33934028
An FSM-Based Approach for Malicious Code Detection Using the Self-Relocation Gene
Most information attacks on the Internet are perpetrated by deploying malicious codes, which results in destructive epidemics. The correct execution of viruses and worms throughout the Internet is accomplished by self-relocation. Self-relocation is a built-in mechanism in most malicious codes, allowing them to get the base address of the host program to correctly infect it. Since most legitimate computer programs do not need self-relocate themselves, the detection of malicious codes could be reduced to the detection of the various mutations of the self-relocation gene. This study presents such a detection mechanism based on finite state machine theory for both known and previously unknown malicious executable codes. It does not rely on signature-screening of known viruses, but instead it detects self-relocation attempt of the suspicious executable code. The experiments were conducted and the results indicate that the proposed approach has better ability to detect known and previously unknown malicious executable codes than other methods.
29802848
Improved Approximate Detection of Duplicates for Data Streams Over Sliding Windows
Detecting duplicates in data streams is an important problem that has a wide range of applications. In general, precisely detecting duplicates in an unbounded data stream is not feasible in most streaming scenarios, and, on the other hand, the elements in data streams are always time sensitive. These make it particular significant approximately detecting duplicates among newly arrived elements of a data stream within a fixed time frame. In this paper, we present a novel data structure, Decaying Bloom Filter (DBF), as an extension of the Counting Bloom Filter, that effectively removes stale elements as new elements continuously arrive over sliding windows. On the DBF basis we present an efficient algorithm to approximately detect duplicates over sliding windows. Our algorithm may produce false positive errors, but not false negative errors as in many previous results. We analyze the time complexity and detection accuracy, and give a tight upper bound of false positive rate. For a given space G bits and sliding window size W, our algorithm has an amortized time complexity of $ O + (\sqrt{G/W}) $. Both analytical and experimental results on synthetic data demonstrate that our algorithm is superior in both execution time and detection accuracy to the previous results.
18262600
Parameters optimization of support vector regression based on immune particle swarm optimization algorithm
A novel Immune Particle Swarm Optimization (IPSO) for parameters optimization of Support Vector Regression (SVR) is proposed in this article. After introduced clonal copy and mutation process of Immune Algorithm (IA), the particle of PSO is considered as antibodies. Therefore, evaluated the fitness of particles by the Leave-One-Out Cross-Validation (LOOCV) standard, the best individual mutated particle for each cloned group will be selected to compose the next generation to get better parameters of SVR. It can construct high accuracy and generalization performance regression model rapidly by optimizing the combination of three SVR parameters at the same time. Under the datasets generated from sinx function with additive noise and spectra dataset, simulation results show that the new method can determine the parameters of SVR quickly and the gotten models have superior learning accuracy and generalization performance.
14272122
A Dynamic Immunity-Based Model for Computer Virus Detection
Internet provides a fertile medium for new breeds of computer viruses. Many people who have access to a wealth of information via Internet are attacked by more computer viruses than they can effectively process. We present a dynamic computer virus detection model that can detect known viruses and previously unknown viruses to prevent information systems from damage. This model is inspired by biological immune systems that protect the body against damage from pathogens. The architecture of this model, the formal definitions of self, nonself, antigen, antibody, and vaccine gene library are introduced. Furthermore, the evolution of self and nonself, the generation of the antibody, the evolution of the virus vaccine gene, and the detection of the antigen are depicted. Experiment results show that this model has better capacity of self-adaptability and self-learning in detecting unknown viruses than traditional models.
10021622
Dynamically Maintaining Duplicate-Insensitive and Time-Decayed Sum Using Time-Decaying Bloom Filter
The duplicate-insensitive and time-decayed sum of an arbitrary subset in a stream is an important aggregation for various analyses in many distributed stream scenarios. In general, precisely providing this sum in an unbounded and high-rate stream is infeasible. Therefore, we target at this problem and introduce a sketch, namely, time-decaying Bloom Filter (TDBF). The TDBF can detect duplicates in a stream and meanwhile dynamically maintain decayed-weight of all distinct elements in the stream according to a user-specified decay function. For a query for the current decayed sum of a subset in the stream, TDBF provides an effective estimation. In our theoretical analysis, a provably approximate guarantee has been given for the error of the estimation. In addition, the experimental results on synthetic stream validate our theoretical analysis.
43302296
A Novel Immune Based Approach for Detection of Windows PE Virus
Generic computer virus detection is the absolute need of the hour as most commercial antivirus products fail to detect unknown and new Windows PE viruses. Motivated by the success of immune-based techniques in intrusion detection systems, recent research in detecting computer viruses is directed towards devising efficient non-signature-based techniques. We observe that each Windows PE virus whether or not it is encrypted must have a relocation module to relocate its variables or constants in the infected programs. Due to its unique characteristic, the virus relocation module can be extracted as an antibody in the immune systems to detect the specific antigens. In this paper, we presented a novel Windows PE virus detection approach that draws inspiration from artificial immune system and the structure of the relocation module of the virus. The structure of Windows PE virus is sufficiently analyzed. The dynamic evolution of self and nonself, the presentation of the antigen, and the generation of the antibody are proposed. The experiment is conducted and its results indicate that this approach not only has relatively higher detection rate of unknown Windows PE virus than the earlier known methods, but also has better capability of self-adaptive and self-learning.
7391366
Craniofacial Landmark Detection by Layered Diffusion and Dilated Skeleton Maps
This paper proposed a new method for cephalogram landmark location. It firstly employed diffusions in different scales for layered segmentation, making uses of region-homogeneity and edge-saltation, thus the landmark positions could be clearly reflected on edge-maps, i.e. skeleton, of layered diffusion. Secondly, key landmarks were determined via binarization pixel-cliques which were formed by Euclidean distance maps (EDM) on dilated skeleton. To validate the performance of this method, 30 surgery cases were inspected. The comparison of predicted parameters and application values shows that all 9 angle parameters and 4 of 5 distance parameters were correctly calculated, the predicted profiles were similar to the actual contours except one point due to the intrinsic difficulty in labium prediction. Our method took advantages of layered feature preserving and ease landmark extraction, and the latter was also owing to different EDM-Width of pixel-cliques and skeleton points. It is accurate, lifelike, and superior to many similar methods
5253367
Instant Facial Modeling and Animation of Living Humans
16272826
Analyzing the impact of on-chip network traffic on program phases for CMPs
It is known that the execution of programs exhibits repetitive phases; in other words, the execution of programs can be partitioned into segments of execution, during which the application exhibits unique architectural properties. This property has been used for various optimization goals. In addition, phase information is utilized to reduce the run time of the architectural simulation. Conventionally, an application is examined in an architecture-independent manner (such as the number of times a basic block is executed) to extract information about the phases and then only the representative execution intervals are executed to analyze architectural choices. We claim that such approaches are becoming inadequate in the many-core era as application execution is not dominated by the instructions only, but instead the communication structure of the application is becoming as important as the instruction behavior. Hence, we propose to utilize communication behavior to determine the phases of an application. Our results reveal that the inclusion of the communication information can increase the accuracy of the phase detection significantly. Specifically, for SPLASH2 and MineBench applications, the average (geometric mean) CPI error rate with the instruction-based phase detection is 11.01%, while our phase detection scheme has an average error rate of 3.41% when compared to the simulations that run the applications to completion.
759478
A New Load Balancing Scheme for Distributed Multi-Agent Simulations
Disclosed is a heat sink clip assembly for releaseably attaching a heat sink to a DIP or similar electronic device package. The clip assembly includes a non-conductive attachment clip which extends between the leads on the underside of the DIP and means for latching the attachment clip to a heat sink disposed adjacent the opposite side of the electronic device package with the heat sink in intimate thermal contact with the electronic device package.
206504813
Effective Filtering Scheme against RREQ Flooding Attack in Mobile Ad Hoc Networks
In Mobile Ad hoc Networks (MANET), various types of Denial of Service Attacks (DoS) are possible because of the inherent limitations of its routing protocols. The attack of initiating / forwarding fake Route Requests (RREQs) can lead to hogging of network resources and hence denial of service to genuine nodes. This type of attack is hard to detect since malicious nodes mimic normal nodes in all aspects except that they do route discoveries much more frequently than the other nodes. A distrusted filtering mechanism is proposed to mitigate such situations and reduce the loss of throughput. The proposed mechanism could prevent this specific kind of DoS attack and does not use any additional network bandwidth.