Control flow matching methods have been utilized to detect malware variants. However, as the number of malware variants has soared, it has become harder and harder to detect all malware variants while maintaining high accuracy. Even though many researchers have proposed control flow matching methods, there is still a trade-off between accuracy and performance. To solve this trade-off, we designed Malfinder, a method based on approximate matching, which is accurate but slow. To overcome its low performance, we resolve its performance bottleneck and non-parallelism on three fronts: I-Filter for identical string matching, table division to exclude unnecessary comparisons with some malware and dynamic resource allocation for efficient parallelism. Our performance evaluation shows that the total performance improvement is 280.9 times.

Recent advent of manycore system increases needs for larger but faster memory hierarchy. Emerging next generation memories such as on-chip DRAM and nonvolatile memory (NVRAM) are promising candidates for replacement of DRAM-only main memory. Combined with the manycore trends, it gives an opportunity to rethink conventional resource management system with a memory hierarchy for a single cloud node. In an attempt to mitigate the energy and memory problems, we propose MN-MATE, an elastic resource management architecture for a single cloud node with manycores, on-chip DRAM, and large size of off-chip DRAM and NVRAM. In MN-MATE, the hypervisor places consolidated VMs and balances memory among them. Based on the monitored information about the allocated memory, a guest OS co-schedules tasks accessing different types of memory with complementary access intensity. Polymorphic management of DRAM hierarchy accelerates average memory access speed inside each guest OS. A guest OS reduces energy consumption with small performance loss based on the NVRAM-aware data placement policy and the hybrid page cache. A new lightweight kernel is developed to reduce the overhead from the guest OS for scientific applications. Experiment results show that our techniques in MN-MATE platform improve system performance and reduce energy consumption.

While a NUMA system is being widely used as a target machine for virtualization, each data access request produced by a virtual machine (VM) on the NUMA system may have a different access time depending on not only remote access condition, but also shared resource contentions. Mainly due to this, each VM running on the NUMA system will have irregular data access performance at different times. Because existing hypervisors, such as KVM, VMware, and Xen, have yet to consider this, users of VMs cannot predict their data access performance or even recognize the data access performance they have experienced. In this paper, we propose a novel VM placement technique to resolve this issue pertaining to irregular data access performance of VMs running on the NUMA system. The hypervisor with our technique provides the illusion of a private memory subsystem to each VM, which guarantees the data access latency required by each VM on average. To enable this feature, we periodically evaluates the average data access latency of each VM using hardware performance monitoring units. After every evaluation, our Mcredit-based VM migration algorithm tries to migrate the VCPU or memory of the VM not meeting with its required data access latency to another node, giving the VM less data access latency. We implemented the prototype for KVM hypervisor on Linux 3.10.10. Experimental results show that, in the four-node NUMA system, our technique keeps the required data access performance levels of VMs running various workloads while it only consumes less than 1 percent of the cycles of a core and 0.3 percent of the system memory bandwidth.

Main memory as a hybrid between DRAM and nonvolatile memory is rapidly considered as a basic building block of computing systems. Despite widely-performed researches no one can confirm whether hybrid memory is at its full performance in terms of energy consumption, time delay or both. The main problem is that evaluating their performance in comparison with the optimal performance is challenging since deriving the optimal value is NP-complete. In this paper, we design and implement an evaluation framework termed OPAMP, which calculates optimal performance of the hybrid memory environment. This system gathers workload, specification of DRAM and PRAM, and environmental parameters of the hybrid main memory. After that, it calculates the maximum performance under the corresponding conditions. We suggest the way of deriving the optimal value by profiling instead of page migration which is the mainstream of recent researches on hybrid main memory system. Also, proportion of DRAM's size to PRAM's and proportion of DRAM's usage space to PRAM's are impactive factors. While designing hybrid main memory, those two variables must be determined carefully and OPAMP gives the guideline to the researchers.

While adopting cache in software RAID brings performance benefit, it can cause data loss at power failure which results in the broken filesystem consistency. Though I/O Barrier can be used to remove the consistency issue, it sacrifices the write performance of software RAID. To mitigate this tradeoff, we suggest R-Barrier for software RAID. The basic idea of R-Barrier is to avoid the synchronization of the entire cache space. Instead, based on given hints from the filesystem layer, R-Barrier makes software RAID cache select one of the following methods when the cache writes a certain write request into the disk: (1)Strictly ordered destaging for the write requests affecting the filesystem consistency, (2)Reordered destaging for the rest of write requests. We show that R-Barrier guarantees same filesystem consistency with I/O Barrier while the performance degradation of R-Barrier is less than that of I/O Barrier.

Providing secure and efficient outsourced storage is a precursor to widespread cloud deployment and availability. For this purpose, existing designs mainly rely on block ciphers, although stream ciphers are more computationally-efficient than block ciphers. This paper presents a construction of secure storage, BLAST, enhanced with a stream cipher rather than a block cipher with a novel block accessible encryption mechanism based on streaming ciphers. In BLAST, a hierarchical tree generated in the form of an n-level quad tree is created for each user during the registration phase of the storage system. When a user wants to access the outsourced storage, the user can access their data after encrypting or decrypting it using a sequence of key stream frames derived from the hierarchical tree. The experimental results show that the proposed system achieves significant improved performance than normal streaming/block cipher-based secure storage system in terms of throughput and access latency.