  \nnonces N'a and N'b assure each party that there is no replay attack. \n2.9.2 One-Way Authentication \nWith some refinement, the KDC strategy is a candidate for encrypted electronic mail.  \nBecause we wish to avoid requiring that the recipient (B) be on line at the same time as the sender \n(A), steps 4 and 5 must be eliminated. \n For a message with content M, the sequence is as follows: \n \nThis approach guarantees that only the intended recipient of a message will be able to read it. \n It also provides a level of authentication that the sender is A. \nReferences: \n\u2022 William Stallings, \u201c Cryptography and Network Security\u201d, 4th Edition, Pearson, 2009. \n\u2022 Behrouz A. Forouzan, \u201c Cryptography and Network Security\u201d, Tata McGraw-Hill, 2008.", "chunk_id": "2e7f7ca7-be40-4fd3-ba9d-3cc09b896855", "chroma:document": "Because we wish to avoid requiring that the recipient (B) be on line at the same time as the sender \n(A), steps 4 and 5 must be eliminated. \n For a message with content M, the sequence is as follows: \n \nThis approach guarantees that only the intended recipient of a message will be able to read it. \n It also provides a level of authentication that the sender is A. \nReferences:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b8994c0b-679f-43eb-8116-632efd17c3dd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 81, "full_page_content": "82 \n \nmessage and not a replay (Na) and it provides A with a session key (Ks) and the time limit on its  \nuse (Tb).  \n4. A transmits the ticket to B, together with the B's nonce, the latter encrypted with the session key.  \nThe ticket provides B with the secret key that is used to decrypt E(Ks, Nb) to recover the nonce.  \nThe fact that B's nonce is encrypted with the session key authenticates that the message came  \nfrom A and is not a replay. \nThis protocol provides an effective, secure means for A and B to establish a session with a secure  \nsession key.  Furthermore, the protocol leaves A in possession of a key that can be used for subsequent \nauthentication to B, avoiding the need to contact the authentication server repeatedly. Suppose that \nA and B establish a session using the aforementioned protocol and then conclude that session. \nSubsequently, but within the time limit established by the protocol, A desires a new session with B. \nThe following protocol ensues: \n \nWhen B receives the message in step 1, it verifies that the ticket has not expired. The newly generated  \nnonces N'a and N'b assure each party that there is no replay attack. \n2.9.2 One-Way Authentication \nWith some refinement, the KDC strategy is a candidate for encrypted electronic mail.  \nBecause we wish to avoid requiring that the recipient (B) be on line at the same time as the sender \n(A), steps 4 and 5 must be eliminated. \n For a message with content M, the sequence is as follows: \n \nThis approach guarantees that only the intended recipient of a message will be able to read it. \n It also provides a level of authentication that the sender is A. \nReferences: \n\u2022 William Stallings, \u201c Cryptography and Network Security\u201d, 4th Edition, Pearson, 2009. \n\u2022 Behrouz A. Forouzan, \u201c Cryptography and Network Security\u201d, Tata McGraw-Hill, 2008.", "chunk_id": "3593fcdc-6265-40bd-8cfc-deb60f1f3843", "chroma:document": "References: \n\u2022 William Stallings, \u201c Cryptography and Network Security\u201d, 4th Edition, Pearson, 2009. \n\u2022 Behrouz A. Forouzan, \u201c Cryptography and Network Security\u201d, Tata McGraw-Hill, 2008."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 40c29f54-5f8c-4dbb-845c-b545ee37b967
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 82, "full_page_content": "83 \n \n \n \nSCHOOL OF COMPUTING \nDEPARTMENT OF INFORMATION TECHNOLOGY \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \nUNIT \u2013 III SYSTEM SECURITY \u2013 SITA1602", "chunk_id": "ca46ae73-47af-4247-b295-803d2abd3f7d", "chroma:document": "83 \n \n \n \nSCHOOL OF COMPUTING \nDEPARTMENT OF INFORMATION TECHNOLOGY \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \nUNIT \u2013 III SYSTEM SECURITY \u2013 SITA1602"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dd630d3b-f006-412e-8c13-9dfc09bfd78c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "693c6488-6d11-4371-bece-51fd174188c7", "chroma:document": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 295e0ef3-6c8a-4dd9-885c-b495992f1fbd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "d1380a81-5404-4bd0-ac6a-ac9cc5736c96", "chroma:document": "viruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5bf5c2a2-673e-4b04-a1e6-4e4c7f37d98a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "75777736-2b5f-49bb-b81e-9520791c09a0", "chroma:document": "access is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f5a5e154-41d8-4f9d-a16e-415b11124987
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "67080e2a-2ee0-4545-819c-c9eeda8c47f3", "chroma:document": "\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 468fd1ec-1d36-49ac-8fa1-054a6ba352cb
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "9666a7f6-cedb-4c8f-972c-a0c5acefa1b0", "chroma:document": "modify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 812e6805-df78-42f0-a0fe-f762ab7fe02b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "8ddb2318-6c6e-4271-9a04-2e38c694b3d1", "chroma:document": "The password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 533339ad-e381-4b7f-85fc-1a2786f7390d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 83, "full_page_content": "84 \n \n \nUNIT 3 SYSTEM SECURITY  \nIntruders \u2013 Detection \u2013 Password Management \u2013 Malicious Software \u2013 Virus \u2013 \nCountermeasures \u2013 Distributed Denial of Service Attacks \u2013 Firewalls \u2013 Design \nPrinciples \u2013 Trusted Systems \n3.1 Intruders \nOne of the two most publicized threats to security is the intruder (the other is \nviruses), generally referred to as a hacker or cracker. There are three classes of intruders: \n\u2022 Masquerader: An individual who is not authorized to use the computer and who \npenetrates a system's access controls to exploit a legitimate user's account \n\u25cf Misfeasor: A legitimate user who accesses data, programs, or resources for which such \naccess is not authorized, or who is authorized for such access but misuses his or her \nprivileges \n\u25cf Clandestine user: An individual who seizes supervisory control of the system and uses \nthis control to evade auditing and access controls or to suppress audit collection \nAn analysis of previous attack revealed that there were two levels of hackers: \n\u00b7       The high levels were sophisticated users with a thorough knowledge of the \ntechnology.   \n\u00b7       The low levels were the \u201efoot soldiers\u201f who merely use the supplied cracking \nprograms with little understanding of how they work.   \nIn addition to running password cracking programs, the intruders attempted to \nmodify login software to enable them to capture passwords of users logging onto the \nsystems. \n3.1.1 Intrusion techniques \nThe objective of the intruders is to gain access to a system or to increase the range of \nprivileges accessible on a system. Generally, this requires the intruders to acquire \ninformation that should be protected.  \nThe password files can be protected in one of the two ways: \nOne way encryption \u2013 the system stores only an encrypted form of user\u201fs password. \nIn practice, the system usually performs a one way transformation (not reversible) in \nwhich the password is used to generate a key for the encryption function and in which a \nfixed length output is produced.   \n Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults.", "chunk_id": "1c9f8e04-d23e-477a-8efe-afeec120e49f", "chroma:document": "Access control \u2013 access to the password file is limited to one or a very few accounts.   \nThe following techniques are used for learning passwords. \n1.  Try default passwords used with standard accounts that are shipped with the \nsystem.  Many administrators do not bother to change these defaults."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 29c9339c-ca87-42b1-83b0-b66a823e9a6d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 84, "full_page_content": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers. \n6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent \nyears. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified. \nFigure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more \nintruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders.", "chunk_id": "0c3d6013-04ca-4108-baed-b5a90b133fb9", "chroma:document": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 529e4119-9b3a-46c5-9fc6-691f2a29cc8d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 84, "full_page_content": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers. \n6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent \nyears. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified. \nFigure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more \nintruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders.", "chunk_id": "6d2c9f6a-f0ab-4d36-8cd8-0791d2236df6", "chroma:document": "6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0ad6b38a-85b9-4eb9-81ff-957b38322583
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 84, "full_page_content": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers. \n6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent \nyears. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified. \nFigure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more \nintruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders.", "chunk_id": "2c37636f-bcda-49d0-b104-a8b1b105f9fd", "chroma:document": "years. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f7370795-30b5-4adf-8b4f-6dbfc2d630e6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 84, "full_page_content": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers. \n6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent \nyears. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified. \nFigure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more \nintruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders.", "chunk_id": "a85481ca-2f7c-407e-9c80-5a63c9a8aeef", "chroma:document": "intrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6faa294a-30ed-45ac-a826-6e8ffd797b1c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 84, "full_page_content": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers. \n6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent \nyears. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified. \nFigure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more \nintruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders.", "chunk_id": "388e4af0-3d85-412e-99bf-ef1de4cc3c45", "chroma:document": "Figure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e9e2e00b-ec2e-4cca-91ea-69f12ea8252a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 84, "full_page_content": "85 \n \n2.  Exhaustively try all short passwords. \n3. Try words in the system\u2019s online dictionary or a list of likely passwords. \n4.  Collect information about users such as their full names, the name of their spouse and \nchildren, pictures in their office and books in their office that are related to hobbies. \n5. Try user\u2019s phone number, social security numbers and room numbers. \n6. Try all legitimate license plate numbers. \n7. Use a torjan horse to bypass restriction on access. \n8. Tap the line between a remote user and the host system. \n 3.2 Intrusion Detection \nInevitably, the best intrusion prevention system will fail. A system's second line of \ndefense is intrusion detection, and this has been the focus of much research in recent \nyears. This interest is motivated by a number of considerations, including the following: \n \u00b7    If an intrusion is detected quickly enough, the intruder can be identified and ejected \nfrom the system     before any damage is done or any data are compromised \n\u00b7    An effective intrusion detection system can serve as a deterrent, so acting to prevent \nintrusions. \n.    Intrusion detection enables the collection of information about intrusion techniques \nthat can be used to strengthen the intrusion prevention facility. \nIntrusion detection is based on the assumption that the behavior of the intruder differs \nfrom that of a legitimate user in ways that can be quantified. \nFigure 3.1 suggests, in very abstract terms, the nature of the task confronting the \ndesigner of an intrusion detection system. Although the typical behavior of an intruder \ndiffers from the typical behavior of an authorized user, there is an overlap in these \nbehaviors. Thus, a loose interpretation of intruder behavior, which will catch more \nintruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders.", "chunk_id": "c342a1ef-f4c4-4f5c-aa09-9e6fe485c39e", "chroma:document": "intruders, will also lead to a number of \"false positives,\" or authorized users identified as \nintruders."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6a206551-27ac-4ea0-817a-6e5467480484
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 85, "full_page_content": "86 \n \n \nFig :3.1 Profiles of Behavior of Intruders and Authorized Users \nThe approaches to intrusion detection: \n1. Statistical anomaly detection: Involves the collection of data relating to the behavior of \nlegitimate users over a period of time. Then statistical tests are applied to observed \nbehavior to determine with a high level of confidence whether that behavior is not \nlegitimate user behavior.  \nThreshold detection: This approach involves defining thresholds, independent of user, \nfor the frequency of occurrence of various events.  \nProfile based: A profile of the activity of each user is developed and used to \ndetect changes in the behavior of individual accounts. \n2. Rule-based detection: Involves an attempt to define a set of rules that can be used to \ndecide that a given behavior is that of an intruder.  \nAnomaly detection: Rules are developed to detect deviation from previous \nusage patterns.  \nPenetration identification: An expert system approach that searches for suspicious \nbehavior.  \n3.2.1 Audit Records \n A fundamental tool for intrusion detection is the audit record. Some record of ongoing \nactivity by users must be maintained as input to an intrusion detection system. Basically, \ntwo plans are used: \n\u2022 Native audit records: Virtually all multiuser operating systems include accounting \nsoftware that collects information on user activity. The advantage of using this \ninformation is that no additional collection software is needed. The disadvantage is that \nthe native audit records may not contain the needed information or may not contain it in \na convenient form.", "chunk_id": "3e399d3b-7ade-4fbb-994c-2bfa8701622c", "chroma:document": "86 \n \n \nFig :3.1 Profiles of Behavior of Intruders and Authorized Users \nThe approaches to intrusion detection: \n1. Statistical anomaly detection: Involves the collection of data relating to the behavior of \nlegitimate users over a period of time. Then statistical tests are applied to observed \nbehavior to determine with a high level of confidence whether that behavior is not"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: bd32b927-5b63-485f-8471-6072e66a9e7e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 85, "full_page_content": "86 \n \n \nFig :3.1 Profiles of Behavior of Intruders and Authorized Users \nThe approaches to intrusion detection: \n1. Statistical anomaly detection: Involves the collection of data relating to the behavior of \nlegitimate users over a period of time. Then statistical tests are applied to observed \nbehavior to determine with a high level of confidence whether that behavior is not \nlegitimate user behavior.  \nThreshold detection: This approach involves defining thresholds, independent of user, \nfor the frequency of occurrence of various events.  \nProfile based: A profile of the activity of each user is developed and used to \ndetect changes in the behavior of individual accounts. \n2. Rule-based detection: Involves an attempt to define a set of rules that can be used to \ndecide that a given behavior is that of an intruder.  \nAnomaly detection: Rules are developed to detect deviation from previous \nusage patterns.  \nPenetration identification: An expert system approach that searches for suspicious \nbehavior.  \n3.2.1 Audit Records \n A fundamental tool for intrusion detection is the audit record. Some record of ongoing \nactivity by users must be maintained as input to an intrusion detection system. Basically, \ntwo plans are used: \n\u2022 Native audit records: Virtually all multiuser operating systems include accounting \nsoftware that collects information on user activity. The advantage of using this \ninformation is that no additional collection software is needed. The disadvantage is that \nthe native audit records may not contain the needed information or may not contain it in \na convenient form.", "chunk_id": "0035225f-d09a-4420-aa7c-3b5a1ccc3274", "chroma:document": "legitimate user behavior.  \nThreshold detection: This approach involves defining thresholds, independent of user, \nfor the frequency of occurrence of various events.  \nProfile based: A profile of the activity of each user is developed and used to \ndetect changes in the behavior of individual accounts."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9094a2ef-7aa5-48fc-b5e0-11e1c8e00649
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 85, "full_page_content": "86 \n \n \nFig :3.1 Profiles of Behavior of Intruders and Authorized Users \nThe approaches to intrusion detection: \n1. Statistical anomaly detection: Involves the collection of data relating to the behavior of \nlegitimate users over a period of time. Then statistical tests are applied to observed \nbehavior to determine with a high level of confidence whether that behavior is not \nlegitimate user behavior.  \nThreshold detection: This approach involves defining thresholds, independent of user, \nfor the frequency of occurrence of various events.  \nProfile based: A profile of the activity of each user is developed and used to \ndetect changes in the behavior of individual accounts. \n2. Rule-based detection: Involves an attempt to define a set of rules that can be used to \ndecide that a given behavior is that of an intruder.  \nAnomaly detection: Rules are developed to detect deviation from previous \nusage patterns.  \nPenetration identification: An expert system approach that searches for suspicious \nbehavior.  \n3.2.1 Audit Records \n A fundamental tool for intrusion detection is the audit record. Some record of ongoing \nactivity by users must be maintained as input to an intrusion detection system. Basically, \ntwo plans are used: \n\u2022 Native audit records: Virtually all multiuser operating systems include accounting \nsoftware that collects information on user activity. The advantage of using this \ninformation is that no additional collection software is needed. The disadvantage is that \nthe native audit records may not contain the needed information or may not contain it in \na convenient form.", "chunk_id": "a6181ca6-f8f7-419e-9214-9f37c49f70d2", "chroma:document": "2. Rule-based detection: Involves an attempt to define a set of rules that can be used to \ndecide that a given behavior is that of an intruder.  \nAnomaly detection: Rules are developed to detect deviation from previous \nusage patterns.  \nPenetration identification: An expert system approach that searches for suspicious \nbehavior.  \n3.2.1 Audit Records"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ec4173c9-0c1b-43f6-88e0-ad71a0edb700
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 85, "full_page_content": "86 \n \n \nFig :3.1 Profiles of Behavior of Intruders and Authorized Users \nThe approaches to intrusion detection: \n1. Statistical anomaly detection: Involves the collection of data relating to the behavior of \nlegitimate users over a period of time. Then statistical tests are applied to observed \nbehavior to determine with a high level of confidence whether that behavior is not \nlegitimate user behavior.  \nThreshold detection: This approach involves defining thresholds, independent of user, \nfor the frequency of occurrence of various events.  \nProfile based: A profile of the activity of each user is developed and used to \ndetect changes in the behavior of individual accounts. \n2. Rule-based detection: Involves an attempt to define a set of rules that can be used to \ndecide that a given behavior is that of an intruder.  \nAnomaly detection: Rules are developed to detect deviation from previous \nusage patterns.  \nPenetration identification: An expert system approach that searches for suspicious \nbehavior.  \n3.2.1 Audit Records \n A fundamental tool for intrusion detection is the audit record. Some record of ongoing \nactivity by users must be maintained as input to an intrusion detection system. Basically, \ntwo plans are used: \n\u2022 Native audit records: Virtually all multiuser operating systems include accounting \nsoftware that collects information on user activity. The advantage of using this \ninformation is that no additional collection software is needed. The disadvantage is that \nthe native audit records may not contain the needed information or may not contain it in \na convenient form.", "chunk_id": "66994469-a1b0-4874-8688-99cd01131f2c", "chroma:document": "A fundamental tool for intrusion detection is the audit record. Some record of ongoing \nactivity by users must be maintained as input to an intrusion detection system. Basically, \ntwo plans are used: \n\u2022 Native audit records: Virtually all multiuser operating systems include accounting \nsoftware that collects information on user activity. The advantage of using this"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ddf286ab-d209-4220-bac8-3c664b3f9d58
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 85, "full_page_content": "86 \n \n \nFig :3.1 Profiles of Behavior of Intruders and Authorized Users \nThe approaches to intrusion detection: \n1. Statistical anomaly detection: Involves the collection of data relating to the behavior of \nlegitimate users over a period of time. Then statistical tests are applied to observed \nbehavior to determine with a high level of confidence whether that behavior is not \nlegitimate user behavior.  \nThreshold detection: This approach involves defining thresholds, independent of user, \nfor the frequency of occurrence of various events.  \nProfile based: A profile of the activity of each user is developed and used to \ndetect changes in the behavior of individual accounts. \n2. Rule-based detection: Involves an attempt to define a set of rules that can be used to \ndecide that a given behavior is that of an intruder.  \nAnomaly detection: Rules are developed to detect deviation from previous \nusage patterns.  \nPenetration identification: An expert system approach that searches for suspicious \nbehavior.  \n3.2.1 Audit Records \n A fundamental tool for intrusion detection is the audit record. Some record of ongoing \nactivity by users must be maintained as input to an intrusion detection system. Basically, \ntwo plans are used: \n\u2022 Native audit records: Virtually all multiuser operating systems include accounting \nsoftware that collects information on user activity. The advantage of using this \ninformation is that no additional collection software is needed. The disadvantage is that \nthe native audit records may not contain the needed information or may not contain it in \na convenient form.", "chunk_id": "5a1c4295-9553-4a72-b151-2654913a5a84", "chroma:document": "information is that no additional collection software is needed. The disadvantage is that \nthe native audit records may not contain the needed information or may not contain it in \na convenient form."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 1173da27-4e64-42e1-aced-b1d198787607
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "abbb37c5-db05-4867-9f79-73ffb1858c9c", "chroma:document": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 62fc88d8-cad8-4508-85d0-0d3f43ccbe80
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "84b11de5-1d93-4923-96b9-fa1158d0dda6", "chroma:document": "involved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e3cbb825-dc5c-47d9-9aee-33a3f2648c5f
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "5aa91f9f-6f08-48c0-a632-27dbed87ddf1", "chroma:document": "by  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records,"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: bd0de852-12a9-47b7-a042-73deef0c5c0e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "b426a4ec-1c92-4291-a8e8-bf5bec25f870", "chroma:document": "terminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8d360fb2-dc24-4ca6-8ea4-5214f428482a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "6e687941-8ddc-4977-99bb-17d3ffe46169", "chroma:document": "\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time)."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b9b03ff4-1000-4c95-a028-06fb8b58350e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "401e1871-deb5-4629-b906-3e9678cb3898", "chroma:document": "\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 30d886c2-5f32-457b-acc8-24051e8f2edb
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 86, "full_page_content": "87 \n \n\u25cf Detection-specific audit records: A collection facility can be implemented that \ngenerates audit records containing only that information required by the intrusion \ndetection system. One advantage of such an approach is that it could be made vendor \nindependent and ported to a variety of systems. The disadvantage is the extra overhead \ninvolved in having, in effect, two accounting packages running on a machine. \nEach audit record contains the following fields: \n\u2022 Subject: Initiators of actions. A subject is typically a terminal user but might also be a \nprocess  \nacting on behalf of users or groups of users. All activity arises through commands issued \nby  \nsubjects. Subjects may be grouped into different access classes, and these classes may \noverlap. \n\u25cf Action: Operation performed by the subject on or with an object; for example, login, \nread,  \nperform I/O, execute. \n\u25cf Object: Receptors of actions. Examples include files, programs, messages, records, \nterminals, printers, and user- or program-created structures. When a subject is the \nrecipient of an action, such as electronic mail, then that subject is considered an object. \nObjects may be grouped by type. Object granularity may vary by object type and by \nenvironment. For example, database actions may be audited for the database as a whole \nor at the record level. \n\u25cf Exception-Condition: Denotes which, if any, exception condition is raised on return. \n\u25cf Resource-Usage: A list of quantitative elements in which each element gives the \namount used of some resource (e.g., number of lines printed or displayed, number of \nrecords read or written, processor time, I/O units used, session elapsed time). \n\u25cf Time-Stamp: Unique time-and-date stamp identifying when the action took placeMost \nuser operations are made up of a number of elementary actions. For example, a file copy \ninvolves the execution of the user command, which includes doing access validation and \nsetting up the copy, plus the read from one file, plus the write to another file. Consider \nthe command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:", "chunk_id": "57d6f976-0d0d-4e92-9420-c8942496b5c1", "chroma:document": "the command \nCOPY GAME.EXE TO <Library>GAME.EXE \nissued by Smith to copy an executable file GAME from the current directory to the \n<Library> directory. The following audit records may be generated:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b2ba36aa-6aef-4a8f-a105-99e1c98f8d85
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "8b75f380-f877-4f8b-807a-6775b2bf5293", "chroma:document": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0207eed9-5c5d-480d-8692-15b852c3d9e8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "d2ca5bcb-1e2d-4d19-846d-9e530b82c2c7", "chroma:document": "2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 2a34f9c6-9cb7-431c-909c-cb964da2e57b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "92464e1b-1d15-4abe-bf04-c259d46255fc", "chroma:document": "3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ada9b3dc-73d0-4000-ab98-4ae8ce36947d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "7091b07a-98eb-4ef6-a336-d310baa38ee0", "chroma:document": "Profile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 275a2091-5f55-4182-8583-a8688b1f73b0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "c633d827-8b75-4954-976e-299cab3fd440", "chroma:document": "intrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6508e7b6-63c4-4550-bb5e-357005b0ed69
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "531fcb48-5a73-46a6-9b77-db9e6625a82d", "chroma:document": "\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 139f1df2-927c-49e1-b751-88728d426079
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 87, "full_page_content": "88 \n \n \nIn this case, the copy is aborted because Smith does not have write permission to \n<Library> The decomposition of a user operation into elementary actions has three \nadvantages: \n1. Because objects are the protectable entities in a system, the use of elementary actions \nenables an audit of all behavior affecting an object.  \n2. Single-object, single-action audit records simplify the model and the implementation. \n3. Because of the simple, uniform structure of the detection-specific audit records, it may be \nrelatively easy to obtain this information or at least part of it by a straightforward mapping \nfrom existing native audit records to the detection-specific audit records. \n3.2.2 Statistical Anomaly Detection \nAs was mentioned, statistical anomaly detection techniques fall into two broad categories:  \nThreshold detection involves counting the number of occurrences of a specific event type \nover an interval of time. If the count surpasses what is considered a reasonable number \nthat one might expect to occur, then intrusion is assumed. \nProfile-based anomaly detection focuses on characterizing the past behavior of individual \nusers or related groups of users and then detecting significant deviations. A profile may \nconsist of a set of parameters, so that deviation on just a single parameter may not be \nsufficient in itself to signal an alert.Examples of metrics that are useful for profile-based \nintrusion detection are the following: \n\u2022 Counter: A nonnegative integer that may be incremented but not decremented until it is \nreset by management action. Examples include the number of logins by a single user \nduring an hour, the number of times a given command is executed during a single user \nsession, and the number of password failures during a minute. \n\u25cf Gauge: A nonnegative integer that may be incremented or decremented. Typically, a \ngauge is used to measure the current value of some entity. Examples include the number \nof logical connections assigned to a user application and the number of outgoing \nmessages queued for a user process. \n\u25cf Interval timer: The length of time between two related events. An example is the \nlength of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time", "chunk_id": "b3970415-5d13-4b5d-b8c7-12caaef4b152", "chroma:document": "length of time between successive logins to an account. \n\u25cf Resource utilization: Quantity of resources consumed during a specified period. \nExamples include the number of pages printed during a user session and total time"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8c24b7ff-2a0c-4e8f-b0a1-4fb6149f70e0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "f97f0908-c4c8-40eb-8d5a-0a90c4508448", "chroma:document": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 1e67ef1c-f45e-45a8-bf18-be5bada66edd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "ad519d3f-63db-4b8a-8a7a-fdeafbd590fa", "chroma:document": "over some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime)."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: deca2597-10bf-431b-8bf3-a11768d8b5f7
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "67e46382-1889-4450-8c14-eccb30a8ad20", "chroma:document": "time). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0496fe8d-a757-4f6d-a85c-337e05a71f3d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "2375f7ba-d64c-4abd-8c6f-e9764bc0318e", "chroma:document": "characterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ddc4b82a-8db9-4be9-a358-d8b1338c3bdd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "32a8d44a-e265-42bc-9095-7be8a027b674", "chroma:document": "set of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 2a801360-8ce7-4022-9b02-271c5a6409e6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "fe4d5e30-cef8-4e31-865f-01e9893f2084", "chroma:document": "patterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dbae4a46-227f-4e6e-bf53-212ec5371086
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 88, "full_page_content": "89 \n \nconsumed by a program execution. Given these general metrics, various tests can be \nperformed to determine whether current activity fits within acceptable limits. \n\u25cf Mean and standard deviation \n\u25cf Multivariate \n\u25cf Markov process \n\u25cf Time \n\u25cf Operational \nThe simplest statistical test is to measure the mean and standard deviation of a parameter \nover some historical period. This gives a reflection of the average behavior and its \nvariability. \nA multivariate model is based on correlations between two or more variables. Intruder \nbehavior may be characterized with greater confidence by considering such correlations \n(for example, processor time and resource usage, or login frequency and session elapsed \ntime). \n A Markov process model is used to establish transition probabilities among various \nstates. As an example, this model might be used to look at transitions between certain \ncommands. \n A time series model focuses on time intervals, looking for sequences of events that \nhappen too rapidly or too slowly. A variety of statistical tests can be applied to \ncharacterize abnormal timing. Finally, an operational model is based on a judgment of \nwhat is considered abnormal, rather than an automated analysis of past audit records.  \n3.2.3 Rule-Based Intrusion Detection \nRule-based techniques detect intrusion by observing events in the system and applying a \nset of rules that lead to a decision regarding whether a given pattern of activity is or is \nnot suspicious.  \nRule-based anomaly detection is similar in terms of its approach and strengths to \nstatistical anomaly detection. With the rule-based approach, historical audit records are \nanalyzed to identify usage patterns and to generate automatically rules that describe those \npatterns. Rules may represent past behavior patterns of users, programs, privileges, time \nslots, terminals, and so on. Current behavior is then observed, and each transaction is \nmatched against the set of rules to determine if it conforms to any historically observed \npattern of behavior. \nRule-based penetration identification takes a very different approach to intrusion \ndetection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:", "chunk_id": "b3bd969a-6554-4772-b16c-d0cc82847dac", "chroma:document": "detection, one based on expert system technology. The key feature of such systems is the \nuse of rules for identifying known penetrations or penetrations that would exploit known \nweaknesses \n Example heuristics are the following:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 14cacf22-4e06-4bf7-b325-6b9883e40149
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "190ccc59-609e-4fdb-aacd-9e5d917912c4", "chroma:document": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: bbef236f-ac6d-4d55-9a24-f2a90d4e2ac6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "d7d6543a-8d4f-4e66-afe1-4519e898cf93", "chroma:document": "3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b7cc43a3-175f-493d-8ba3-2ac9006223b6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "95b4e217-033a-49ed-938b-0ffb4803cd28", "chroma:document": "of security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9355ee8d-48ce-4c18-8471-564076d3cb29
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "4944a6ff-9ee6-48a1-a071-e30e76ea1cfe", "chroma:document": "alone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 081dd04b-02f6-4403-94ec-076e1e6f5003
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "b2e57ecb-c756-447e-bc12-8a365d3ed322", "chroma:document": "record formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ec4853f3-add8-43a5-ac10-053627d26115
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "7fe92a18-bfd2-457d-a05b-86e68573fcc4", "chroma:document": "for the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6d94ba7e-e856-4775-a196-4f46d2b4c7ef
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "f1310a57-7aa2-403a-a22e-5e0a685a34f3", "chroma:document": "architecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ea2a49cc-3aa8-4231-86bf-5dd58e92a5bb
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 89, "full_page_content": "90 \n \n1. Users should not read files in other users' personal directories. \n2. Users must not write other users' files. \n3. Users who log in after hours often access the same files they used earlier. \n4. Users do not generally open disk devices directly but rely on higher-level operating \nsystem  \nutilities. \n5. Users should not be logged in more than once to the same system. \n 3.2.4 The Base-Rate Fallacy \n      To be of practical use, an intrusion detection system should detect a substantial \npercentage of intrusions while keeping the false alarm rate at an acceptable level. If only \na modest percentage of actual intrusions are detected, the system provides a false sense \nof security. On the other hand, if the system frequently triggers an alert when there is no \nintrusion (a false alarm), then either system managers will begin to ignore the alarms, or \nmuch time will be wasted analyzing the false alarms. \n     3.2.5 Distributed Intrusion Detection \nUntil recently, work on intrusion detection systems focused on single-system stand-\nalone facilities. The typical organization, however, needs to defend a distributed \ncollection of hosts supported by a LAN Porras points out the following major issues in \nthe design of a distributed intrusion detection system \n\u2713 \nA distributed intrusion detection system may need to deal with different audit \nrecord formats. In a heterogeneous environment, different systems will employ different \nnative audit collection systems and, if using intrusion detection, may employ different \nformats for security-related audit records.   \n\u2713 \nOne or more nodes in the network will serve as collection and analysis points \nfor the data from the systems on the network. Thus, either raw audit data or summary \ndata must be transmitted across the network. Therefore, there is a requirement to assure \nthe integrity and confidentiality of these data.  \n\u2713 \nEither a centralized or decentralized architecture can be used. With a centralized \narchitecture, there is a single central point of collection and analysis of all audit data. This \neases the task of correlating incoming reports but creates a potential bottleneck and single \npoint of failure. With a decentralized architecture, there are more than one analysis \ncenters, but these must coordinate their activities and exchange information. \nA good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager.", "chunk_id": "40de039a-c7e8-444d-9d00-c4ce58254862", "chroma:document": "A good example of a distributed intrusion detection system is developed. Figure 3.2  \nshows the overall architecture, which consists of three main components:  \n\u25cf Host agent module: An audit collection module operating as a background process on \na monitored system. Its purpose is to collect data on security-related events on the host \nand transmit these to the central manager."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 976d0922-42be-4da1-a638-efa1ff582f1a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 90, "full_page_content": "91 \n \n\u25cf LAN monitor agent module: Operates in the same fashion as a host agent module \nexcept that it analyzes LAN traffic and reports the results to the central manager. \n \u25cf Central manager module: Receives reports from LAN monitor and host agents and \nprocesses and correlates these reports to detect intrusion \n \nFig 3.2. Architecture for Distributed Intrusion Detection \nThe scheme is designed to be independent of any operating system or system auditing \nimplementation.", "chunk_id": "a56a83d0-fd53-4ccc-87b8-1b83b31d9df2", "chroma:document": "91 \n \n\u25cf LAN monitor agent module: Operates in the same fashion as a host agent module \nexcept that it analyzes LAN traffic and reports the results to the central manager. \n \u25cf Central manager module: Receives reports from LAN monitor and host agents and \nprocesses and correlates these reports to detect intrusion \n \nFig 3.2. Architecture for Distributed Intrusion Detection"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5cd4e113-29b5-4d96-aaa5-b9de83b63b3c
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 90, "full_page_content": "91 \n \n\u25cf LAN monitor agent module: Operates in the same fashion as a host agent module \nexcept that it analyzes LAN traffic and reports the results to the central manager. \n \u25cf Central manager module: Receives reports from LAN monitor and host agents and \nprocesses and correlates these reports to detect intrusion \n \nFig 3.2. Architecture for Distributed Intrusion Detection \nThe scheme is designed to be independent of any operating system or system auditing \nimplementation.", "chunk_id": "65f79ba5-0b29-40a3-8d26-b7440e96bbe3", "chroma:document": "The scheme is designed to be independent of any operating system or system auditing \nimplementation."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: da1e70ee-4a11-4147-a5c8-16a0085a4f16
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 91, "full_page_content": "92 \n \n \n \n\u2022        The agent captures each audit record produced by the native audit collection system. \n\u2022        A filter is applied that retains only those records that are of security interest. \n\u2022        These records are then reformatted into a standardized format referred to as the host \naudit record (HAR). \n\u2022        Next, a template-driven logic module analyzes the records for suspicious activity. \n\u2022        At the lowestlevel, the agent scans for notable events that are of interest independent \nof any past events. \n\u2022        Examples include failed file accesses, accessing system files, and changing a file's \naccess control. \n\u2022        At the next higher level, the agent looks for sequences of events, such as known attack \natterns (signatures). \n\u2022        Finally, the agent looks for anomalous behavior of an individual user based on a \nhistorical profile of that user, such as number of programs executed, number of files \naccessed, and the like. \n\u2022        When suspicious activity is detected, an alert is sent to the central manager.", "chunk_id": "5bd1ba36-674d-4849-99fe-e26c4700b95d", "chroma:document": "92 \n \n \n \n\u2022        The agent captures each audit record produced by the native audit collection system. \n\u2022        A filter is applied that retains only those records that are of security interest. \n\u2022        These records are then reformatted into a standardized format referred to as the host \naudit record (HAR)."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 009013a9-d9e2-4c72-94d5-ca3458ab8026
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 91, "full_page_content": "92 \n \n \n \n\u2022        The agent captures each audit record produced by the native audit collection system. \n\u2022        A filter is applied that retains only those records that are of security interest. \n\u2022        These records are then reformatted into a standardized format referred to as the host \naudit record (HAR). \n\u2022        Next, a template-driven logic module analyzes the records for suspicious activity. \n\u2022        At the lowestlevel, the agent scans for notable events that are of interest independent \nof any past events. \n\u2022        Examples include failed file accesses, accessing system files, and changing a file's \naccess control. \n\u2022        At the next higher level, the agent looks for sequences of events, such as known attack \natterns (signatures). \n\u2022        Finally, the agent looks for anomalous behavior of an individual user based on a \nhistorical profile of that user, such as number of programs executed, number of files \naccessed, and the like. \n\u2022        When suspicious activity is detected, an alert is sent to the central manager.", "chunk_id": "ebdf27d4-ff1e-4746-99df-a8d5df2beadf", "chroma:document": "\u2022        Next, a template-driven logic module analyzes the records for suspicious activity. \n\u2022        At the lowestlevel, the agent scans for notable events that are of interest independent \nof any past events. \n\u2022        Examples include failed file accesses, accessing system files, and changing a file's \naccess control."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 03e57c77-69cb-4fe8-a5b9-62ff1bfbbd18
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 91, "full_page_content": "92 \n \n \n \n\u2022        The agent captures each audit record produced by the native audit collection system. \n\u2022        A filter is applied that retains only those records that are of security interest. \n\u2022        These records are then reformatted into a standardized format referred to as the host \naudit record (HAR). \n\u2022        Next, a template-driven logic module analyzes the records for suspicious activity. \n\u2022        At the lowestlevel, the agent scans for notable events that are of interest independent \nof any past events. \n\u2022        Examples include failed file accesses, accessing system files, and changing a file's \naccess control. \n\u2022        At the next higher level, the agent looks for sequences of events, such as known attack \natterns (signatures). \n\u2022        Finally, the agent looks for anomalous behavior of an individual user based on a \nhistorical profile of that user, such as number of programs executed, number of files \naccessed, and the like. \n\u2022        When suspicious activity is detected, an alert is sent to the central manager.", "chunk_id": "c204a053-ea9c-48e9-804b-e891b3e42380", "chroma:document": "access control. \n\u2022        At the next higher level, the agent looks for sequences of events, such as known attack \natterns (signatures). \n\u2022        Finally, the agent looks for anomalous behavior of an individual user based on a \nhistorical profile of that user, such as number of programs executed, number of files \naccessed, and the like."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 98eef87e-54fb-4e65-a157-319dcfa42fe1
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 91, "full_page_content": "92 \n \n \n \n\u2022        The agent captures each audit record produced by the native audit collection system. \n\u2022        A filter is applied that retains only those records that are of security interest. \n\u2022        These records are then reformatted into a standardized format referred to as the host \naudit record (HAR). \n\u2022        Next, a template-driven logic module analyzes the records for suspicious activity. \n\u2022        At the lowestlevel, the agent scans for notable events that are of interest independent \nof any past events. \n\u2022        Examples include failed file accesses, accessing system files, and changing a file's \naccess control. \n\u2022        At the next higher level, the agent looks for sequences of events, such as known attack \natterns (signatures). \n\u2022        Finally, the agent looks for anomalous behavior of an individual user based on a \nhistorical profile of that user, such as number of programs executed, number of files \naccessed, and the like. \n\u2022        When suspicious activity is detected, an alert is sent to the central manager.", "chunk_id": "8955bdae-6241-4e67-8a32-ae579b56b6a2", "chroma:document": "\u2022        When suspicious activity is detected, an alert is sent to the central manager."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f01120f7-1489-47ab-abe4-f8f3fc5d1cde
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "2d90e412-e871-42d2-aaaa-7400118563db", "chroma:document": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f31a7393-8b1b-4168-b6eb-975aa8ffb077
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "922a810c-06b3-432c-b692-50b8c4affa3e", "chroma:document": "\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e5ae7464-449b-44f1-b13f-cf5c82557cb8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "e68f95db-1793-4f27-85c5-c460e48bc5d2", "chroma:document": "3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 589212b3-9be1-413a-9a73-2b9036f6b32f
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "1e9bab7c-e33b-46bc-bfc3-5bc86652cb60", "chroma:document": "To facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: f6e07c5c-4546-4c61-bc18-5d4df98bfbf6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "044f0a9c-d0a3-45e5-a9cf-e8f0ca964799", "chroma:document": "between \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 971472a7-8977-4d1f-8c49-63f11a231a01
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "549b3fb2-37b4-4f95-8fa2-c01f961b32a1", "chroma:document": "the requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dbe7910a-96fd-4309-9317-de9fc90d7f10
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 92, "full_page_content": "93 \n \n\u2022        The central manager includes an expert system that can draw inferences from received \ndata. \n\u2022        The manager may also query individual systems for copies of HARs to correlate with \nthose from other agents. \n\u2022        The LAN monitor agent also supplies information to the central manager. \n\u2022        The LAN monitor agent audits host-host connections, services used, and volume of \ntraffic. \n\u2022        It  \nsearches  \nfor  \nsignificant  \nevents,  \nsuch  \nas  \nsudden  \nchanges \nin \nnetwork  load,  the  use  of \n\u2022        security-related services, and network activities such as rlogin. \n 3.2.6 Honeypots \nA relatively recent innovation in intrusion detection technology is the honeypot. \nHoneypots are designed to \n\u25cf divert an attacker from accessing critical systems \n\u25cf collect information about the attacker's activity \n\u25cf encourage the attacker to stay on the system long enough for administrators to respond \n3.2.7 Intrusion Detection Exchange Format \nTo facilitate the development of distributed intrusion detection systems that can \nfunction across a wide range of platforms and environments, standards are needed to \nsupport interoperability.  \n The outputs of this working group include the following: \n1. A requirements document, which describes the high-level functional requirements for \ncommunication \nbetween \nintrusion \ndetection \nsystems \nand \nrequirements \nfor \ncommunication between intrusion detection systems and with management systems, \nincluding the rationale for those requirements. Scenarios will be used to illustrate the \nrequirements. \n2. A common intrusion language specification, which describes data formats that satisfy \nthe requirements. \n3. A framework document, which identifies existing protocols best used for \ncommunication between intrusion detection systems, and describes how the devised data \nformats relate to them. \n3.3 Password Management \n3.3.1 Password Protection \nThe front line of defense against intruders is the password system. Virtually all \nmultiuser systems require that a user provide not only a name or identifier (ID) but also", "chunk_id": "3a1d8d08-60c5-4b46-951f-92369eb73fa6", "chroma:document": "multiuser systems require that a user provide not only a name or identifier (ID) but also"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: af2665e7-d5e3-4095-a330-583e141ce701
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "6325baba-bf02-4c5a-a83f-3f1cb609aff4", "chroma:document": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 2eb26344-1a5c-4b28-80ce-5db9a3fe1c94
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "7bcb053e-7179-428d-b93e-fe75a700fb37", "chroma:document": "\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ca14da2a-4dc0-419a-8443-3a02259e98c0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "8376ed07-887b-408e-bd22-150e37bb4287", "chroma:document": "scheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b6b55296-3e4d-45e1-ab33-c1f9f7151849
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "c5ec4760-b2f1-48cd-b134-3935e26bc8ac", "chroma:document": "modified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6825f3cc-17a0-4fd1-b68c-0a41800e0847
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "9e9669ee-9e6b-42d4-bed8-26ef34c9aea9", "chroma:document": "\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8eac6eb3-ba2c-4a10-b506-bb8bf8835d96
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "e0778ddb-aa0a-4977-a3f0-30182fff2886", "chroma:document": "\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 180ec089-b75d-47c7-97f0-00b63fc124da
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 93, "full_page_content": "94 \n \na password. The password serves to authenticate the ID of the individual logging on to \nthe system. In turn, the ID provides security in the following ways: \n\u2022 The ID determines whether the user is authorized to gain access to a system.  \n\u2022  The ID determines the privileges accorded to the user.  \n\u2022  The ID is used in what is referred to as discretionary access control. For example, by \nlisting the IDs of the other users, a user may grant permission to them to read files owned \nby that user. \n3.3.1.1 The Vulnerability of Passwords \nTo understand the nature of the threat to password-based systems, let us consider a \nscheme that is widely used on UNIX, the following procedure is employed in figure 3.3. \n\u2022 Each user selects a password of up to eight printable characters in length.  \n\u2022 This is converted into a 56-bit value (using 7-bit ASCII) that serves as the key input to \nan encryption routine.  \n\u2022 The encryption routine, known as crypt(3), is based on DES. The DES algorithm is \nmodified using a 12-bit \"salt\" value. \n\u2022 Typically, this value is related to the time at which the password is assigned to the user.  \n\u2022 The modified DES algorithm is exercised with a data input consisting of a 64-bit block \nof zeros.  \n\u2022 The output of the algorithm then serves as input for a second encryption.  \n\u2022 This process is repeated for a total of 25 encryptions. \n\u2022 The resulting 64-bit output is then translated into an 11-character sequence.  \n\u2022 The hashed password is then stored, together with a plaintext copy of the salt, in the \npassword file for the corresponding user ID.  \n\u2022 This method has been shown to be secure against a variety of cryptanalytic attack \nThe salt serves three purposes: \n\u25cf It prevents duplicate passwords from being visible in the password file. Even if two \nusers choose the same password, those passwords will be assigned at different times. \nHence, the \"extended\" passwords of the two users will differ. \n\u25cf It effectively increases the length of the password without requiring the user to \nremember two additional characters.  \n\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext", "chunk_id": "d9432c65-156a-44e4-81dd-b5e9707b7a7a", "chroma:document": "\u25cf It prevents the use of a hardware implementation of DES, which would ease the \ndifficulty of a brute-force guessing attack. \nWhen a user attempts to log on to a UNIX system, the user provides an ID and a password. \nThe operating system uses the ID to index into the password file and retrieve the plaintext"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 47d17295-1d45-4ba4-9924-dc19c18f81da
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 94, "full_page_content": "95 \n \nsalt and the encrypted password. The salt and user-supplied password are used as input \nto the encryption routine. If the result matches the stored value, the password is accepted. \nThe encryption routine is designed to discourage guessing attacks. Software \nimplementations of DES are slow compared to hardware versions, and the use of 25 \niterations multiplies the time required by 25. \n \n \nFig 3.3 : UNIX Password Scheme \n \n \nThus, there are two threats to the UNIX password scheme. First, a user can gain \naccess on a machine using a guest account or by some other means and then run a \npassword guessing program, called a password cracker, on that machine.", "chunk_id": "41b7b86a-4e56-4129-be18-6a84a2aecb61", "chroma:document": "95 \n \nsalt and the encrypted password. The salt and user-supplied password are used as input \nto the encryption routine. If the result matches the stored value, the password is accepted. \nThe encryption routine is designed to discourage guessing attacks. Software \nimplementations of DES are slow compared to hardware versions, and the use of 25"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 65e40768-2907-4fba-8afa-765758e87035
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 94, "full_page_content": "95 \n \nsalt and the encrypted password. The salt and user-supplied password are used as input \nto the encryption routine. If the result matches the stored value, the password is accepted. \nThe encryption routine is designed to discourage guessing attacks. Software \nimplementations of DES are slow compared to hardware versions, and the use of 25 \niterations multiplies the time required by 25. \n \n \nFig 3.3 : UNIX Password Scheme \n \n \nThus, there are two threats to the UNIX password scheme. First, a user can gain \naccess on a machine using a guest account or by some other means and then run a \npassword guessing program, called a password cracker, on that machine.", "chunk_id": "36ac022f-89d5-45af-9dd0-ec7e54502160", "chroma:document": "iterations multiplies the time required by 25. \n \n \nFig 3.3 : UNIX Password Scheme \n \n \nThus, there are two threats to the UNIX password scheme. First, a user can gain \naccess on a machine using a guest account or by some other means and then run a \npassword guessing program, called a password cracker, on that machine."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8b5784e1-cf98-4e73-9e9b-596d879cfdf4
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "a1bbbccc-4b24-4d8a-948c-ca1896097bf5", "chroma:document": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 60afa6f0-2567-405d-b3b5-8680bc6474a6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "5c50f71d-9515-4946-802a-12682caecff6", "chroma:document": "second on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 113e395e-879e-4504-9ae8-ddd41666c04a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "c68240a1-2ab4-4a17-b2ba-46368e8e729f", "chroma:document": "password cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5cc3a9ae-3a65-499d-bd3a-1610e7933756
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "3ec645fb-eefa-444e-8092-52469c27fbfd", "chroma:document": "4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 7ac93c7c-ce9d-44be-819b-ef663c6ef14e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "9ad44cc9-00a2-40d7-9b28-0760150c593f", "chroma:document": "the opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 1084d507-44db-4bea-aab7-3426295f898b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "8ba28ba4-7d0b-4fb5-9268-3715612c3322", "chroma:document": "provided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 215e78a4-2d3e-443f-ba60-e99cac00a528
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 95, "full_page_content": "96 \n \nAs an example, a password cracker was reported on the Internet in August 1993. \nUsing a Thinking Machines Corporation parallel computer, a performance of 1560 \nencryptions per second per vector unit was achieved. With four vector units per \nprocessing node (a standard configuration), this works out to 800,000 encryptions per \nsecond on a 128-node machine (which is a modest size) and 6.4 million encryptions per \nsecond on a 1024-node machine. \nPassword length is only part of the problem. Many people, when permitted to \nchoose their own password, pick a password that is guessable, such as their own name, \ntheir street name, a common dictionary word, and so forth. This makes the job of \npassword cracking straightforward. \nThe following strategy was used: \n1. Try the user's name, initials, account name, and other relevant personal information. In \nall, 130 different permutations for each user were tried. \n2. Try words from various dictionaries.  \n3. Try various permutations on the words from step 2.  \n4. Try various capitalization permutations on the words from step 2 that were not \nconsidered in step 3. This added almost 2 million additional words to the list. \n3.3.1.2 Access Control \nOne way to thwart a password attack is to deny the opponent access to the password file. \nIf the encrypted password portion of the file is accessible only by a privileged user, then \nthe opponent cannot read it without already knowing the password of a privileged user. \n 3.3.2 Password Selection Strategies \nFour basic techniques are in use: \n\u2022 User education  \n\u2022 Computer-generated passwords \n\u2022 Reactive password checking  \n\u2022 Proactive password checking \n \nUsers can be told the importance of using hard-to-guess passwords and can be \nprovided with guidelines for selecting strong passwords. This user education strategy \nis unlikely to succeed at most installations, particularly where there is a large user \npopulation or a lot of turnover. Many users will simply ignore the guidelines \nComputer-generated passwords also have problems. If the passwords are quite random \nin nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown.", "chunk_id": "6fbec6dd-5bba-4982-81c1-0552a4abdfd0", "chroma:document": "in nature, users will not be able to remember them. Even if the password is \npronounceable, the user may have difficulty remembering it and so be tempted to write it \ndown."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: eccd8f3c-7db1-4530-91f5-e5c04174a466
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 96, "full_page_content": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password. \nHowever, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack. \nThe first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach: \n\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov \nmodel for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter \nfollows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5.", "chunk_id": "425dc4d4-c64e-449d-924e-a1e1cea86105", "chroma:document": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9e9163f0-a013-4924-a1df-587ef9319bdd
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 96, "full_page_content": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password. \nHowever, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack. \nThe first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach: \n\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov \nmodel for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter \nfollows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5.", "chunk_id": "8a0012ed-d498-470e-a549-e369ccddaa98", "chroma:document": "However, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: eeaa375a-c430-4505-8ee4-c603296e51d6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 96, "full_page_content": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password. \nHowever, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack. \nThe first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach: \n\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov \nmodel for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter \nfollows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5.", "chunk_id": "be3506ce-f235-4904-ae7c-4b46107e9a53", "chroma:document": "The first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9e77d891-1548-4ca8-b8bc-aaa3f5170922
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 96, "full_page_content": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password. \nHowever, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack. \nThe first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach: \n\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov \nmodel for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter \nfollows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5.", "chunk_id": "3aa695b8-21f2-426d-84a9-4f7695bac417", "chroma:document": "\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6d766da3-51cc-482f-9421-2b822144b410
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 96, "full_page_content": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password. \nHowever, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack. \nThe first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach: \n\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov \nmodel for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter \nfollows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5.", "chunk_id": "2f878ad0-f35d-482b-ae54-39b3d9aa5d03", "chroma:document": "model for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 827d4e24-2194-4a8a-a22e-bad955d939d8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 96, "full_page_content": "97 \n \nA reactive password checking strategy is one in which the system periodically runs its \nown password   cracker to find guessable passwords. \n \nThe most promising approach to improved password security is a proactive \npassword checker. In this scheme, a user is allowed to select his or her own password. \nHowever, at the time of selection, the system checks to see if the password is allowable \nand, if not, rejects it. Such checkers are based on the philosophy that, with sufficient \nguidance from the system, users can select memorable passwords from a fairly large \npassword space that are not likely to be guessed in a dictionary attack. \nThe first approach is a simple system for rule enforcement. For example, the following \nrules could be enforced: \n\u25cf All passwords must be at least eight characters long. \n\u25cf In the first eight characters, the passwords must include at least one each of uppercase, \nlowercase, numeric digits, and punctuation marks. \nThere are two problems with this approach: \n\u25cf Space: The dictionary must be very large to be effective.  \n\u25cf Time: The time required to search a large dictionary may itself be large.  \nTwo techniques for developing an effective and efficient proactive password checker that \nis based on rejecting words on a list show promise. One of these develops a Markov \nmodel for the generation of guessable passwords. Figure 3.4 shows a simplified version \nof such a model. This model shows a language consisting of an alphabet of three \ncharacters. The state of the system at any time is the identity of the most recent letter. The \nvalue on the transition from one state to another represents the probability that one letter \nfollows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5.", "chunk_id": "16308cc9-616b-4018-9fab-9e12558c696c", "chroma:document": "follows another. Thus, the probability that the next letter is b, given that the current letter \nis a, is 0.5."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 907d653a-0544-40a1-a887-4aafca0ffcc9
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 97, "full_page_content": "98 \n \n \nFigure 3.4. An Example Markov Model \n \nIn general, a Markov model is a quadruple [m, A, T, k], where m is the number of \nstates in the model, A is the state space, T is the matrix of transition probabilities, and k \nis the order of the model. For a kth-order model, the probability of making a transition to \na particular letter depends on the previous k letters that have been generated. \n \nThe authors report on the development and use of a second-order model. To begin, a \ndictionary of guessable passwords is constructed. Then the transition matrix is calculated \nas follows: \n1. Determine the frequency matrix f, where f(i, j, k) is the number of occurrences of the \ntrigram  \nconsisting of the ith, jth, and kth character. For example, the password parsnips yields the  \ntrigrams par, ars, rsn, sni, nip, and ips. \n2. For each bigram ij, calculate f(i, j, ) as the total number of trigrams beginning with ij. \nFor  \nexample, f(a, b, ) would be the total number of trigrams of the form aba, abb, abc, and so \non. \n3. Compute the entries of T as follows:", "chunk_id": "7b6ac3ba-df4b-442a-b11a-93438dd48e3f", "chroma:document": "98 \n \n \nFigure 3.4. An Example Markov Model \n \nIn general, a Markov model is a quadruple [m, A, T, k], where m is the number of \nstates in the model, A is the state space, T is the matrix of transition probabilities, and k \nis the order of the model. For a kth-order model, the probability of making a transition to"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 80651eed-f615-4b36-9e49-0a66fd5d153d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 97, "full_page_content": "98 \n \n \nFigure 3.4. An Example Markov Model \n \nIn general, a Markov model is a quadruple [m, A, T, k], where m is the number of \nstates in the model, A is the state space, T is the matrix of transition probabilities, and k \nis the order of the model. For a kth-order model, the probability of making a transition to \na particular letter depends on the previous k letters that have been generated. \n \nThe authors report on the development and use of a second-order model. To begin, a \ndictionary of guessable passwords is constructed. Then the transition matrix is calculated \nas follows: \n1. Determine the frequency matrix f, where f(i, j, k) is the number of occurrences of the \ntrigram  \nconsisting of the ith, jth, and kth character. For example, the password parsnips yields the  \ntrigrams par, ars, rsn, sni, nip, and ips. \n2. For each bigram ij, calculate f(i, j, ) as the total number of trigrams beginning with ij. \nFor  \nexample, f(a, b, ) would be the total number of trigrams of the form aba, abb, abc, and so \non. \n3. Compute the entries of T as follows:", "chunk_id": "96b08691-1b6e-4bfd-8ea1-b82465bb7b10", "chroma:document": "a particular letter depends on the previous k letters that have been generated. \n \nThe authors report on the development and use of a second-order model. To begin, a \ndictionary of guessable passwords is constructed. Then the transition matrix is calculated \nas follows: \n1. Determine the frequency matrix f, where f(i, j, k) is the number of occurrences of the \ntrigram"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ba9d1427-24ee-43c9-9da6-fe87c7b86c80
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 97, "full_page_content": "98 \n \n \nFigure 3.4. An Example Markov Model \n \nIn general, a Markov model is a quadruple [m, A, T, k], where m is the number of \nstates in the model, A is the state space, T is the matrix of transition probabilities, and k \nis the order of the model. For a kth-order model, the probability of making a transition to \na particular letter depends on the previous k letters that have been generated. \n \nThe authors report on the development and use of a second-order model. To begin, a \ndictionary of guessable passwords is constructed. Then the transition matrix is calculated \nas follows: \n1. Determine the frequency matrix f, where f(i, j, k) is the number of occurrences of the \ntrigram  \nconsisting of the ith, jth, and kth character. For example, the password parsnips yields the  \ntrigrams par, ars, rsn, sni, nip, and ips. \n2. For each bigram ij, calculate f(i, j, ) as the total number of trigrams beginning with ij. \nFor  \nexample, f(a, b, ) would be the total number of trigrams of the form aba, abb, abc, and so \non. \n3. Compute the entries of T as follows:", "chunk_id": "80a7b24f-0840-4a9a-8ca4-301ea0967534", "chroma:document": "trigram  \nconsisting of the ith, jth, and kth character. For example, the password parsnips yields the  \ntrigrams par, ars, rsn, sni, nip, and ips. \n2. For each bigram ij, calculate f(i, j, ) as the total number of trigrams beginning with ij. \nFor  \nexample, f(a, b, ) would be the total number of trigrams of the form aba, abb, abc, and so \non."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: fcc09c33-dbf3-4b38-b5e0-f6cb0def7e69
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 97, "full_page_content": "98 \n \n \nFigure 3.4. An Example Markov Model \n \nIn general, a Markov model is a quadruple [m, A, T, k], where m is the number of \nstates in the model, A is the state space, T is the matrix of transition probabilities, and k \nis the order of the model. For a kth-order model, the probability of making a transition to \na particular letter depends on the previous k letters that have been generated. \n \nThe authors report on the development and use of a second-order model. To begin, a \ndictionary of guessable passwords is constructed. Then the transition matrix is calculated \nas follows: \n1. Determine the frequency matrix f, where f(i, j, k) is the number of occurrences of the \ntrigram  \nconsisting of the ith, jth, and kth character. For example, the password parsnips yields the  \ntrigrams par, ars, rsn, sni, nip, and ips. \n2. For each bigram ij, calculate f(i, j, ) as the total number of trigrams beginning with ij. \nFor  \nexample, f(a, b, ) would be the total number of trigrams of the form aba, abb, abc, and so \non. \n3. Compute the entries of T as follows:", "chunk_id": "8c7d777c-19c7-4cf6-adbd-fef0def8bdfe", "chroma:document": "on. \n3. Compute the entries of T as follows:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 757f2fc3-7734-4e3f-bf74-616f01ae1ab8
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 98, "full_page_content": "99 \n \nThe result is a model that reflects the structure of the words in the dictionary. \nA quite different approach has been reported by Spafford [SPAF92a, SPAF92b]. It is \nbased on the use of a Bloom filter [BLOO70]. To begin, we explain the operation of the \nBloom filter. A Bloom filter of order k consists of a set of k independent hash functions \nH1(x), H2(x),..., Hk (x), where each function maps a password into a hash value in the \nrange 0 to N - 1 That is, \n \nD = number of words in password dictionary \nThe following procedure is then applied to the dictionary: \n1. A hash table of N bits is defined, with all bits initially set to 0. \n2. For each password, its k hash values are calculated, and the corresponding bits in the \nhash table are set to 1. Thus, if Hi(Xj) = 67 for some (i, j), then the sixty-seventh bit of \nthe hash table is set to 1; if the bit already has the value 1, it remains at 1.When a new \npassword is presented to the checker, its k hash values are calculated. If all the \ncorresponding bits of the hash table are equal to 1, then the password is rejected. \n \n3.4 Malcious Software \n3.4.1 Malicious Programs \n \nMalicious software can be divided into two categories: those that need a host \nprogram, and those that are independent. The former, referred to as parasitic, are \nessentially fragments of programs that cannot exist independently of some actual \napplication program, utility, or system program. Viruses, logic  bombs,", "chunk_id": "be732425-47c4-4b54-b758-5fabde190d2c", "chroma:document": "99 \n \nThe result is a model that reflects the structure of the words in the dictionary. \nA quite different approach has been reported by Spafford [SPAF92a, SPAF92b]. It is \nbased on the use of a Bloom filter [BLOO70]. To begin, we explain the operation of the \nBloom filter. A Bloom filter of order k consists of a set of k independent hash functions"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9e463311-9819-436f-ba4e-53f0edda4b48
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 98, "full_page_content": "99 \n \nThe result is a model that reflects the structure of the words in the dictionary. \nA quite different approach has been reported by Spafford [SPAF92a, SPAF92b]. It is \nbased on the use of a Bloom filter [BLOO70]. To begin, we explain the operation of the \nBloom filter. A Bloom filter of order k consists of a set of k independent hash functions \nH1(x), H2(x),..., Hk (x), where each function maps a password into a hash value in the \nrange 0 to N - 1 That is, \n \nD = number of words in password dictionary \nThe following procedure is then applied to the dictionary: \n1. A hash table of N bits is defined, with all bits initially set to 0. \n2. For each password, its k hash values are calculated, and the corresponding bits in the \nhash table are set to 1. Thus, if Hi(Xj) = 67 for some (i, j), then the sixty-seventh bit of \nthe hash table is set to 1; if the bit already has the value 1, it remains at 1.When a new \npassword is presented to the checker, its k hash values are calculated. If all the \ncorresponding bits of the hash table are equal to 1, then the password is rejected. \n \n3.4 Malcious Software \n3.4.1 Malicious Programs \n \nMalicious software can be divided into two categories: those that need a host \nprogram, and those that are independent. The former, referred to as parasitic, are \nessentially fragments of programs that cannot exist independently of some actual \napplication program, utility, or system program. Viruses, logic  bombs,", "chunk_id": "85f8459a-8df2-4ed3-8e94-4b11107fe4eb", "chroma:document": "H1(x), H2(x),..., Hk (x), where each function maps a password into a hash value in the \nrange 0 to N - 1 That is, \n \nD = number of words in password dictionary \nThe following procedure is then applied to the dictionary: \n1. A hash table of N bits is defined, with all bits initially set to 0."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0392fd40-fb9c-4dc9-8211-150d9bd91d4f
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 98, "full_page_content": "99 \n \nThe result is a model that reflects the structure of the words in the dictionary. \nA quite different approach has been reported by Spafford [SPAF92a, SPAF92b]. It is \nbased on the use of a Bloom filter [BLOO70]. To begin, we explain the operation of the \nBloom filter. A Bloom filter of order k consists of a set of k independent hash functions \nH1(x), H2(x),..., Hk (x), where each function maps a password into a hash value in the \nrange 0 to N - 1 That is, \n \nD = number of words in password dictionary \nThe following procedure is then applied to the dictionary: \n1. A hash table of N bits is defined, with all bits initially set to 0. \n2. For each password, its k hash values are calculated, and the corresponding bits in the \nhash table are set to 1. Thus, if Hi(Xj) = 67 for some (i, j), then the sixty-seventh bit of \nthe hash table is set to 1; if the bit already has the value 1, it remains at 1.When a new \npassword is presented to the checker, its k hash values are calculated. If all the \ncorresponding bits of the hash table are equal to 1, then the password is rejected. \n \n3.4 Malcious Software \n3.4.1 Malicious Programs \n \nMalicious software can be divided into two categories: those that need a host \nprogram, and those that are independent. The former, referred to as parasitic, are \nessentially fragments of programs that cannot exist independently of some actual \napplication program, utility, or system program. Viruses, logic  bombs,", "chunk_id": "3845fc56-6c82-4bbf-ba6b-fe8bcff70c64", "chroma:document": "2. For each password, its k hash values are calculated, and the corresponding bits in the \nhash table are set to 1. Thus, if Hi(Xj) = 67 for some (i, j), then the sixty-seventh bit of \nthe hash table is set to 1; if the bit already has the value 1, it remains at 1.When a new \npassword is presented to the checker, its k hash values are calculated. If all the"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9e2703c1-e152-434d-9bcf-da7a0d8bb655
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 98, "full_page_content": "99 \n \nThe result is a model that reflects the structure of the words in the dictionary. \nA quite different approach has been reported by Spafford [SPAF92a, SPAF92b]. It is \nbased on the use of a Bloom filter [BLOO70]. To begin, we explain the operation of the \nBloom filter. A Bloom filter of order k consists of a set of k independent hash functions \nH1(x), H2(x),..., Hk (x), where each function maps a password into a hash value in the \nrange 0 to N - 1 That is, \n \nD = number of words in password dictionary \nThe following procedure is then applied to the dictionary: \n1. A hash table of N bits is defined, with all bits initially set to 0. \n2. For each password, its k hash values are calculated, and the corresponding bits in the \nhash table are set to 1. Thus, if Hi(Xj) = 67 for some (i, j), then the sixty-seventh bit of \nthe hash table is set to 1; if the bit already has the value 1, it remains at 1.When a new \npassword is presented to the checker, its k hash values are calculated. If all the \ncorresponding bits of the hash table are equal to 1, then the password is rejected. \n \n3.4 Malcious Software \n3.4.1 Malicious Programs \n \nMalicious software can be divided into two categories: those that need a host \nprogram, and those that are independent. The former, referred to as parasitic, are \nessentially fragments of programs that cannot exist independently of some actual \napplication program, utility, or system program. Viruses, logic  bombs,", "chunk_id": "04c640a4-ad6c-4645-848f-d7fbfbe86a22", "chroma:document": "corresponding bits of the hash table are equal to 1, then the password is rejected. \n \n3.4 Malcious Software \n3.4.1 Malicious Programs \n \nMalicious software can be divided into two categories: those that need a host \nprogram, and those that are independent. The former, referred to as parasitic, are \nessentially fragments of programs that cannot exist independently of some actual"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 8d23d418-e958-4379-94f7-edfa37b86f00
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 98, "full_page_content": "99 \n \nThe result is a model that reflects the structure of the words in the dictionary. \nA quite different approach has been reported by Spafford [SPAF92a, SPAF92b]. It is \nbased on the use of a Bloom filter [BLOO70]. To begin, we explain the operation of the \nBloom filter. A Bloom filter of order k consists of a set of k independent hash functions \nH1(x), H2(x),..., Hk (x), where each function maps a password into a hash value in the \nrange 0 to N - 1 That is, \n \nD = number of words in password dictionary \nThe following procedure is then applied to the dictionary: \n1. A hash table of N bits is defined, with all bits initially set to 0. \n2. For each password, its k hash values are calculated, and the corresponding bits in the \nhash table are set to 1. Thus, if Hi(Xj) = 67 for some (i, j), then the sixty-seventh bit of \nthe hash table is set to 1; if the bit already has the value 1, it remains at 1.When a new \npassword is presented to the checker, its k hash values are calculated. If all the \ncorresponding bits of the hash table are equal to 1, then the password is rejected. \n \n3.4 Malcious Software \n3.4.1 Malicious Programs \n \nMalicious software can be divided into two categories: those that need a host \nprogram, and those that are independent. The former, referred to as parasitic, are \nessentially fragments of programs that cannot exist independently of some actual \napplication program, utility, or system program. Viruses, logic  bombs,", "chunk_id": "2b8685a7-6a73-4e5a-a1de-efb594120ca0", "chroma:document": "application program, utility, or system program. Viruses, logic  bombs,"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 9960bb90-b1ec-4ae4-b4aa-b2061231d9f0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 99, "full_page_content": "100 \n \n \n \nTable 3.1 Terminology of Malicious Programs \nand backdoors are examples. Independent malware is a self-contained program that can \nbe scheduled and run by the operating system. Worms and bot programs are examples. \n \n3.4.1.1 Backdoor \n \nA backdoor, also known as a trapdoor, is a secret entry point into a program that \nallows someone who is aware of the backdoor to gain access without going through the \nusual security access procedures. Programmers have used backdoors legiti- mately for \nmany years to debug and test programs; such a backdoor is called a maintenance hook. \nThis usually is done when the programmer is developing an application that has an \nauthentication procedure, or a long setup, requiring the user to enter many different values \nto run the application. To debug the program, the developer may wish to gain special \nprivileges or to avoid all the necessary setup and authentication.  \n \nBackdoors become threats when unscrupulous programmers use them to gain \nunauthorized access. The backdoor was the basic idea for the vulnerability portrayed in \nthe movie War Games. Another example is that during the develop- ment of Multics, \npenetration tests were conducted by an Air Force \u201ctiger team\u201d (simulating adversaries).", "chunk_id": "3c87db30-b23f-4225-aa48-fa883852ee2c", "chroma:document": "100 \n \n \n \nTable 3.1 Terminology of Malicious Programs \nand backdoors are examples. Independent malware is a self-contained program that can \nbe scheduled and run by the operating system. Worms and bot programs are examples. \n \n3.4.1.1 Backdoor \n \nA backdoor, also known as a trapdoor, is a secret entry point into a program that"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: fa3140de-ebf0-4614-b024-2f5997351d3f
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 99, "full_page_content": "100 \n \n \n \nTable 3.1 Terminology of Malicious Programs \nand backdoors are examples. Independent malware is a self-contained program that can \nbe scheduled and run by the operating system. Worms and bot programs are examples. \n \n3.4.1.1 Backdoor \n \nA backdoor, also known as a trapdoor, is a secret entry point into a program that \nallows someone who is aware of the backdoor to gain access without going through the \nusual security access procedures. Programmers have used backdoors legiti- mately for \nmany years to debug and test programs; such a backdoor is called a maintenance hook. \nThis usually is done when the programmer is developing an application that has an \nauthentication procedure, or a long setup, requiring the user to enter many different values \nto run the application. To debug the program, the developer may wish to gain special \nprivileges or to avoid all the necessary setup and authentication.  \n \nBackdoors become threats when unscrupulous programmers use them to gain \nunauthorized access. The backdoor was the basic idea for the vulnerability portrayed in \nthe movie War Games. Another example is that during the develop- ment of Multics, \npenetration tests were conducted by an Air Force \u201ctiger team\u201d (simulating adversaries).", "chunk_id": "f45e59e1-77aa-4e52-8fbe-d26ff6a84840", "chroma:document": "allows someone who is aware of the backdoor to gain access without going through the \nusual security access procedures. Programmers have used backdoors legiti- mately for \nmany years to debug and test programs; such a backdoor is called a maintenance hook. \nThis usually is done when the programmer is developing an application that has an"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: cee1dfd2-7354-4671-81af-c4097cabc842
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 99, "full_page_content": "100 \n \n \n \nTable 3.1 Terminology of Malicious Programs \nand backdoors are examples. Independent malware is a self-contained program that can \nbe scheduled and run by the operating system. Worms and bot programs are examples. \n \n3.4.1.1 Backdoor \n \nA backdoor, also known as a trapdoor, is a secret entry point into a program that \nallows someone who is aware of the backdoor to gain access without going through the \nusual security access procedures. Programmers have used backdoors legiti- mately for \nmany years to debug and test programs; such a backdoor is called a maintenance hook. \nThis usually is done when the programmer is developing an application that has an \nauthentication procedure, or a long setup, requiring the user to enter many different values \nto run the application. To debug the program, the developer may wish to gain special \nprivileges or to avoid all the necessary setup and authentication.  \n \nBackdoors become threats when unscrupulous programmers use them to gain \nunauthorized access. The backdoor was the basic idea for the vulnerability portrayed in \nthe movie War Games. Another example is that during the develop- ment of Multics, \npenetration tests were conducted by an Air Force \u201ctiger team\u201d (simulating adversaries).", "chunk_id": "a77f9ded-3ff5-410a-9042-bf4e99d393c0", "chroma:document": "authentication procedure, or a long setup, requiring the user to enter many different values \nto run the application. To debug the program, the developer may wish to gain special \nprivileges or to avoid all the necessary setup and authentication.  \n \nBackdoors become threats when unscrupulous programmers use them to gain"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5651c5b6-b417-4ab9-a3e8-b7e38c250c1d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 99, "full_page_content": "100 \n \n \n \nTable 3.1 Terminology of Malicious Programs \nand backdoors are examples. Independent malware is a self-contained program that can \nbe scheduled and run by the operating system. Worms and bot programs are examples. \n \n3.4.1.1 Backdoor \n \nA backdoor, also known as a trapdoor, is a secret entry point into a program that \nallows someone who is aware of the backdoor to gain access without going through the \nusual security access procedures. Programmers have used backdoors legiti- mately for \nmany years to debug and test programs; such a backdoor is called a maintenance hook. \nThis usually is done when the programmer is developing an application that has an \nauthentication procedure, or a long setup, requiring the user to enter many different values \nto run the application. To debug the program, the developer may wish to gain special \nprivileges or to avoid all the necessary setup and authentication.  \n \nBackdoors become threats when unscrupulous programmers use them to gain \nunauthorized access. The backdoor was the basic idea for the vulnerability portrayed in \nthe movie War Games. Another example is that during the develop- ment of Multics, \npenetration tests were conducted by an Air Force \u201ctiger team\u201d (simulating adversaries).", "chunk_id": "b33bfdab-9f74-4fa4-84d6-ac43e9129195", "chroma:document": "unauthorized access. The backdoor was the basic idea for the vulnerability portrayed in \nthe movie War Games. Another example is that during the develop- ment of Multics, \npenetration tests were conducted by an Air Force \u201ctiger team\u201d (simulating adversaries)."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6675ae2b-be13-4b1a-8496-b65b9c5aac7e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "500b2c8f-0c71-41b2-8325-329391b931fb", "chroma:document": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5d31bf74-427d-4bfa-9aa9-445a1973b83e
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "12dac037-9004-4991-9317-67e61b44d2f8", "chroma:document": "a logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6797b857-5bd0-42c1-8fa0-01eb47da6eb2
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "e03ec087-be7f-4a52-95eb-66724ec1f085", "chroma:document": "containing hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5503fb1b-82f9-477e-a0ac-0f2e917f85da
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "a9eeb4e4-c148-45ac-a233-4dbb8490347b", "chroma:document": "executed, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5ae5918e-f3a5-47d9-a60c-130f9e526945
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "d1c5ef4b-a93b-4b01-907d-bebfd88e6a20", "chroma:document": "format. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0f2ccf3c-f931-43f7-9453-b60c6f01e003
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "5d7a3a00-9a07-415b-81fb-69454ba50b4b", "chroma:document": "a backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 79811563-cc0a-440b-9001-7a1c6ff40ef6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "aaaf33b7-76a1-4420-b98d-9074c60476d6", "chroma:document": "then uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3e3a635f-67ae-440a-95e5-4ed07ff769c5
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 100, "full_page_content": "101 \n \n \nIt is difficult to implement operating system controls for backdoors. Security \nmeasures must focus on the program development and software update activities. \n \n3.4.1.2 Logic Bomb \n \n \nThe logic bomb is code embedded in some legitimate program that is set to \u201cexplode\u201d \nwhen certain conditions are met. Examples of conditions that can be used as triggers for \na logic bomb are the presence or absence of certain files, a particular day of the week or \ndate, or a particular user running the appli- cation. Once triggered, a bomb may alter or \ndelete data or entire files, cause a machine halt, or do some other damage.  \n \n3.4.1.3 Trojan Horses \n \nA Trojan horse1 is a useful, or apparently useful, program or command procedure \ncontaining hidden code that, when invoked, performs some unwanted or harmful \nfunction. \n \nTrojan horse programs can be used to accomplish functions indirectly that an \nunauthorized user could not accomplish directly. For example, to gain access to the files \nof another user on a shared system, a user could create a Trojan horse program that, when \nexecuted, changes the invoking user\u2019s file permissions so that the files are readable by \nany user. The author could then induce users to run the program by placing it in a common \ndirectory and naming it such that it appears to be a useful utility program or application. \nAn example is a program that ostensibly produces a listing of the user\u2019s files in a desirable \nformat. After another user has run the program, the author of the program can then access \nthe information in the user\u2019s files. An example of a Trojan horse program that would be \ndifficult to detect is a compiler that has been modified to insert additional code into \ncertain programs as they are compiled, such as a system login program. The code creates \na backdoor in the login program that permits the author to log on to the system using a \nspecial password. This Trojan horse can never be discovered by reading the source code \nof the login program. \n \n3.4.1.4 Zombie  \nA zombie is a program that secretly takes over another Internet-attached computer and \nthen uses that computer to launch attacks that are difficult to trace to the zombie's creator. \nZombies are used in denial-of-service attacks, typically against targeted Web sites. The \nzombie is planted on hundreds of computers belonging to unsuspecting third parties, and \nthen used to overwhelm the target Web site by launching an overwhelming onslaught of \nInternet traffic.  \n \n3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical", "chunk_id": "581326af-6b61-45f2-b467-d39a4701afce", "chroma:document": "3.4.2 The nature of viruses \nA computer virus is a piece of software that can \u201cinfect\u201d other programs by modifying  \nhem; the modification includes injecting the original program with a routine to make \ncopies of the virus program, which can then go on to infect other programs. The typical"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: b47f2ddf-d15b-4c7d-a1d1-ba97fedc6406
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "466e1819-39b7-44b8-80f4-d3c711d5217c", "chroma:document": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: fa630340-59da-473e-be46-8436d1ff5c04
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "5c623965-cd66-4dcf-8733-30cb45648bdd", "chroma:document": "over a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 7a633035-1f19-4845-8187-d70869a9354a
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "130ce76a-1613-4701-8482-c83be18ea98f", "chroma:document": "\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 528c6d08-9fba-4abc-92be-fa497b839605
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "b5346882-ee4d-4ee7-adeb-7bf8bd2305fb", "chroma:document": "\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 2dfaf9fb-99dc-40f2-b746-d3773981e9c2
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "909e50e9-a9e7-45ae-82ae-f6386d6fe08c", "chroma:document": "essage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: e4b3cc3d-6821-497e-a2a6-1347251b3f07
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "dcea1a93-84a6-42ff-9c62-b2c8bdfc5942", "chroma:document": "its \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 7c51633a-8e2e-4f48-80ff-5e17282235fe
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "101ddbf6-7179-45e8-b7c9-814fac27ed33", "chroma:document": "program. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme-"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 24962b08-4fbd-4661-9b23-012fa3d56e34
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "81642096-a76e-4361-92a1-6f9a7fc802e1", "chroma:document": "diately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: c8927fd4-19ac-4351-9d99-31dca5d429ae
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 101, "full_page_content": "102 \n \nvirus becomes embedded in a program on a computer. Then, whenever the \ninfected computer comes into contact with an uninfected piece of software, a fresh copy \nof the virus passes into the new program. Thus, the infection can be spread from computer \nto computer by unsuspecting users who either swap disks or send programs to one another \nover a network. During its lifetime, a typical virus goes through the following \nfour phases: \n \u2022 Dormant phase: The virus is idle. The virus will eventually be activated by some \nevent, such as a date, the presence of another program or file, or the capacity of the disk \nexceeding some limit. Not all viruses have this stage. \n\u2022 Propagation phase: The virus places a copy of itself into other programs or into \ncertain \nsystem \nareas \non \nthe \ndisk. The copy \nmay \nnot \nbe \nidentical \nto \nthe propagating version; viruses often morph to evade detection. Each infected program \nwill now contain a clone of the virus, which will itself enter a propagation phase. \n\u2022 Triggering phase: The virus is activated to perform the function for which it was \nintended. As with the dormant phase, the triggering phase can be caused  by a variety of \nsystem events, including a count of the number of times that   this copy of the virus has \nmade copies of itself. \n \u2022 Execution phase: The function is performed. The function may be harmless, such as a m\nessage on the screen, or damaging, such as the destruction of programs and data files. \n3.4.2.1 virus  Structure                                                                                   \n A virus can be prepended or postpended to an executable program, or it can be \nembedded \nin \nsome \nother \nfashion. The key \nto \nits \noperation \nis \nthat the infected program, when invoked, will first execute the virus code and then \nexecute the original code of the program. \nA very general depiction of virus structure is shown in Figure3.5  In this case, the virus c\node, is prepended to infected programs, and it \nis assumed that the entry point to the program, when invoked, is the first line of the \nprogram. \nThe infected program begins with the virus code and works as follows. The first \nline of code is a jump to the main virus program. The second line is a special marker \nthat is used by the virus to determine whether or not a potential victim program has \nalready been infected with this virus. When the program is invoked, control is imme- \ndiately transferred to the main virus program. The virus program may first seek out uninf\nected \nexecutable \nfiles and infect \nthem. \nNext, the virus may perform some action, usually detrimental to the system. This action c\nould be performed every time \nthe program is invoked, or it could be a logic bomb that triggers only under certain \nconditions. Finally, the virus transfers control to the original program. If the infection", "chunk_id": "3b93f2ec-1fc1-47a5-89a4-6e3a8cb78916", "chroma:document": "conditions. Finally, the virus transfers control to the original program. If the infection"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ed4e687b-3220-4e19-a061-910bacbbc8a6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 102, "full_page_content": "103 \n \n \nFig 3.5. Simple virus \n \nFig 3.6. Logic for a Compression Virus", "chunk_id": "6c2bf2c8-455d-473a-ab2a-33d853148921", "chroma:document": "103 \n \n \nFig 3.5. Simple virus \n \nFig 3.6. Logic for a Compression Virus"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 65cd260e-c5a5-4e28-8c12-738d2f383807
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 103, "full_page_content": "104 \n \n \nFig : 3.6 A compression Virus \n \nphase of the program is reasonably rapid, a user is unlikely to notice any difference \nbetween the execution of an infected and an uninfected program. \nA virus such as the one just described is easily detected because an infected version of a \nprogram \nis \nlonger \nthan \nthe \ncorresponding \nuninfected \none. \nA \nway \nto \nthwart such a simple means of detecting a virus is to compress the executable file so that \nboth the infected and uninfected versions are of identical length. Figure 3.6 \nshows in general terms the logic required. The key lines in this virus are numbered, and \nFigure 3.7 illustrates the operation. We assume that program P1 is infected with the \nvirus CV. When \nthis \nprogram \nis \ninvoked, \ncontrol \npasses to its virus, which performs the following steps: \n1.                        For each uninfected file P2 that is found, the virus first compresses that \nfile to produce P2 , which is shorter than the original program by the size of the virus. \n2.                        A copy of the virus is prepended to the compressed program. \n3.                        The compressed version of the original infected program, P1\u00bf , is uncom\npressed. \n4.                        The uncompressed original program is executed. \nIn this example, the virus does nothing other than propagate. As in the previous example, \nthe virus may  \ninclude a logic bomb.", "chunk_id": "b76398dc-d9e7-4ad2-9f39-538ef7a79707", "chroma:document": "104 \n \n \nFig : 3.6 A compression Virus \n \nphase of the program is reasonably rapid, a user is unlikely to notice any difference \nbetween the execution of an infected and an uninfected program. \nA virus such as the one just described is easily detected because an infected version of a \nprogram \nis \nlonger \nthan \nthe \ncorresponding \nuninfected \none. \nA \nway \nto"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 27b57f39-73e7-490f-a859-75fede8726f6
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 103, "full_page_content": "104 \n \n \nFig : 3.6 A compression Virus \n \nphase of the program is reasonably rapid, a user is unlikely to notice any difference \nbetween the execution of an infected and an uninfected program. \nA virus such as the one just described is easily detected because an infected version of a \nprogram \nis \nlonger \nthan \nthe \ncorresponding \nuninfected \none. \nA \nway \nto \nthwart such a simple means of detecting a virus is to compress the executable file so that \nboth the infected and uninfected versions are of identical length. Figure 3.6 \nshows in general terms the logic required. The key lines in this virus are numbered, and \nFigure 3.7 illustrates the operation. We assume that program P1 is infected with the \nvirus CV. When \nthis \nprogram \nis \ninvoked, \ncontrol \npasses to its virus, which performs the following steps: \n1.                        For each uninfected file P2 that is found, the virus first compresses that \nfile to produce P2 , which is shorter than the original program by the size of the virus. \n2.                        A copy of the virus is prepended to the compressed program. \n3.                        The compressed version of the original infected program, P1\u00bf , is uncom\npressed. \n4.                        The uncompressed original program is executed. \nIn this example, the virus does nothing other than propagate. As in the previous example, \nthe virus may  \ninclude a logic bomb.", "chunk_id": "b4b66015-2748-4426-94b4-d1a0a5e7a7a3", "chroma:document": "one. \nA \nway \nto \nthwart such a simple means of detecting a virus is to compress the executable file so that \nboth the infected and uninfected versions are of identical length. Figure 3.6 \nshows in general terms the logic required. The key lines in this virus are numbered, and \nFigure 3.7 illustrates the operation. We assume that program P1 is infected with the \nvirus CV. When"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: d128c015-3f18-4108-a224-89971b39b714
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 103, "full_page_content": "104 \n \n \nFig : 3.6 A compression Virus \n \nphase of the program is reasonably rapid, a user is unlikely to notice any difference \nbetween the execution of an infected and an uninfected program. \nA virus such as the one just described is easily detected because an infected version of a \nprogram \nis \nlonger \nthan \nthe \ncorresponding \nuninfected \none. \nA \nway \nto \nthwart such a simple means of detecting a virus is to compress the executable file so that \nboth the infected and uninfected versions are of identical length. Figure 3.6 \nshows in general terms the logic required. The key lines in this virus are numbered, and \nFigure 3.7 illustrates the operation. We assume that program P1 is infected with the \nvirus CV. When \nthis \nprogram \nis \ninvoked, \ncontrol \npasses to its virus, which performs the following steps: \n1.                        For each uninfected file P2 that is found, the virus first compresses that \nfile to produce P2 , which is shorter than the original program by the size of the virus. \n2.                        A copy of the virus is prepended to the compressed program. \n3.                        The compressed version of the original infected program, P1\u00bf , is uncom\npressed. \n4.                        The uncompressed original program is executed. \nIn this example, the virus does nothing other than propagate. As in the previous example, \nthe virus may  \ninclude a logic bomb.", "chunk_id": "f7298b70-82f7-4ac5-aabe-46602ccebbfe", "chroma:document": "virus CV. When \nthis \nprogram \nis \ninvoked, \ncontrol \npasses to its virus, which performs the following steps: \n1.                        For each uninfected file P2 that is found, the virus first compresses that \nfile to produce P2 , which is shorter than the original program by the size of the virus."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: ab52553b-3f48-4d3a-acca-910a164ceab4
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 103, "full_page_content": "104 \n \n \nFig : 3.6 A compression Virus \n \nphase of the program is reasonably rapid, a user is unlikely to notice any difference \nbetween the execution of an infected and an uninfected program. \nA virus such as the one just described is easily detected because an infected version of a \nprogram \nis \nlonger \nthan \nthe \ncorresponding \nuninfected \none. \nA \nway \nto \nthwart such a simple means of detecting a virus is to compress the executable file so that \nboth the infected and uninfected versions are of identical length. Figure 3.6 \nshows in general terms the logic required. The key lines in this virus are numbered, and \nFigure 3.7 illustrates the operation. We assume that program P1 is infected with the \nvirus CV. When \nthis \nprogram \nis \ninvoked, \ncontrol \npasses to its virus, which performs the following steps: \n1.                        For each uninfected file P2 that is found, the virus first compresses that \nfile to produce P2 , which is shorter than the original program by the size of the virus. \n2.                        A copy of the virus is prepended to the compressed program. \n3.                        The compressed version of the original infected program, P1\u00bf , is uncom\npressed. \n4.                        The uncompressed original program is executed. \nIn this example, the virus does nothing other than propagate. As in the previous example, \nthe virus may  \ninclude a logic bomb.", "chunk_id": "b7ec44fd-6202-4de4-842a-a009f31d6bf7", "chroma:document": "2.                        A copy of the virus is prepended to the compressed program. \n3.                        The compressed version of the original infected program, P1\u00bf , is uncom\npressed. \n4.                        The uncompressed original program is executed. \nIn this example, the virus does nothing other than propagate. As in the previous example, \nthe virus may"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 3caaf3f1-7195-421d-a2e1-4f4a55a58c1d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 103, "full_page_content": "104 \n \n \nFig : 3.6 A compression Virus \n \nphase of the program is reasonably rapid, a user is unlikely to notice any difference \nbetween the execution of an infected and an uninfected program. \nA virus such as the one just described is easily detected because an infected version of a \nprogram \nis \nlonger \nthan \nthe \ncorresponding \nuninfected \none. \nA \nway \nto \nthwart such a simple means of detecting a virus is to compress the executable file so that \nboth the infected and uninfected versions are of identical length. Figure 3.6 \nshows in general terms the logic required. The key lines in this virus are numbered, and \nFigure 3.7 illustrates the operation. We assume that program P1 is infected with the \nvirus CV. When \nthis \nprogram \nis \ninvoked, \ncontrol \npasses to its virus, which performs the following steps: \n1.                        For each uninfected file P2 that is found, the virus first compresses that \nfile to produce P2 , which is shorter than the original program by the size of the virus. \n2.                        A copy of the virus is prepended to the compressed program. \n3.                        The compressed version of the original infected program, P1\u00bf , is uncom\npressed. \n4.                        The uncompressed original program is executed. \nIn this example, the virus does nothing other than propagate. As in the previous example, \nthe virus may  \ninclude a logic bomb.", "chunk_id": "1500a374-8ab1-432e-804f-27e924a36a67", "chroma:document": "the virus may  \ninclude a logic bomb."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 0f83b198-da2a-426e-9093-21e82ff083c5
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 104, "full_page_content": "105 \n \n \nFig 3.7 A Compression Virus \nIn this example, the virus does nothing other than propagate. As previously mentioned, \nthe virus may include a logic bomb. \n Initial Infection \n \nOnce a virus has gained entry to a system by infecting a single program, it is in a \nposition to infect some or all other executable files on that system when the infected \nprogram executes. Thus, viral infection can be completely prevented by preventing the \nvirus from gaining entry in the first place. Unfortunately, prevention is extraordinarily \ndifficult because a virus can be part of any program outside a system.  \n3.4.3 Types of Viruses \nThe following the most significant types of viruses: \n\u25cf Parasitic virus: The traditional and still most common form of virus. A parasitic virus \nattaches itself to executable files and replicates, when the infected program is executed, \nby finding other executable files to infect. \n\u25cf Memory-resident virus: Lodges in main memory as part of a resident system program. \nFrom that point on, the virus infects every program that executes. \n\u25cf Boot sector virus: Infects a master boot record or boot record and spreads when a \nsystem is booted from the disk containing the virus. \n\u25cf Stealth virus: A form of virus explicitly designed to hide itself from detection by \nantivirus  \nsoftware. \n\u25cf Polymorphic virus: A virus that mutates with every infection, making detection by \nthe  \n\"signature\" of the virus impossible. \n\u25cf Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with \nevery infection.", "chunk_id": "373338dc-ee3d-4c94-9ab5-a566fdd6eedf", "chroma:document": "105 \n \n \nFig 3.7 A Compression Virus \nIn this example, the virus does nothing other than propagate. As previously mentioned, \nthe virus may include a logic bomb. \n Initial Infection \n \nOnce a virus has gained entry to a system by infecting a single program, it is in a \nposition to infect some or all other executable files on that system when the infected"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 57fae462-7bb2-4eaf-9b7a-9c53621f72ec
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 104, "full_page_content": "105 \n \n \nFig 3.7 A Compression Virus \nIn this example, the virus does nothing other than propagate. As previously mentioned, \nthe virus may include a logic bomb. \n Initial Infection \n \nOnce a virus has gained entry to a system by infecting a single program, it is in a \nposition to infect some or all other executable files on that system when the infected \nprogram executes. Thus, viral infection can be completely prevented by preventing the \nvirus from gaining entry in the first place. Unfortunately, prevention is extraordinarily \ndifficult because a virus can be part of any program outside a system.  \n3.4.3 Types of Viruses \nThe following the most significant types of viruses: \n\u25cf Parasitic virus: The traditional and still most common form of virus. A parasitic virus \nattaches itself to executable files and replicates, when the infected program is executed, \nby finding other executable files to infect. \n\u25cf Memory-resident virus: Lodges in main memory as part of a resident system program. \nFrom that point on, the virus infects every program that executes. \n\u25cf Boot sector virus: Infects a master boot record or boot record and spreads when a \nsystem is booted from the disk containing the virus. \n\u25cf Stealth virus: A form of virus explicitly designed to hide itself from detection by \nantivirus  \nsoftware. \n\u25cf Polymorphic virus: A virus that mutates with every infection, making detection by \nthe  \n\"signature\" of the virus impossible. \n\u25cf Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with \nevery infection.", "chunk_id": "db08a7bd-2d0a-45e6-ac23-e010e487ae9f", "chroma:document": "program executes. Thus, viral infection can be completely prevented by preventing the \nvirus from gaining entry in the first place. Unfortunately, prevention is extraordinarily \ndifficult because a virus can be part of any program outside a system.  \n3.4.3 Types of Viruses \nThe following the most significant types of viruses:"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 746b084b-2714-4da2-8a24-156d3b88a25b
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 104, "full_page_content": "105 \n \n \nFig 3.7 A Compression Virus \nIn this example, the virus does nothing other than propagate. As previously mentioned, \nthe virus may include a logic bomb. \n Initial Infection \n \nOnce a virus has gained entry to a system by infecting a single program, it is in a \nposition to infect some or all other executable files on that system when the infected \nprogram executes. Thus, viral infection can be completely prevented by preventing the \nvirus from gaining entry in the first place. Unfortunately, prevention is extraordinarily \ndifficult because a virus can be part of any program outside a system.  \n3.4.3 Types of Viruses \nThe following the most significant types of viruses: \n\u25cf Parasitic virus: The traditional and still most common form of virus. A parasitic virus \nattaches itself to executable files and replicates, when the infected program is executed, \nby finding other executable files to infect. \n\u25cf Memory-resident virus: Lodges in main memory as part of a resident system program. \nFrom that point on, the virus infects every program that executes. \n\u25cf Boot sector virus: Infects a master boot record or boot record and spreads when a \nsystem is booted from the disk containing the virus. \n\u25cf Stealth virus: A form of virus explicitly designed to hide itself from detection by \nantivirus  \nsoftware. \n\u25cf Polymorphic virus: A virus that mutates with every infection, making detection by \nthe  \n\"signature\" of the virus impossible. \n\u25cf Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with \nevery infection.", "chunk_id": "e5f14107-6d88-4f42-9b12-9a7d2f1adf49", "chroma:document": "\u25cf Parasitic virus: The traditional and still most common form of virus. A parasitic virus \nattaches itself to executable files and replicates, when the infected program is executed, \nby finding other executable files to infect. \n\u25cf Memory-resident virus: Lodges in main memory as part of a resident system program. \nFrom that point on, the virus infects every program that executes."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: dcc28364-35a9-42e1-9a23-a7a5e0fa4613
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 104, "full_page_content": "105 \n \n \nFig 3.7 A Compression Virus \nIn this example, the virus does nothing other than propagate. As previously mentioned, \nthe virus may include a logic bomb. \n Initial Infection \n \nOnce a virus has gained entry to a system by infecting a single program, it is in a \nposition to infect some or all other executable files on that system when the infected \nprogram executes. Thus, viral infection can be completely prevented by preventing the \nvirus from gaining entry in the first place. Unfortunately, prevention is extraordinarily \ndifficult because a virus can be part of any program outside a system.  \n3.4.3 Types of Viruses \nThe following the most significant types of viruses: \n\u25cf Parasitic virus: The traditional and still most common form of virus. A parasitic virus \nattaches itself to executable files and replicates, when the infected program is executed, \nby finding other executable files to infect. \n\u25cf Memory-resident virus: Lodges in main memory as part of a resident system program. \nFrom that point on, the virus infects every program that executes. \n\u25cf Boot sector virus: Infects a master boot record or boot record and spreads when a \nsystem is booted from the disk containing the virus. \n\u25cf Stealth virus: A form of virus explicitly designed to hide itself from detection by \nantivirus  \nsoftware. \n\u25cf Polymorphic virus: A virus that mutates with every infection, making detection by \nthe  \n\"signature\" of the virus impossible. \n\u25cf Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with \nevery infection.", "chunk_id": "3c5dab52-2d7f-402d-baca-71da902a73c3", "chroma:document": "\u25cf Boot sector virus: Infects a master boot record or boot record and spreads when a \nsystem is booted from the disk containing the virus. \n\u25cf Stealth virus: A form of virus explicitly designed to hide itself from detection by \nantivirus  \nsoftware. \n\u25cf Polymorphic virus: A virus that mutates with every infection, making detection by \nthe  \n\"signature\" of the virus impossible."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 6f92e07c-6f23-4089-a16a-b119b14e827d
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 104, "full_page_content": "105 \n \n \nFig 3.7 A Compression Virus \nIn this example, the virus does nothing other than propagate. As previously mentioned, \nthe virus may include a logic bomb. \n Initial Infection \n \nOnce a virus has gained entry to a system by infecting a single program, it is in a \nposition to infect some or all other executable files on that system when the infected \nprogram executes. Thus, viral infection can be completely prevented by preventing the \nvirus from gaining entry in the first place. Unfortunately, prevention is extraordinarily \ndifficult because a virus can be part of any program outside a system.  \n3.4.3 Types of Viruses \nThe following the most significant types of viruses: \n\u25cf Parasitic virus: The traditional and still most common form of virus. A parasitic virus \nattaches itself to executable files and replicates, when the infected program is executed, \nby finding other executable files to infect. \n\u25cf Memory-resident virus: Lodges in main memory as part of a resident system program. \nFrom that point on, the virus infects every program that executes. \n\u25cf Boot sector virus: Infects a master boot record or boot record and spreads when a \nsystem is booted from the disk containing the virus. \n\u25cf Stealth virus: A form of virus explicitly designed to hide itself from detection by \nantivirus  \nsoftware. \n\u25cf Polymorphic virus: A virus that mutates with every infection, making detection by \nthe  \n\"signature\" of the virus impossible. \n\u25cf Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with \nevery infection.", "chunk_id": "7b6f8192-a6c5-410d-81f0-57d6b8592aba", "chroma:document": "\u25cf Metamorphic virus: As with a polymorphic virus, a metamorphic virus mutates with \nevery infection."}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: a600e9de-6366-473b-ab29-9d3a80083d26
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "8d78b9a5-07f1-46b0-aec5-90e6603bcfc5", "chroma:document": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 5fd32883-5c9a-4a59-a868-def32a4412a0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "33b5ece4-5817-4df3-ab95-ec37410ba195", "chroma:document": "using these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion"}


created_at: 2025-01-28 05:36:03
topic: persistent://default/default/a5c4f461-3901-4175-9ce9-937730884692
id: 29482419-a1b9-44be-9e2b-775f2f5ca5a0
encoding: FLOAT32
metadata:
{"producer": "Microsoft\u00ae Word 2019", "creator": "Microsoft\u00ae Word 2019", "creationdate": "2022-02-08T09:25:32+05:30", "source": "data/SITA1602.pdf", "file_path": "data/SITA1602.pdf", "total_pages": 165, "format": "PDF 1.7", "title": "", "author": "Jabez J", "subject": "", "keywords": "", "moddate": "2022-02-08T09:25:32+05:30", "trapped": "", "page": 105, "full_page_content": "106 \n \n \nOne example of a stealth virus was discussed earlier: a virus that uses compression \nso that the infected program is exactly the same length as an uninfected version. Far more \nsophisticated techniques are possible. For example, a virus can place intercept logic in \ndisk I/O routines, so that when there is an attempt to read suspected portions of the disk \nusing these routines, the virus will present back the original, uninfected program.  \nA polymorphic virus creates copies during replication that are functionally equivalent \nbut have distinctly different bit patterns. As with a stealth virus, the purpose is to defeat \nprograms that scan for viruses. A more effective approach is to use encryption. A portion \nof the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect \nMicrosoft Word documents. Any hardware platform and operating system that supports \nWord can be infected. \n2. Macro viruses infect documents, not executable portions of code. Most of the \ninformation  \nintroduced onto a computer system is in the form of a document rather than a program. \n 3. Macro viruses are easily spread. A very common method is by electronic mail. \n \nMacro viruses take advantage of a feature found in Word and other office applications \nsuch as Microsoft Excel, namely the macro. In essence, a macro is an executable program \nembedded in a word processing document or other type of file. Typically, users employ \nmacros to automate repetitive tasks and thereby save keystrokes.  \n \nSuccessive releases of Word provide increased protection against macro viruses. For \nexample, Microsoft offers an optional Macro Virus Protection tool that detects suspicious \nWord files and alerts the customer to the potential risk of opening a file with macros.  \n3.4.5 E-mail Viruses \n \nA more recent development in malicious software is the e-mail virus. The first rapidly \nspreading e-mail viruses, such as Melissa, made use of a Microsoft Word macro \nembedded in an attachment. If the recipient opens the e-mail attachment, the Word macro \nis activated. Then \n1. The e-mail virus sends itself to everyone on the mailing list in the user's e-mail package. \n2. The virus does local damage. \n \nThus we see a new generation of malware that arrives via e-mail and uses e-mail \nsoftware features to replicate itself across the Internet. The virus propagates itself as soon \nas activated (either by opening an e-mail attachment of by opening the e-mail) to all of \nthe e-mail addresses known to the infected host. As a result, whereas viruses used to take \nmonths or years to propagate, they now do so in hours.  \n3.4.6 Worms", "chunk_id": "8249ca59-215d-4c71-bfb9-0478223204bc", "chroma:document": "of the virus, generally called a mutation engine, creates a random encryption key to \nencrypt the remainder of the virus. The key is stored with the virus, and the mutation \nengine itself is altered.  \n3.4.4 Macro Viruses \nMacro viruses are particularly threatening for a number of reasons: \n1. A macro virus is platform independent. Virtually all of the macro viruses infect"}


