Tamper-Evident Integrity Monitoring for Critical OS Components

Problem statement

Investigate how Black Wall can detect unauthorized changes to protected files, executable components, configuration, and security policies.

Why it matters

Persistence usually requires changing something on disk or in policy. Integrity monitoring makes those changes visible, but only if it can tell an authorised update apart from an unexpected modification and record the evidence without itself being altered.

Research questions

1. 01 Which components need integrity coverage, and at what granularity?
2. 02 How are trusted baselines and signed manifests created, stored and updated?
3. 03 How can authorised updates be distinguished from unexpected modifications without a manual decision every time?
4. 04 What monitoring overhead and detection latency are acceptable on a running system?

Research objectives

• Establish trusted baselines and signed manifests.
• Distinguish authorized updates from unexpected modifications.
• Investigate tamper-evident records.
• Evaluate monitoring overhead and detection latency.
• Develop reproducible integrity-verification tests.

Technical challenges

• Baselines must change with legitimate updates without becoming attacker-controlled.
• Continuous verification competes with normal I/O and can be expensive at fine granularity.
• Tamper-evident records require somewhere trustworthy to anchor their integrity.
• Detection latency depends on when a change is observed, not only on when it occurred.

Expected outcome

A prototype integrity-monitoring system with documented coverage and limitations.

Tags

integrity monitoringsigned manifestsbaselinestamper evidencedetection latency

Related research

• Designing a Self-Defending Operating System Architecture

  Design an operating-system architecture that continuously evaluates security conditions, detects suspicious system changes and applies controlled defensive responses.

  Open Research Problem · Cybersecurity
• Verifiable Updates and Rollback Protection for Black Wall

  Design an update architecture that verifies authenticity, resists unauthorised modification, recovers safely from interrupted installs and restricts unauthorised downgrades.

  Open Research Problem · Systems
• Establishing a Verifiable Boot Chain for Black Wall

  Establish a verifiable chain of trust from UEFI firmware through the bootloader to the running kernel, including signature verification, boot measurements and recovery from verification failures.

  Open Research Problem · Systems