Cloud attack provenance is a well-established industrial practice for assuring transparency and accountability for a service provider to tenants. However, the multi-tenancy and self-service nature coupled with the sheer size of a cloud implies many unique challenges to cloud forensics. Although Virtual Machine Introspection (VMI) is a powerful tool for attack provenance due to the privilege isolation, the stealthiness of state-of-the-art attacks and the lack of precise information make existing attack provenance solutions difficult to fulfill real-time forensics when tracking enormous suspicious behaviors. To this end, we propose an instruction-level tracing framework for inspecting the presence of attacks by dynamically tracking shared processor hardware event patterns and analyzing the attack traces. To overcome the challenges of real-time detection and provenance, we advocate Last Branch Record (LBR) profiling, to extract the suspicious execution flows. With the hardware assistance and software-based virtualization introspection, we show that the framework can provide an effective response to threats in different cases, thereby enabling a quick attack provenance with high fidelity. The evaluation shows that our prototype introduces negligible performance penalties.

Since the division with remainder cannot be implemented in multivariable polynomials, the two‐dimensional non‐separable wavelet transform cannot be lifted by using a similar way as that of univariate wavelet transforms. To solve this problem, a general lifting factoring method of two‐dimensional two‐channel non‐separable stripe filter banks is presented. The constructing form of the polyphase matrices of the stripe filter banks is deduced and the general factoring of the polyphase matrices is given. Compared with the separable lifting wavelet transform, the proposed lifting factoring method can extract better texture information. The lifting form is more succinct than that of the tensor product lifting wavelet transform. The computation amount of the proposed factoring method for image decomposition is a quarter of the two‐dimensional two‐channel non‐separable stripe filter bank and the original two‐dimensional two‐channel non‐separable wavelet system is quickened. Moreover, the proposed lifting factorising method is faster than the traditional two‐dimensional two‐channel non‐separable wavelet transform based on the Fourier transformation framework in which the size of each filter is greater than . The proposed lifting factorising method has better sparsity than that of the original wavelet transform and the famous two‐dimensional two‐channel biorthogonal symmetric non‐separable wavelet transform.

Image fusion method based on separable discrete wavelet transform has block effect and the spatial resolution is lower in the fusion result images. The design method of filter bank relies on the form of the dilation matrices in the image fusion method based on three‐channel non‐separable wavelet. To resolve these problems, a new construction method of the filter banks based on three‐channel non‐separable symmetric wavelet with arbitrary dilation matrices is presented. A new multispectral image fusion method based on this kind of wavelet filter bank is proposed. An example of the filter bank with those properties is constructed and applied to the fusion of multispectral image and panchromatic image. The experiment results show that this method has good visual effect. The fusion performance of the proposed method is better than that of the other methods in terms of several frequently used and the latest metrics.