In the realm of cybersecurity, rootkits pose a credible threat to individuals, corporations, and governments. Through various techniques, rootkits are not only able to infect computer systems, but often times are able to remain undetected in a host for an extended amount of time by manipulating system software. The purpose of this paper is to describe what a rootkit is, how they operate, and how they relate to other types of malware. Historical data and statistics will be presented in order to show how rootkits have been employed in cyber attacks. Different types of rootkits, including user, kernel, and hypervisor rootkits will be described, as well as the various methods used to defend against rootkits. We will then present a case study where neural networks were used to analyze the behavior of a system both not infected and infected with a rootkit, and categorize the resulting system calls as anomalous or not.

Rootkits are powerful and dangerous pieces of malware that use stealth and administrative privilege to maintain a persistent, covert foothold on a compromised system. These capabilities make them popular with a wide range of cyber attackers, including the instigators of advanced persistent threat (APT) attacks. With recent examples of APT attacks being used to disrupt critical infrastructure in Ukraine in 2015, the urgency to produce a robust detection framework for rootkits is increased. However, due to sophisticated active and passive defense techniques, rootkits are resistant to traditional detection and remediation techniques. An effective detector will sit outside of a rootkit's sphere of influence and use process-indicative data from a side channel that cannot be tampered with or spoofed. In this paper, we present preliminary results of experiments based on Oak Ridge National Laboratory's (ORNL) Beholder Project to detect rootkit execution out-of-band. We utilize power supply voltage measurements collected with a basic multimeter and current clamp, then extract time-serial system dynamics through the application of a novel nonlinear, phase-space algorithm. We examine variance of phase-space graph features between nominal and infected data, and then train our algorithm on threshold values to reach best possible prediction accuracy. Our results indicate that the algorithm can successfully detect a rootkit infection through power measurement analysis, at an accuracy rate that meets or exceeds the performance of other machine learning algorithms in a similar testing context.

Cyber-physical system security presents unique challenges to conventional measurement science and technology. Anomaly detection in software-assisted physical systems, such as those employed in additive manufacturing or in DNA synthesis, is often hampered by the limited available parameter space of the underlying mechanism that is transducing the anomaly. As a result, the formulation of anomaly detection for such systems often leads to inverse or ill-posed problems, requiring statistical treatments. Here, we present Bayesian inference of unknown parameters associated with a generic actuator considered as a representative vital element of a cyber-physical system. Via a series of experimental input-output measurements, a transfer function for the actuator is obtained numerically, which serves as our model for the proposed method. Linear, nonlinear, and delayed dynamics may be assumed for the actuator response. By devising a code-based malicious signal, we study the efficacy of Bayesian inference for its potential to produce a detection, including uncertainty quantification, with a remarkably small number of input data points. Our approach should be adaptable to a variety of real-time cyber-physical anomaly detection scenarios.

The crisis of insecure software has resulted in a drastic increase in the frequency and impact of cyber attacks on businesses and individual users alike. The discipline of secure software engineering has evolved as a response to this trend, with the aim of producing software with fewer coding bugs or design flaws that result in exploitable vulnerabilities. However, secure software engineering is a young discipline, and many software artifacts in current use were created before, or in ignorance of, its development. Software practitioners would benefit greatly from a rigorous methodology for analyzing and validating software that has already entered its maintenance lifecycle. In this paper, we present a combined penetrating testing methodology that incorporates strengths of several existing approaches, with the goal to understand their utility and benefit for analyzing security of existing software programs. We exercise this methodology through a case study applied to a popular tool used by many network security practitioners: Wireshark. As a contribution, our study illustrates the benefits of a combined approach and outlines recommendations for a holistic method that will improve security-based risk assessment. Specifically, we show how application of rigorous test-driven threat modeling can produce better abuse cases, which can in turn be used to inform and more precisely define penetration testing activities.

In hybrid quantum systems, the interface between quantum and classical domains is essential for the generation, control, and measurement of quantum states. Quantum-classical interfaces (QCIs) are ubiquitous in devices such as optical modulators, quantum sensors, and signal processors, where classical signals influence quantum dynamics. In this paper, we employ the Lindblad master equation to simulate the evolution of a quantum system interacting with a classical control system. Our model captures both linear and nonlinear interactions by incorporating first- and second-order susceptibilities, and it quantifies the influence of externally applied control parameters on decoherence and state evolution. As an illustrative example, we analyze an optical modulator and demonstrate how variations in material response and drive conditions affect photon statistics, coherence, and phase-space distributions. The findings offer a path to an all-encompassing model for understanding and optimizing QCIs, with wide-ranging implications for the performance, design, and robustness of next-generation quantum devices.

Hybrid quantum–classical systems are emerging as key platforms in quantum computing, sensing, and communication technologies, but the quantum–classical interface (QCI)—the boundary enabling these systems—introduces unique and largely unexplored security vulnerabilities. This position paper proposes using entropy-based metrics to monitor and enhance security, specifically at the QCI. We present a theoretical security outline that leverages well-established information-theoretic entropy measures, such as Shannon entropy, von Neumann entropy, and quantum relative entropy, to detect anomalous behaviors and potential breaches at the QCI. By linking entropy fluctuations to scenarios of practical relevance—including quantum key distribution, quantum sensing, and hybrid control systems—we promote the potential value and applicability of entropy-based security monitoring. While explicitly acknowledging practical limitations and theoretical assumptions, we argue that entropy-based metrics provide a complementary approach to existing security methods, inviting further empirical studies and theoretical refinements that can strengthen future quantum technologies.