When attackers compromise a computer system and obtain root control over the victim system, retaining that control and avoiding detection become their top priority. To achieve this goal, various rootkits have been developed. However, existing rootkits are still easy to detect as long as defenders can gain control at a lower level, such as the operating system level, the hypervisor level, or the hardware level. In this paper, we present a new type of rootkit called CloudSkulk, which is a nested virtual machine (VM) based rootkit. While nested virtualization has attracted sufficient attention from the security and cloud community, to the best of our knowledge, we are the first to reveal and demonstrate how nested virtualization can be used by attackers to develop rootkits. We then, from defenders' perspective, present a novel approach to detecting CloudSkulk rootkits at the host level. Our experimental results show that the proposed approach is effective in detecting CloudSkulk rootkits.

The rate of a network code is the ratio of the block size of the network's messages to that of its edge codewords. We compare the linear capacities and achievable rate regions of networks using finite field alphabets to the more general cases of arbitrary ring and module alphabets. For non-commutative rings, two-sided linearity is allowed. Specifically, we prove the following for directed acyclic networks. First, the linear rate region and the linear capacity of any network over a finite field depend only on the characteristic of the field. Furthermore, any two fields with different characteristics yield different linear capacities for at least one network. Second, whenever the characteristic of a given finite field divides the size of a given finite ring, each network's linear rate region over the ring is contained in its linear rate region over the field. Thus, any network's linear capacity over a field is at least its linear capacity over any other ring of the same size. An analogous result also holds for linear network codes over module alphabets. Third, whenever the characteristic of a given finite field does not divide the size of a given finite ring, there is some network whose linear capacity over the ring is strictly greater than its linear capacity over the field. Thus, for any finite field, there always exist rings over which some networks have higher linear capacities than over the field.

Linear network coding over finite fields is a wellstudied problem. We consider the more general setting of linear coding for directed acyclic networks with finite commutative ring alphabets. Our results imply that for scalar linear network coding over commutative rings, fields can always be used when the alphabet size is flexible, but other rings may be needed when the alphabet size is fixed. We prove that if a network has a scalar linear solution over some finite commutative ring, then the (unique) smallest such commutative ring is a field. We also show that fixed-size commutative rings are quasi-ordered, such that all the scalar linearly solvable networks over any given ring are also scalar linearly solvable over any higher-ordered ring. We study commutative rings that are maximal with respect to this quasiorder, as they may be considered the best commutative rings of a given size. We prove that a commutative ring is maximal if and only if some network is scalar linearly solvable over the ring, but not over any other commutative ring of the same size. Furthermore, we show that maximal commutative rings are direct products of certain fields specified by the integer partitions of the prime factor multiplicities of the ring's size. Finally, we prove that there is a unique maximal commutative ring of size m if and only if each prime factor of m has multiplicity in {1, 2, 3, 4, 6}. As consequences, 1) every finite field is such a maximal ring and 2) for each prime p, some network is scalar linearly solvable over a commutative ring of size pk but not over the field of the same size if and only if k ∉ {1, 2, 3, 4, 6}.

In Part I, we studied linear network coding over finite commutative rings and made comparisons to the well-studied case of linear network coding over finite fields. Here, we consider the more general setting of linear network coding over finite (possibly non-commutative) rings and modules. We prove the following results regarding the linear solvability of directed acyclic networks over various finite alphabets. For any network, the following are equivalent: (i) vector linear solvability over some field, (ii) scalar linear solvability over some ring, and (iii) linear solvability over some module. Analogously, the following are equivalent: (a) scalar linear solvability over some field, (b) scalar linear solvability over some commutative ring, and (c) linear solvability over some module whose ring is commutative. Whenever any network is linearly solvable over a module, a smallest such module arises in a vector linear solution for that network over a field. If a network is scalar linearly solvable over some non-commutative ring but not over any commutative ring, then such a non-commutative ring must have size at least 16, and for some networks, this bound is achieved. An infinite family of networks is demonstrated, each of which is scalar linearly solvable over some non-commutative ring but not over any commutative ring. Whenever p is prime and 1 ≤ k ≤ 6, if a network is scalar linearly solvable over some ring of size pk, then it is also k-dimensional vector linearly solvable over the field GF(p), but the converse does not necessarily hold. This result is extended to all k ≥ 1 when the ring is commutative.

For each positive composite integer m, a network is constructed, which is solvable over an alphabet of size m but is not solvable over any smaller alphabet. These networks have no linear solutions over any module alphabets and are not asymptotically linearly solvable over any finite-field alphabets. The networks' capacities are all shown to equal one, and their linear capacities are all shown to be bounded away from one for all finite-field alphabets. In addition, if m is a non-power-of-prime composite number, then such a network is not solvable over any prime-power-size alphabet.

For each integer m ≥ 2, a network is constructed which is solvable over an alphabet of size m but is not solvable over any smaller alphabets. If m is composite, then the network has no vector linear solution over any module alphabet. The network's capacity is shown to equal one, and when m is composite, its linear capacity is bounded away from one for all finite-field alphabets.