2018.07/Digital Forensics
Leveraging Relocations in ELF-Binaries for Linux Kernel Version Identification
M. Bhatt, I. Ahmed
Abstract
Uses relocation entries in ELF binaries to fingerprint Linux kernel versions from memory images, enabling forensic tools to apply correct kernel profiles during memory analysis.
Where it sits
Pillar 03 — Defenses, Artifacts & Disclosure
What can a defender run tomorrow?
Turn findings into usable protection — concrete defenses, deployed tools, and real vulnerability disclosure.
Outside writing
How outside writing is graded →More from defenses
Whole pillar →2026.06Beyond Injection Detection: A Positive-Security Prompt Firewall that Closes the Scope and PHI Gap SOTA Classifiers Miss in HealthcarePresents QFIRE, an inline, provider-agnostic prompt firewall for healthcare AI agents that combines positive-security scope constraints, an asynchronous detector graph, and de-obfuscation — and releases QFIRE-HealthBench, where generic injection detectors recover only 0.40 recall while QFIRE's scope+PHI chain reaches 0.83.2025.11MAIF: Enforcing AI Trust and Provenance with an Artifact-Centric Agentic ParadigmProposes an artifact-centric architecture that embeds provenance, access control, and audit evidence into the data objects used by AI agents.2025.07ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by Using OAuth-Enhanced Tool Definitions and Policy-Based Access ControlMitigates tool squatting and rug pull attacks in the Model Context Protocol (MCP) by hardening tool definitions with OAuth-enhanced signatures and policy-based access control, preventing malicious or mutated tools from being silently substituted into agent workflows.