Detecting obfuscated malware using reduced opcode set and optimised runtime trace

The research presented, investigates the optimal set of operational codes (opcodes) that create a robust indicator of malicious software (malware) and also determines a program’s execution duration for accurate classification of benign and malicious software. The features extracted from the dataset are opcode density histograms, extracted during the program execution. The classifier used is a support vector machine and is configured to select those features to produce the optimal classification of malware over different program run lengths. The findings demonstrate that malware can be detected using dynamic analysis with relatively few opcodes.

Contribution of biomass combustion to air pollutant emissions

In Portugal, it was estimated that around 1.95 Mton/year of wood is used in residential wood burning for heating and cooking. Additionally, in the last decades, burnt forest area has also been increasing. These combustions result in high levels of toxic air pollutants and a large perturbation of atmospheric chemistry, interfere with climate and have adverse effects on health. Accurate quantification of the amounts of trace gases and particulate matter emitted from residential wood burning, agriculture and garden waste burning and forest fires on a regional and global basis is essential for various purposes, including: the investigation of several atmospheric processes, the reporting of greenhouse gas emissions, and quantification of the air pollution sources that affect human health at regional scales. In Southern Europe, data on detailed emission factors from biomass burning are rather inexistent. Emission inventories and source apportionment, photochemical and climate change models use default values obtained for US and Northern Europe biofuels. Thus, it is desirable to use more specific locally available data. The objective of this study is to characterise and quantify the contribution of biomass combustion sources to atmospheric trace gases and aerosol concentrations more representative of the national reality. Laboratory (residential wood combustion) and field (agriculture/garden waste burning and experimental wildland fires) sampling experiments were carried out. In the laboratory, after the selection of the most representative wood species and combustion equipment in Portugal, a sampling program to determine gaseous and particulate matter emission rates was set up, including organic and inorganic aerosol composition. In the field, the smoke plumes from agriculture/garden waste and experimental wildland fires were sampled. The results of this study show that the combustion equipment and biofuel type used have an important role in the emission levels and composition. Significant differences between the use of traditional combustion equipment versus modern equipments were also observed. These differences are due to higher combustion efficiency of modern equipment, reflecting the smallest amount of particulate matter, organic carbon and carbon monoxide released. With regard to experimental wildland fires in shrub dominated areas, it was observed that the largest organic fraction in the samples studied was mainly composed by vegetation pyrolysis products. The major organic components in the smoke samples were pyrolysates of vegetation cuticles, mainly comprising steradienes and sterol derivatives, carbohydrates from the breakdown of cellulose, aliphatic lipids from vegetation waxes and methoxyphenols from the lignin thermal degradation. Despite being a banned practice in our country, agriculture/garden waste burning is actually quite common. To assess the particulate matter composition, the smoke from three different agriculture/garden residues have been sampled into 3 different size fractions (PM2.5, PM2.5-10 and PM>10). Despite distribution patterns of organic compounds in particulate matter varied among residues, the amounts of phenolics (polyphenol and guaiacyl derivatives) and organic acids were always predominant over other organic compounds in the organosoluble fraction of smoke. Among biomarkers, levoglucosan, β-sitosterol and phytol were detected in appreciable amounts in the smoke of all agriculture/garden residues. In addition, inositol may be considered as an eventual tracer for the smoke from potato haulm burning. It was shown that the prevailing ambient conditions (such as high humidity in the atmosphere) likely contributed to atmospheric processes (e.g. coagulation and hygroscopic growth), which influenced the particle size characteristics of the smoke tracers, shifting their distribution to larger diameters. An assessment of household biomass consumption was also made through a national scale survey. The information obtained with the survey combined with the databases on emission factors from the laboratory and field tests allowed us to estimate the pollutant amounts emitted in each Portuguese district. In addition to a likely contribution to the improvement of emission inventories, emission factors obtained for tracer compounds in this study can be applied in receptor models to assess the contribution of biomass burning to the levels of atmospheric aerosols and their constituents obtained in monitoring campaigns in Mediterranean Europe.

Characterisation of gas and particle emissions from wildfires

Os incêndios florestais são uma importante fonte de emissão de compostos gasosos e de aerossóis. Em Portugal, onde a maioria dos incêndios ocorre no norte e centro do país, os incêndios destroem todos os anos milhares de hectares, com importantes perdas em termos económicos, de vidas humanas e qualidade ambiental. As emissões podem alterar consideravelmente a química da atmosfera, degradar a qualidade do ar e alterar o clima. Contudo, a informação sobre as caraterísticas das emissões dos incêndios florestais nos países do Mediterrâneo é limitada. Tanto a nível nacional como internacional, existe um interesse crescente na elaboração de inventários de emissões e de regulamentos sobre as emissões de carbono para a atmosfera. Do ponto de vista atmosférico da monitorização atmosférica, os incêndios são considerados um desafio, dada a sua variabilidade temporal e espacial, sendo de esperar um aumento da sua frequência, dimensão e severidade, e também porque as estimativas de emissões dependem das caraterísticas dos biocombustíveis e da fase de combustão. O objetivo deste estudo foi quantificar e caraterizar as emissões de gases e aerossóis de alguns dos mais representativos incêndios florestais que ocorreram no centro de Portugal nos verões de 2009 e de 2010. Efetuou-se a colheita de amostras de gases e de duas frações de partículas (PM2.5 e PM2.5-10) nas plumas de fumo em sacos Tedlar e em filtros de quartzo acoplados a um amostrador de elevado volume, respetivamente. Os hidrocarbonetos totais (THC) e óxidos de carbono (CO e CO2) nas amostras gasosas foram analisados em instrumentos automáticos de ionização de chama e detetores não dispersivos de infravermelhos, respetivamente. Para algumas amostras, foram também quantificados alguns compostos de carbonilo após reamostragem do gás dos sacos Tedlar em cartuchos de sílica gel revestidos com 2,4-dinitrofenilhidrazina (DNPH), seguida de análise por cromatografia líquida de alta resolução. Nas partículas, analisou-se o carbono orgânico e elementar (técnica termo-óptica), iões solúveis em água (cromatografia iónica) e elementos (espectrometria de massa com plasma acoplado por indução ou análise instrumental por ativação com neutrões). A especiação orgânica foi obtida por cromatografia gasosa acoplada a espectrometria de massa após extração com recurso a vários solventes e separação dos extratos orgânicos em diversas classes de diferentes polaridades através do fracionamento com sílica gel. Os fatores de emissão do CO e do CO2 situaram-se nas gamas 52-482 e 822-1690 g kg-1 (base seca), mostrando, respetivamente, correlação negativa e positiva com a eficiência de combustão. Os fatores de emissão dos THC apresentaram valores mais elevados durante a fase de combustão latente sem chama, oscilando entre 0.33 e 334 g kg-1 (base seca). O composto orgânico volátil oxigenado mais abundante foi o acetaldeído com fatores de emissão que variaram desde 1.0 até 3.2 g kg-1 (base seca), seguido pelo formaldeído e o propionaldeído. Observou-se que as emissões destes compostos são promovidas durante a fase de combustão latente sem chama. Os fatores de emissão de PM2.5 e PM10 registaram valores entre 0.50-68 e 0.86-72 g kg-1 (base seca), respetivamente. A emissão de partículas finas e grosseiras é também promovida em condições de combustão lenta. As PM2.5 representaram cerca de 90% da massa de partículas PM10. A fração carbonosa das partículas amostradas em qualquer dos incêndios foi claramente dominada pelo carbono orgânico. Foi obtida uma ampla gama de rácios entre o carbono orgânico e o carbono elementar, dependendo das condições de combustão. Contudo, todos os rácios refletiram uma maior proporção de carbono orgânico em relação ao carbono elementar, típica das emissões de queima de biomassa. Os iões solúveis em água obtidos nas partículas da pluma de fumo contribuíram com valores até 3.9% da massa de partículas PM2.5 e 2.8% da massa de partículas de PM2.5-10. O potássio contribuiu com valores até 15 g mg-1 PM2.5 e 22 g mg-1 PM2.5-10, embora em massa absoluta estivesse maioritariamente presente nas partículas finas. Os rácios entre potássio e carbono elementar e entre potássio e carbono orgânico obtidos nas partículas da pluma de fumo enquadram-se na gama de valores relatados na literatura para emissões de queima de biomassa. Os elementos detetados nas amostras representaram, em média, valores até 1.2% e 12% da massa de PM2.5 e PM2.5-10, respetivamente. Partículas resultantes de uma combustão mais completa (valores elevados de CO2 e baixos de CO) foram caraterizadas por um elevado teor de constituintes inorgânicos e um menor conteúdo de matéria orgânica. Observou-se que a matéria orgânica particulada é composta principalmente por componentes fenólicos e produtos derivados, séries de compostos homólogos (alcanos, alcenos, ácidos alcanóicos e alcanóis), açúcares, biomarcadores esteróides e terpenóides, e hidrocarbonetos aromáticos policíclicos. O reteno, um biomarcador das emissões da queima de coníferas, foi o hidrocarboneto aromático dominante nas amostras das plumas de fumo amostradas durante a campanha que decorreu em 2009, devido ao predomínio de amostras colhidas em incêndios em florestas de pinheiros. O principal açúcar anidro, e sempre um dos compostos mais abundantes, foi o levoglucosano. O rácio levoglucosano/OC obtido nas partículas das plumas de fumo, em média, registaram valores desde 5.8 a 23 mg g-1 OC. Os rácios levoglucosano/manosano e levoglucosano/(manosano+galactosano) revelaram o predomínio de amostras provenientes da queima de coníferas. Tendo em conta que a estimativa das emissões dos incêndios florestais requer um conhecimento de fatores de emissão apropriados para cada biocombustível, a base de dados abrangente obtida neste estudo é potencialmente útil para atualizar os inventários de emissões. Tem vindo a ser observado que a fase de combustão latente sem chama, a qual pode ocorrer simultaneamente com a fase de chama e durar várias horas ou dias, pode contribuir para uma quantidade considerável de poluentes atmosféricos, pelo que os fatores de emissão correspondentes devem ser considerados no cálculo das emissões globais de incêndios florestais. Devido à falta de informação detalhada sobre perfis químicos de emissão, a base de dados obtida neste estudo pode também ser útil para a aplicação de modelos no recetor no sul da Europa.

Comparison of AGNES (absence of gradients and Nernstian equilibrium stripping) and SSCP (scanned stripping chronopotentiometry) for trace metal speciation analysis

The free metal ion concentrations obtained by SSCP (stripping chronopotentiometry at scanned deposition potential) and by AGNES (absence of gradients and Nernstian equilibrium stripping) techniques have been compared and the usefulness of the combination of both techniques in the same electrochemical cell for trace metal speciation analysis is assessed. The free metal ion concentrations and the stability constants obtained for lead(II) and cadmium(II) complexation by pyridinedicarboxylic acid, by 40 nm radius carboxylated latex nanospheres and by a humic acid extracted from an ombrotrophic peat bog were determined. Whenever possible, the free metal ion concentrations were compared with the theoretical predictions of the code MEDUSA and with the free metal ion concentrations estimated from ion selective electrodes (ISE). SSCP values were in agreement with the ones obtained by AGNES, and both of them agreed reasonably with the ISE values and the theoretical predictions. For the lead(II)-humic acid, it was not possible to obtain the stability constants by SSCP due to the heterogeneity effect. However, using AGNES it is possible to obtain, for these heterogeneous systems, the free bulk metal concentration, which allows us to retrieve the stability constant at bulk conditions.

Electrochemical methodology to study labile trace metal/natural organic matter complexation at low concentration levels in natural waters

A new electrochemical methodology to study labile trace metal/natural organic matter complexation at low concentration levels in natural waters is presented. This methodology consists of three steps: (i) an estimation of the complex diffusion coefficient (DML), (ii) determination at low pH of the total metal concentration initially present in the sample, (iii) a metal titration at the desired pH. The free and bound metal concentrations are determined for each point of the titration and modeled with the non-ideal competitive adsorption (NICA-Donnan) model in order to obtain the binding parameters. In this methodology, it is recommended to determine the hydrodynamic transport parameter, α, for each set of hydrodynamic conditions used in the voltammetric measurements. The methodology was tested using two fractions of natural organic matter (NOM) isolated from the Loire river, namely the hydrophobic organic matter (HPO) and the transphilic organic matter (TPI), and a well characterized fulvic acid (Laurentian fulvic acid, LFA). The complex diffusion coefficients obtained at pH 5 were 0.4 ± 0.2 for Pb and Cu/HPO, 1.8 ± 0.2 for Pb/TPI and (0.612 ± 0.009) × 10−10 m2 s−1 for Pb/LFA. NICA-Donnan parameters for lead binding were obtained for the HPO and TPI fractions. The new lead/LFA results were successfully predicted using parameters derived in our previous work.

Depositional characteristics and trace metal abundance of sediments in an anoxic basin

Senior thesis written for Oceanography 445

Serum trace elements in dysphagic gastrostomy candidates before endoscopic gastrostomy for long term enteral feeding

Background & aims - Patients who underwent endoscopic gastrostomy (PEG) present protein-energy malnutrition, but little is known about Trace Elements (TE), Zinc (Zn), Copper (Cu), Selenium (Se), Iron (Fe), Chromium (Cr). Our aim was the evaluation of serum TE in patients who underwent PEG and its relationship with serum proteins, BMI and nature of underlying disorder. Methods - A prospective observational study was performed collecting: patient's age, gender, underlying disorder, NRS-2002, BMI, serum albumin, transferrin and TE concentration. We used ferrozine colorimetric method for Fe; Inductively Coupled Plasma-Atomic Emission Spectroscopy for Zn/Cu; Furnace Atomic Absorption Spectroscopy for Se/Cr. The patients were divided into head and neck cancer (HNC) and neurological dysphagia (ND). Results - 146 patients (89 males), 21–95 years: HNC-56; ND-90. Low BMI in 78. Low values mostly for Zn (n = 122) and Fe (n = 69), but less for Se (n = 31), Cu (n = 16), Cr (n = 7); low albumin in 77, low transferrin in 94 and 66 with both proteins low. Significant differences between the groups of underlying disease only for Zn (t140.326 = −2,642, p < 0.01) and a correlation between proteins and TE respectively albumin and Zn (r = 0.197, p = 0.025), and albumin and Fe (r = 0.415, p = 0.000). Conclusions - When gastrostomy was performed, patients display low serum TE namely Zn, but also Fe, less striking regarding others TE. It was related with prolonged fasting, whatever the underlying disease. Low proteins were associated with low TE. Teams taking care of PEG-patients should use Zn supplementation and include other TE evaluation as part of the nutritional assessment of PEG candidates.

Trace metals in size-fractionated particulate matter in a Portuguese hospital: exposure risks assessment and comparisons with other countries

Hospitals are considered as a special and important type of indoor public place where air quality has significant impacts on potential health outcomes. Information on indoor air quality of these environments, concerning exposures to particulate matter (PM) and related toxicity, is limited though. This work aims to evaluate risks associated with inhalation exposure to ten toxic metals and chlorine (As, Ni, Cr, Cd, Pb, Mn, Se, Ba, Al, Si, and Cl) in coarse (PM2.5–10) and fine (PM2.5) particles in a Portuguese hospital in comparison with studies representative of other countries. Samples were collected during 1 month in one urban hospital; elemental PM characterization was determined by proton-induced X-ray emission. Noncarcinogenic and carcinogenic risks were assessed according to the methodology provided by the United States Environmental Protection Agency (USEPA; Region III Risk-Based Concentration Table) for three different age categories of hospital personnel (adults, >20, and <65 years) and patients (considering nine different age groups, i.e., children of 1–3 years to seniors of >65 years). The estimated noncarcinogenic risks due to occupational inhalation exposure to PM2.5-bound metals ranged from 5.88×10−6 for Se (adults, 55–64 years) to 9.35×10−1 for As (adults, 20–24 years) with total noncarcinogenic risks (sum of all metals) above the safe level for all three age categories. As and Cl (the latter due to its high abundances) were the most important contributors (approximately 90 %) to noncarcinogenic risks. For PM2.5–10, noncarcinogenic risks of all metals were acceptable to all age groups. Concerning carcinogenic risks, for Ni and Pb, they were negligible (<1×10−6) in both PM fractions for all age groups of hospital personnel; potential risks were observed for As and Cr with values in PM2.5 exceeding (up to 62 and 5 times, respectively) USEPA guideline across all age groups; for PM2.5–10, increased excess risks of As and Cr were observed particularly for long-term exposures (adults, 55–64 years). Total carcinogenic risks highly (up to 67 times) exceeded the recommended level for all age groups, thus clearly showing that occupational exposure to metals in fine particles pose significant risks. If the extensive working hours of hospital medical staff were considered, the respective noncarcinogenic and carcinogenic risks were increased, the latter for PM2.5 exceeding the USEPA cumulative guideline of 10−4. For adult patients, the estimated noncarcinogenic and carcinogenic risks were approximately three times higher than for personnel, with particular concerns observed for children and adolescents.

Trace Elements in Ambient Air at Porto Metropolitan Area—Checking for Compliance with New European Union (Eu) Air Quality Standards

Because of the scientific evidence showing that arsenic (As), cadmium (Cd), and nickel (Ni) are human genotoxic carcinogens, the European Union (EU) recently set target values for metal concentration in ambient air (As: 6 ng/m3, Cd: 5 ng/m3, Ni: 20 ng/m3). The aim of our study was to determine the concentration levels of these trace elements in Porto Metropolitan Area (PMA) in order to assess whether compliance was occurring with these new EU air quality standards. Fine (PM2.5) and inhalable (PM10) air particles were collected from October 2011 to July 2012 at two different (urban and suburban) locations in PMA. Samples were analyzed for trace elements content by inductively coupled plasma–mass spectrometry (ICP-MS). The study focused on determination of differences in trace elements concentration between the two sites, and between PM2.5 and PM10, in order to gather information regarding emission sources. Except for chromium (Cr), the concentration of all trace elements was higher at the urban site. However, results for As, Cd, Ni, and lead (Pb) were well below the EU limit/target values (As: 1.49 ± 0.71 ng/m3; Cd: 1.67 ± 0.92 ng/m3; Ni: 3.43 ± 3.23 ng/m3; Pb: 17.1 ± 10.1 ng/m3) in the worst-case scenario. Arsenic, Cd, Ni, Pb, antimony (Sb), selenium (Se), vanadium (V), and zinc (Zn) were predominantly associated to PM2.5, indicating that anthropogenic sources such as industry and road traffic are the main source of these elements. High enrichment factors (EF > 100) were obtained for As, Cd, Pb, Sb, Se, and Zn, further confirming their anthropogenic origin.

Modeling of in-situ crystallization processes in the Permian mafic layered intrusion of Mont Collon (Dent Blanche nappe, western Alps)

The Mont Collon mafic complex is one of the best preserved examples of the Early Permian magmatism in the Central Alps, related to the intra-continental collapse of the Variscan belt. It mostly consists (> 95 vol.%) of ol+hy-nonnative plagioclase-wehrlites, olivine- and cpx-gabbros with cumulitic structures, crosscut by acid dikes. Pegmatitic gabbros, troctolites and anorthosites outcrop locally. A well-preserved cumulative, sequence is exposed in the Dents de Bertol area (center of intrusion). PT-calculations indicate that this layered magma chamber emplaced at mid-crustal levels at about 0.5 GPa and 1100 degrees C. The Mont Collon cumulitic rocks record little magmatic differentiation, as illustrated by the restricted range of clinopyroxene mg-number (Mg#(cpx)=83-89). Whole-rock incompatible trace-element contents (e.g. Nb, Zr, Ba) vary largely and without correlation with major-element composition. These features are characteristic of an in-situ crystallization process with variable amounts of interstitial liquid L trapped between the cumulus mineral phases. LA-ICPMS measurements show that trace-element distribution in the latter is homogeneous, pointing to subsolidus re-equilibration between crystals and interstitial melts. A quantitative modeling based on Langmuir's in-situ crystallization equation successfully duplicated the REE concentrations in cumulitic minerals of all rock facies of the intrusion. The calculated amounts of interstitial liquid L vary between 0 and 35% for degrees of differentiation F of 0 to 20%, relative to the least evolved facies of the intrusion. L values are well correlated with the modal proportions of interstitial amphibole and whole-rock incompatible trace-element concentrations (e.g. Zr, Nb) of the tested samples. However, the in-situ crystallization model reaches its limitations with rock containing high modal content of REE-bearing minerals (i.e. zircon), such as pegmatitic gabbros. Dikes of anorthositic composition, locally crosscutting the layered lithologies, evidence that the Mont Collon rocks evolved in open system with mixing of intercumulus liquids of different origins and possibly contrasting compositions. The proposed model is not able to resolve these complex open systems, but migrating liquids could be partly responsible for the observed dispersion of points in some correlation diagrams. Absence of significant differentiation with recurrent lithologies in the cumulitic pile of Dents de Bertol points to an efficiently convective magma chamber, with possible periodic replenishment, (c) 2005 Elsevier B.V. All rights reserved.

Quantification of clenbuterol at trace level in human urine by ultra-high pressure liquid chromatography-tandem mass spectrometry.

Clenbuterol is a β2 agonist agent with anabolic properties given by the increase in the muscular mass in parallel to the decrease of the body fat. For this reason, the use of clenbuterol is forbidden by the World Anti-Doping Agency (WADA) in the practice of sport. This compound is of particular interest for anti-doping authorities and WADA-accredited laboratories due to the recent reporting of risk of unintentional doping following the eating of meat contaminated with traces of clenbuterol in some countries. In this work, the development and the validation of an ultra-high pressure liquid chromatography coupled to electrospray ionization tandem mass spectrometry (UHPLC-ESI-MS/MS) method for the quantification of clenbuterol in human urine is described. The analyte was extracted from urine samples by liquid-liquid extraction (LLE) in basic conditions using tert butyl-methyl ether (TBME) and analyzed by UHPLC-MS/MS with a linear gradient of acetonitrile in 9min only. The simple and rapid method presented here was validated in compliance with authority guidelines and showed a limit of quantification at 5pg/mL and a linearity range from 5pg/mL to 300pg/mL. Good trueness (85.8-105%), repeatability (5.7-10.6% RSD) and intermediate precision (5.9-14.9% RSD) results were obtained. The method was then applied to real samples from eighteen volunteers collecting urines after single oral doses administration (1, 5 and 10μg) of clenbuterol-enriched yogurts.

The development of automated methods for the determination of trace concentrations of carbomate pesticides in water using solid sorbent pre-concentration methods and high performance liquid chromatography /

Several automated reversed-phase HPLC methods have been developed to determine trace concentrations of carbamate pesticides (which are of concern in Ontario environmental samples) in water by utilizing two solid sorbent extraction techniques. One of the methods is known as on-line pre-concentration'. This technique involves passing 100 milliliters of sample water through a 3 cm pre-column, packed with 5 micron ODS sorbent, at flow rates varying from 5-10 mUmin. By the use of a valve apparatus, the HPLC system is then switched to a gradient mobile phase program consisting of acetonitrile and water. The analytes, Propoxur, Carbofuran, Carbaryl, Propham, Captan, Chloropropham, Barban, and Butylate, which are pre-concentrated on the pre-column, are eluted and separated on a 25 cm C-8 analytical column and determined by UV absorption at 220 nm. The total analytical time is 60 minutes, and the pre-column can be used repeatedly for the analysis of as many as thirty samples. The method is highly sensitive as 100 percent of the analytes present in the sample can be injected into the HPLC. No breakthrough of any of the analytes was observed and the minimum detectable concentrations range from 10 to 480 ng/L. The developed method is totally automated for the analysis of one sample. When the above mobile phase is modified with a buffer solution, Aminocarb, Benomyl, and its degradation product, MBC, can also be detected along with the above pesticides with baseline resolution for all of the analytes. The method can also be easily modified to determine Benomyl and MBC both as solute and as particulate matter. By using a commercially available solid phase extraction cartridge, in lieu of a pre-column, for the extraction and concentration of analytes, a completely automated method has been developed with the aid of the Waters Millilab Workstation. Sample water is loaded at 10 mL/min through a cartridge and the concentrated analytes are eluted from the sorbent with acetonitrile. The resulting eluate is blown-down under nitrogen, made up to volume with water, and injected into the HPLC. The total analytical time is 90 minutes. Fifty percent of the analytes present in the sample can be injected into the HPLC, and recoveries for the above eight pesticides ranged from 84 to 93 percent. The minimum detectable concentrations range from 20 to 960 ng/L. The developed method is totally automated for the analysis of up to thirty consecutive samples. The method has proven to be applicable to both purer water samples as well as untreated lake water samples.