Classification of malware based on string and function feature selection

Anti-malware software producers are continually challenged to identify and counter new malware as it is released into the wild. A dramatic increase in malware production in recent years has rendered the conventional method of manually determining a signature for each new malware sample untenable. This paper presents a scalable, automated approach for detecting and classifying malware by using pattern recognition algorithms and statistical methods at various stages of the malware analysis life cycle. Our framework combines the static features of function length and printable string information extracted from malware samples into a single test which gives classification results better than those achieved by using either feature individually. In our testing we input feature information from close to 1400 unpacked malware samples to a number of different classification algorithms. Using k-fold cross validation on the malware, which includes Trojans and viruses, along with 151 clean files, we achieve an overall classification accuracy of over 98%.

Two-dimensional string notation for representing video sequences

Most current work on video indexing concentrates on queries which operate over high level semantic information which must be entirely composed and entered manually. We propose an indexing system which is based on spatial information about key objects in a scene. These key objects may be detected automatically, with manual supervision, and tracked through a sequence using one of a number of recently developed techniques. This representation is highly compact and allows rapid resolution of queries specified by iconic example. A number of systems have been produced which use 2D string notations to index digital image libraries. Just as 2D strings provide a compact and tractable indexing notation for digital pictures, a sequence of 2D strings might provide an index for a video or image sequence. To improve further upon this we reduce the representation to the 2D string pair representing the initial frame, and a sequence of edits to these strings. This takes advantage of the continuity between frames to further reduce the size of the notation. By representing video sequences using string edits, a notation has been developed which is compact, and allows querying on the spatial relationships of objects to be performed without rebuilding the majority of the scene. Calculating ranks of objects directly from the edit sequence allows matching with minimal calculation, thus greatly reducing search time. This paper presents the edit sequence notation and algorithms for evaluating queries over image sequences. A number of optimizations which represent a considerably saving in search time is demonstrated in the paper.

String matching query verification on the cloud-hosted databases

Database query verification schemes attempt to provide authenticity, completeness, and freshness guarantees for queries executed on untrusted cloud servers. A number of such schemes currently exist in the literature, allowing query verification for queries that are based on matching whole values (such as numbers, dates, etc.) or for queries based on keyword matching. However, there is a notable gap in the research with regard to query verification schemes for pattern-matching queries. Our contribution here is to provide such a verification scheme that provides correctness guarantees for pattern-matching queries executed on the cloud. We describe a trivial scheme, ȃŸż and show how it does not provide completeness guarantees, and then proceed to describe our scheme based on efficient primitives such as cryptographic hashing and Merkle hash trees along with suffix arrays. We also provide experimental results based on a working prototype to show the practicality of our scheme.Ÿż

Neglect dyslexia with a stimulus-centred deficit and without visuospatial neglect.

This paper reports a single case of ipsilesional left neglect dyslexia and interprets it according to the three-level model of visual word recognition proposed by Caramazza and Hillis (1990). The three levels reflect a progression from the physical stimulus to an abstract representation of a word. RR was not impaired at the first, retinocentric, level, which represents the individual features of letters within a word according to the location of the word in the visual field: She made the same number of errors to words presented in her left visual field as in her right visual field. A deficit at this level should also mean the patient neglects all stimuli. This did not occur with RR: She did not neglect when naming the items in rows of objects and rows of geometric symbols. In addition, although she displayed significant neglect dyslexia when making visual matching judgements on pairs of words and nonwords, she did not do so to pairs of nonsense letter shapes, shapes which display the same level of visual complexity as letters in words. RR was not impaired at the third, graphemic, level, which represents the ordinal positions of letters within a word: She continued to neglect the leftmost (spatial) letter of words presented in mirror-reversed orientation and she did not neglect in oral spelling. By elimination, these results suggest RR's deficit affects a spatial reference frame where the representational space is bounded by the stimulus: A stimulus-centred level of representation. We define five characteristics of a stimulus-centred deficit, as manifest in RR. First, it is not the case that neglect dyslexia occurs because the remaining letters in a string attract or capture attention away from the leftmost letter(s). Second, the deficit is continuous across the letter string. Third, perceptually significant features, such as spaces, define potential words. Fourth, the whole, rather than part, of a letter is neglected. Fifth, category information is preserved. It is concluded that the Caramazza-Hillis model accounts well for RR's data, although we conclude that neglect dyslexia can be present when a more general visuospatial neglect is absent.

Removal of company directors in a climate of corporate collapses

The string of high-profile corporate collapses recently has provided a fresh insight into many important topics and issues in Australian corporations law. Notwithstanding this, one topic that continues to receive inadequate attention both in Australia and in foreign jurisdictions is the statutory removal of  directors. In an earlier article published in this journal, one of the present authors contributed towards addressing this lack of commentary on the topic by highlighting a number of peculiarities with the provisions under the then Corporations Law regulating the removal of directors in public and proprietary companies. Since that time, the CLERP amendments to the Corporations Law (now Corporations Act 2001) in 2000 introduced some interesting changes to the provisions dealing with the removal of directors in public and proprietary companies. In this article, the authors provide an explanation and critical analysis of these changes, and consider the recent Western Australian Supreme Court decision of Allied & Mining Process Ltd v Boldbow Pty Ltd [2002] WASC 195, which deals with some of the issues raised by the authors in relation to the CLERP amendments. According to the authors, whilst some of the peculiarities raised in the earlier article no longer exist post-CLERP, the current removal provisions still raise some important questions of interpretation.

Effects of polymer concentration and cationic surfactant on the morphology of electrospun polyacrylonitrile nanofibres

PAN nanofibres were prepared via an electrospinning process. The effect of polymer concentration on the fibre morphology was studied. At a very dilute solution, no fibres were obtained in the electrospinning process. As the concentration increased, the fibre morphology evolved from a beads-on-string structure to a uniform fibre structure with increasing fibre diameters. However, when the same electrospinning process was conducted with the addition of a cationic surfactant, the formation of disconnected beads was prevented, and the number of beads-on-string structures reduced significantly. In addition, the presence of cationic surfactant reduced the average diameter of the electrospun PAN nanofibres.

Classifying DDoS packets in high-speed networks

Recently high-speed networks have been utilized by attackers as Distributed Denial of Service (DDoS) attack infrastructure. Services on high-speed networks also have been attacked by successive waves of the DDoS attacks. How to sensitively and accurately detect the attack traffic, and quickly filter out the attack packets are still the major challenges in DDoS defense. Unfortunately most current defense approaches can not efficiently fulfill these tasks. Our approach is to find the network anomalies by using neural network and classify DDoS packets by a Bloom filter-based classifier (BFC). BFC is a set of spaceefficient data structures and algorithms for packet classification. The evaluation results show that the simple complexity, high classification speed and accuracy and low storage requirements of this classifier make it not only suitable for DDoS filtering in high-speed networks, but also suitable for other applications such as string matching for intrusion detection systems and IP lookup for programmable routers.

Legal regulation and corporate governance in China`s top 100 listed companies

This article reports findings from an empirical study of corporate governance in China's top 100 listed companies. It examines the effectiveness of legal regulation, enforcement and remedies, finding that China's company and securities laws have not provided as string a legal framework for the protection of stakeholders im China's stock exchange listed companies as might be expected by investors.

Bis(3-endo-camphoryl)phosphinic acid, a non-racemic helical supramolecular host with aquapores

Bis(3-endo-camphoryl)phosphinic acid (1) was prepared by the reaction of the lithium enolate of D-(+)-camphor and phosphorous trichloride followed by an oxidative work up. Compound 1 crystallizes from wet toluene as monohydrate 1·H2O, which was investigated by X-ray crystallography. Molecules of 1 are associated by strong hydrogen bonds giving rise to the formation of a supramolecular helix. The interior channel of the helix is filled by a one-dimensional (1D) string of water molecules that are also associated by hydrogen bonding. The 1D string adopts a twisted zigzag conformation. Although the hydrogen bond networks are not cross-linked both the screw of the helix and the twist of the 1D string of water molecules are left-handed (M) and controlled by the chiral camphoryl residues situated on the exterior of the helix. The overall supramolecular structure is strongly reminiscent of aquaporin-1, a significant membrane-channel protein responsible for the transport of water into the cells.

Morphological evolution of nanofibers during electrospinning

Electrospinning is a very useful technique to produce polymeric nanofibers. It involves fast-drawing a polymer fluid into nanofibers under a strong electric filed, and depositing randomly on an electrode collector to form non-woven nanofiber mat in most cases [1]. The fibre stretching during electrospinning is a fast and incessant process which can be divided into three consecutive stages: jet initiation, whipping instability and fibre deposition. From the initial jet to dry fibres, the fibre stretching takes place in milliseconds, so it has been hardly so far to observe fiber morphology changes by any normal methods, such as high speed photography [2-5]. In this study, we used a facile and practical approach to realize the observation of nanofiber morphology changes during electrospinning. Through a special collection device with coagulation bath, newly electrospun nanofibers can be solidified at different electro spinning distances, and by associating the fiber morphology with the electrospinning distance (d), the morphological evolution of nanofibers can be established. We used polyacrylonitrile (PAN) and polystyrene (PS) as two model polymers to demonstrate this method in present research. From experimental results, we found the massive jet-thinning happens at the initial stage of the process. The formation of uniform PAN nanofibers (7%) and the beads structure changes on beads-on-string PAN nanofibers (5%) have also been successful observed. Using the same method, we also observed PS nanofiber (10%) morphology changes to understand the beads formation 011 nanofibers during electrospinning process, and how the beads was eliminated when ionic surfactant is added into the PS solution for electrospinning.

Alternative naming strategies : family versus individual brand names

Increased competition in the consumer goods marketplace has resulted in too many brands chasing too few consumers. In an attempt to ease pressure on margins, and both brand and product range profitability, marketers would be well advised to reinspect their policies towards brand naming and the attendant costs associated with those policies. Is it really necessary for each new product to be individually named? If it is, then what are the strategic and financial implications of this decision? Why is it that the practice in some companies is to resort to a string of unrelated brand names whereas the practice elsewhere is to use an umbrella family name, with or without, a brand name as a suffix? The answers to such questions are by no means obvious and closer inspection of the issues relating to naming policy fails to yield any consensus let alone a definitive approach. This article seeks to depict the alternative naming strategies engaged by marketers and to focus on those considerations that would favour a family name in preference to an individualised brand name. The article concludes with recommendations that are drawn from current literature and the experience of marketers with a view to determining those circumstances that may influence the formulation of a more appropriate naming policy.

An automated classification system based on the strings of trojan and virus families

Classifying malware correctly is an important research issue for anti-malware software producers. This paper presents an effective and efficient malware classification technique based on string information using several wellknown classification algorithms. In our testing we extracted the printable strings from 1367 samples, including unpacked trojans and viruses and clean files. Information describing the printable strings contained in each sample was input to various classification algorithms, including treebased classifiers, a nearest neighbour algorithm, statistical algorithms and AdaBoost. Using k-fold cross validation on the unpacked malware and clean files, we achieved a classification accuracy of 97%. Our results reveal that strings from library code (rather than malicious code itself) can be utilised to distinguish different malware families.