hi, i wonder if it is possible, taking openoffice2.0 as an example, that we can use ima to detect an attack (on openoffice)?  If so, do i have to measure additional files? Since most of the measurements are dynamically linked libraries, there will be no changes in measurements if i make trivial changes to options/configurations in the application.  I am wondering in what general cases, for an application like openoffice (or any other large application), when we can expect a legitimate change in the measurements.  One obvious case i can think of is updating to a newer version of the application.

thanks - adrian