Android Malware Detection: an Eigenspace Analysis Approach

The battle to mitigate Android malware has become more critical with the emergence of new strains incorporating increasingly sophisticated evasion techniques, in turn necessitating more advanced detection capabilities. Hence, in this paper we propose and evaluate a machine learning based approach based on eigenspace analysis for Android malware detection using features derived from static analysis characterization of Android applications. Empirical evaluation with a dataset of real malware and benign samples show that detection rate of over 96% with a very low false positive rate is achievable using the proposed method.

The Disorganized Family: Institutions, Practices and Normativity

This paper considers the value of a normative account of the relationship between agents and institutions for contemporary efforts to explain ever more complex and disorganized forms of social life. The character of social institutions, as they relate to practices, agents and norms, is explored through an engagement with the common claim that family life has been deinstitutionalized. The paper argues that a normative rather than empirical definition of institutions avoids a false distinction between institutions and practices. Drawing on ideas of social freedom and creative action from critical theory, the changes in family life are explained not as an effect of deinstitutionalization, but as a shift from an organized to a disorganized institutional type. This is understood as a response to changes in the wider normative structure, as a norm of individual freedom has undermined the legitimacy of the organized patriarchal nuclear family, with gender ascribed roles and associated duties. Contemporary motherhood is drawn on to illustrate the value of analysing the dynamic interactions between institutions, roles and practices for capturing both the complexity and the patterned quality of social experience.

Abundant genetic overlap between blood lipids and immune-mediated diseases indicates shared molecular genetic mechanisms

Epidemiological studies suggest a relationship between blood lipids and immune-mediated diseases, but the nature of these associations is not well understood. We used genome-wide association studies (GWAS) to investigate shared single nucleotide polymorphisms (SNPs) between blood lipids and immune-mediated diseases. We analyzed data from GWAS (n~200,000 individuals), applying new False Discovery Rate (FDR) methods, to investigate genetic overlap between blood lipid levels [triglycerides (TG), low density lipoproteins (LDL), high density lipoproteins (HDL)] and a selection of archetypal immune-mediated diseases (Crohn's disease, ulcerative colitis, rheumatoid arthritis, type 1 diabetes, celiac disease, psoriasis and sarcoidosis). We found significant polygenic pleiotropy between the blood lipids and all the investigated immune-mediated diseases. We discovered several shared risk loci between the immune-mediated diseases and TG (n = 88), LDL (n = 87) and HDL (n = 52). Three-way analyses differentiated the pattern of pleiotropy among the immune-mediated diseases. The new pleiotropic loci increased the number of functional gene network nodes representing blood lipid loci by 40%. Pathway analyses implicated several novel shared mechanisms for immune pathogenesis and lipid biology, including glycosphingolipid synthesis (e.g. FUT2) and intestinal host-microbe interactions (e.g. ATG16L1). We demonstrate a shared genetic basis for blood lipids and immune-mediated diseases independent of environmental factors. Our findings provide novel mechanistic insights into dyslipidemia and immune-mediated diseases and may have implications for therapeutic trials involving lipid-lowering and anti-inflammatory agents.

Shared common variants in prostate cancer and blood lipids

BACKGROUND: Epidemiological and clinical studies suggest comorbidity between prostate cancer (PCA) and cardiovascular disease (CVD) risk factors. However, the relationship between these two phenotypes is still not well understood. Here we sought to identify shared genetic loci between PCA and CVD risk factors.

METHODS: We applied a genetic epidemiology method based on conjunction false discovery rate (FDR) that combines summary statistics from different genome-wide association studies (GWAS), and allows identification of genetic overlap between two phenotypes. We evaluated summary statistics from large, multi-centre GWA studies of PCA (n=50 000) and CVD risk factors (n=200 000) [triglycerides (TG), low-density lipoprotein (LDL) cholesterol and high-density lipoprotein (HDL) cholesterol, systolic blood pressure, body mass index, waist-hip ratio and type 2 diabetes (T2D)]. Enrichment of single nucleotide polymorphisms (SNPs) associated with PCA and CVD risk factors was assessed with conditional quantile-quantile plots and the Anderson-Darling test. Moreover, we pinpointed shared loci using conjunction FDR.

RESULTS: We found the strongest enrichment of P-values in PCA was conditional on LDL and conditional on TG. In contrast, we found only weak enrichment conditional on HDL or conditional on the other traits investigated. Conjunction FDR identified altogether 17 loci; 10 loci were associated with PCA and LDL, 3 loci were associated with PCA and TG and additionally 4 loci were associated with PCA, LDL and TG jointly (conjunction FDR <0.01). For T2D, we detected one locus adjacent to HNF1B.

CONCLUSIONS: We found polygenic overlap between PCA predisposition and blood lipids, in particular LDL and TG, and identified 17 pleiotropic gene loci between PCA and LDL, and PCA and TG, respectively. These findings provide novel pathobiological insights and may have implications for trials using targeting lipid-lowering agents in a prevention or cancer setting.

The obligation to provide information where valid consent is not needed

Accounts of consent in medical ethics typically assume that consent plays the same role irrespective of the type of treatment. In this paper I argue that this assumption is false. Because of this, obligations to provide information to patients that stem from the need for consent to be valid will not apply to all types of treatment. This does not mean that there are no reasons to provide such information. The second part of the paper maps out what these reasons are and argues that they are grounded in the obligation of beneficence and a duty to warn, not in considerations of respect for autonomy.

Detecting Packed Executables using Steganalysis

This paper proposes a novel method of detecting packed executable files using steganalysis, primarily targeting the detection of obfuscated malware through packing. Considering that over 80% of malware in the wild is packed, detection accuracy and low false negative rates are important properties of malware detection methods. Experimental results outlined in this paper reveal that the proposed approach achieving an overall detection accuracy of greater than 99%, a false negative rate of 1% and a false positive rate of 0%.

Genetic Sharing with Cardiovascular Disease Risk Factors and Diabetes Reveals Novel Bone Mineral Density Loci

Bone Mineral Density (BMD) is a highly heritable trait, but genome-wide association studies have identified few genetic risk factors. Epidemiological studies suggest associations between BMD and several traits and diseases, but the nature of the suggestive comorbidity is still unknown. We used a novel genetic pleiotropy-informed conditional False Discovery Rate (FDR) method to identify single nucleotide polymorphisms (SNPs) associated with BMD by leveraging cardiovascular disease (CVD) associated disorders and metabolic traits. By conditioning on SNPs associated with the CVD-related phenotypes, type 1 diabetes, type 2 diabetes, systolic blood pressure, diastolic blood pressure, high density lipoprotein, low density lipoprotein, triglycerides and waist hip ratio, we identified 65 novel independent BMD loci (26 with femoral neck BMD and 47 with lumbar spine BMD) at conditional FDR < 0.01. Many of the loci were confirmed in genetic expression studies. Genes validated at the mRNA levels were characteristic for the osteoblast/osteocyte lineage, Wnt signaling pathway and bone metabolism. The results provide new insight into genetic mechanisms of variability in BMD, and a better understanding of the genetic underpinnings of clinical comorbidity.

Development and Validation of a Lateral Flow Immunoassay for the Rapid Screening of Okadaic Acid and All Dinophysis Toxins from Shellfish Extracts

A single-step lateral flow immunoassay was developed and validated to detect okadaic acid (OA) and dinophysis toxins (DTXs), which cause diarrhetic shellfish poisoning. The performance characteristics of the test were investigated, in comparison to reference methods (liquid chromatography tandem mass spectrometry and/or bioassay), using both spiked and naturally contaminated shellfish. A portable reader was used to generate a qualitative result, indicating the absence or presence of OA-group toxins, at concentrations relevant to the maximum permitted level (MPL). Sample homogenates could be screened in 20 min (including extraction and assay time) for the presence of free toxins (OA, DTX1, DTX2). DTX3 detection could be included with the addition of a hydrolysis procedure. No matrix effects were observed from the species evaluated (mussels, scallops, oysters, and clams). Results from naturally contaminated samples (n = 72) indicated no false compliant results and no false noncompliant results at <50% MPL. Thus, the development of a new low-cost but highly effective tool for monitoring a range of important phycotoxins has been demonstrated.

Improving Recall of Regular Expressions for Information Extraction

Learning or writing regular expressions to identify instances of a specific
concept within text documents with a high precision and recall is challenging.
It is relatively easy to improve the precision of an initial regular expression
by identifying false positives covered and tweaking the expression to avoid the
false positives. However, modifying the expression to improve recall is difficult
since false negatives can only be identified by manually analyzing all documents,
in the absence of any tools to identify the missing instances. We focus on partially
automating the discovery of missing instances by soliciting minimal user
feedback. We present a technique to identify good generalizations of a regular
expression that have improved recall while retaining high precision. We empirically
demonstrate the effectiveness of the proposed technique as compared to
existing methods and show results for a variety of tasks such as identification of
dates, phone numbers, product names, and course numbers on real world datasets

Investigation into DCT Feature Selection for Visual Lip-Based Biometric Authentication

This paper investigated using lip movements as a behavioural biometric for person authentication. The system was trained, evaluated and tested using the XM2VTS dataset, following the Lausanne Protocol configuration II. Features were selected from the DCT coefficients of the greyscale lip image. This paper investigated the number of DCT coefficients selected, the selection process, and static and dynamic feature combinations. Using a Gaussian Mixture Model - Universal Background Model framework an Equal Error Rate of 2.20% was achieved during evaluation and on an unseen test set a False Acceptance Rate of 1.7% and False Rejection Rate of 3.0% was achieved. This compares favourably with face authentication results on the same dataset whilst not being susceptible to spoofing attacks.

Dark room provocative test and extent of angle closure: an anterior segment OCT study.

PURPOSE: To clarify the risk parameters measured by anterior segment optical coherence tomography (AS-OCT) for elevated intraocular pressures (IOP) provoked by the darkroom test and to provide recommendations for its clinical usage. METHODS: Subjects aged >40 years and whose peripheral anterior chambers were ≤1/4 corneal thickness were recruited. The anterior segment of the eye was imaged in sitting position and under both light and dark conditions and biometry was performed using anterior segment optical coherence tomography. The analyzed parameters were: (1) central anterior chamber depth (ACD); (2) anterior chamber width; (3) pupil diameter; (4) iris curvature; (5) lens thickness; and (6) number of meridians with closed angles (NCA). Then the darkroom test was performed and a positive provocative test result was defined as a rise in IOP ≥8 mm Hg after the test. Statistical analyses included: (1) the difference in parameters between positive and negative eyes; (2) the association between posttest IOP and the parameters; and (3) the difference in parameters between the 2 eyes in subjects with the asymmetric results. RESULTS: A total of 70 subjects were recruited. ACD (P=0.022), NCA in light (P<0.001), and NCA in dark (P<0.001) were different significantly between eyes with positive and negative results. There was a strong association between NCA in dark (r=0.755, P<0.001) and the posttest IOP. Among subjects with asymmetric results between the 2 eyes, the ACD was shallower and the lens thickness was larger in the positive eye. CONCLUSIONS: The posttest IOP is determined by the extent of functionally closed angles in the dark. The test may be useful in the early diagnosis of primary angle closure. At the same time, angle configuration should be evaluated to remove false positive result.

Pupil constriction can alter the accuracy of dark room provocative test.

BACKGROUND: Primary angle-closure glaucoma (PACG) is a major cause of visual morbidity in East Asia. Dark-room provocative test (DRPT) has been used to determine which narrow angles have the risk to develop angle closure. However, the accuracy of DRPT might be altered because that after emerging from the dark room, the configuration of the angle is affected by the light of the slit-lamp and the appositionally closed angle reopens. The aim of this study was to examine the pupillary diameter in different light conditions and use it as a parameter to assess the accuracy of dark-room provocative test. METHODS: Patients with suspected primary angle-closure glaucoma undergoing DRPT were recruited. The anterior chamber angle was examined by anterior segment optical coherence tomography under the following conditions: (1) in standard room illumination; (2) after short-term dark-adaptation and (3) after DRPT. Mean values of pupil size and numbers of appositionally closed angle under different conditions were compared. RESULTS: A total of 47 eyes of 47 patients were analyzed. The pupil size after DRPT was smaller than that after short-term dark-adaptation (P < 0.001) and smaller than that in standard room illumination (P = 0.026). The numbers of appositionally closed angles after short-term dark-adaptation were significantly larger than those after DRPT (P < 0.001). There was no significant difference between the numbers of appositionally closed angles in standard room illumination and after DRPT (P = 0.157). CONCLUSIONS: Constriction of pupil size immediately after prolonged dark room provocative test may lead to change in the angle configuration, which may lead to false negative results. We suggest a modified protocol of recording intraocular pressure immediately after DRPT and performing gonioscopy following short-term dark adaptation to improve the accuracy of angle closure assessment.

LS-ADT: Lightweight and Scalable Anomaly Detection for Cloud Datacentres

Cloud data centres are implemented as large-scale clusters with demanding requirements for service performance, availability and cost of operation. As a result of scale and complexity, data centres typically exhibit large numbers of system anomalies resulting from operator error, resource over/under provisioning, hardware or software failures and security issus anomalies are inherently difficult to identify and resolve promptly via human inspection. Therefore, it is vital in a cloud system to have automatic system monitoring that detects potential anomalies and identifies their source. In this paper we present a lightweight anomaly detection tool for Cloud data centres which combines extended log analysis and rigorous correlation of system metrics, implemented by an efficient correlation algorithm which does not require training or complex infrastructure set up. The LADT algorithm is based on the premise that there is a strong correlation between node level and VM level metrics in a cloud system. This correlation will drop significantly in the event of any performance anomaly at the node-level and a continuous drop in the correlation can indicate the presence of a true anomaly in the node. The log analysis of LADT assists in determining whether the correlation drop could be caused by naturally occurring cloud management activity such as VM migration, creation, suspension, termination or resizing. In this way, any potential anomaly alerts are reasoned about to prevent false positives that could be caused by the cloud operator’s activity. We demonstrate LADT with log analysis in a Cloud environment to show how the log analysis is combined with the correlation of systems metrics to achieve accurate anomaly detection.