Analysis of Bayesian classification-based approaches for Android malware detection

Mobile malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in malware targeting the platform. Additionally, Android malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android malware. Hence, the authors develop and analyse proactive machine-learning approaches based on Bayesian classification aimed at uncovering unknown Android malware via static analysis. The study, which is based on a large malware sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification-based solutions for detecting unknown Android malware.

A Game-Theoretic Approach for Threats Detection and Intervention in Surveillance

Threat prevention with limited security resources is a challenging problem. An optimal strategy is to eectively predict attackers' targets (or goals) based on current available information, and use such predictions to prevent (or disrupt) their planned attacks. In this paper, we propose a game-theoretic framework to address this challenge which encompasses the following three elements. First, we design a method to analyze an attacker's types in order to determine the most plausible type of an attacker. Second, we propose an approach to predict possible targets of an attack and the course of actions that the attackers may take even when the attackers' types are ambiguous. Third, a game-theoretic based strategy is developed to determine the best protection actions for defenders (security resources).

Pine wilt disease: a worldwide threat to forest ecosystems

The pinewood nematode (PWN), Bursaphelenchus xylophilus, the causal agent of pine wilt disease (PWD), is a serious pest and pathogen of forest tree species, in particular among the genus Pinus. It was first reported from Japan in the beginning of the XXth century, where it became the major ecological catastrophe of pine forests, with losses reaching over 2 million m3/ year in the 1980s. It has since then spread to other Asian countries such as China, Taiwan and Korea, causing serious losses and economic damage. In 1999, the PWN was first detected in the European Union (EU), in Portugal, and immmediately prompted several government (national and EU) actions to assess the extent of the nematode’s presence, and to contain B. xylophilus and its insect vector (Monochamus galloprovincialis) to an area with a 30km radius in the Setúbal Peninsula, 20 km south of Lisbon. International wood trade, with its political as well as economic ramifications, has been seriously jeopardized. The origin of the population of PWN found in Portugal remains elusive. Several hypotheses may be considered regarding pathway analysis, basically from two general origins: North America or the Far East (Japan or China). World trade of wood products such as timber, wooden crates, palettes, etc… play an important role in the potential dissemination of the pinewood nematode. In fact, human activities involving the movement of wood products may be considered the single most important factor in spreading of the PWN. Despite the dedicated and concerted actions of government agencies, this disease continues to spread. Very recently (2006), in Portugal, forestry and phytosanitary authorities (DGRF and DGPC) have announced a new strategy for the control and ultimately the erradication of the nematode, under the coordination of the national program for the control of the pinewood nematode (PROLUNP). Research regarding the bioecology of the nematode and insect as well as new detection methods, e.g., involving real-time PCR, has progressed since 1999. International agreements (GATT, WTO) and sharing of scientific information is of paramount importance to effectively control the nematode and its vector, and thus protect our forest ecosystems and forest economy.

Pine Wilt Disease: A Threat to Pine Forests in Turkey?

The pinewood nematode, is the causal agent of pine wilt disease, a serious threat to native pine forest in eastern Asia (Japan, Korea, China and Taiwan) and some parts of North America (USA, Canada and Mexico). In 1999, this nematode was found and identified for the first time in Portugal and in Europe. The detection of this quarantine pest in Portugal has indicated the need to know more about the distribution of Bursaphelenchus spp. in coniferous trees in Europe in order to describe the geographic range of the species and to act quickly in case of the nematode’s unwanted introduction into other European regions. Pine forest has a wide distribution in Turkey that increases the number of susceptible host trees for pinewood nematode. Because of these resaons, some regions of Turkey were surveyed for the presence of the nematode. Three different species of Bursaphelenchus were found. However, B. xylophilus was not detected. The detection of B. mucronatus, very similar to B. xylophilus biologically and morphologically, is very important. The presence of this species indicates that B. xylophilus could spread easly in conifer forests of Turkey. A study was conducted to determine the pathogenicity of B. mucronatus and 80% of seedlings of P. sylvestris were wilted. Biological characteristics of M. galloprovincialis were compared with M. carolinensis, Nort American vector, and some of them were found to be similar.

Electrochemical immunosensor for multiplexed detection of food-borne pathogens using nanocrystal bioconjugates and MWCNT screen-printed electrode

Bacterial food poisoning is an ever-present threat that can be prevented with proper care and handling of food products. A disposable electrochemical immunosensor for the simultaneous measurements of common food pathogenic bacteria namely Escherichia coli O157:H7 (E. coli), campylobacter and salmonella were developed. The immunosensor was fabricated by immobilizing the mixture of anti-E. coli, anticampylobacter and anti-salmonella antibodies with a ratio of 1:1:1 on the surface of the multiwall carbon nanotube-polyallylamine modified screen printed electrode (MWCNT-PAH/SPE). Bacteria suspension became attached to the immobilized antibodies when the immunosensor was incubated in liquid samples. The sandwich immunoassay was performed with three antibodies conjugated with specific nanocrystal ( -E. coli-CdS, -campylobacter-PbS and -salmonella-CuS) which has releasable metal ions for electrochemical measurements. The square wave anodic stripping voltammetry (SWASV) was employed to measure released metal ions from bound antibody nanocrystal conjugates. The calibration curves for three selected bacteria were found in the range of 1 × 103 – 5 × 105 cells mL−1 with the limit of detection (LOD) 400 cells mL−1 for salmonella, 400 cells mL−1 for campylobacter and 800 cells mL−1 for E. coli. The precision and sensitivity of this method show the feasibility of multiplexed determination of bacteria in milk samples.

Increasing scepticism toward potential liars: effects of existential threat on veracity judgments and the moderating role of honesty norm activation

With the present research, we investigated effects of existential threat on veracity judgments. According to several meta-analyses, people judge potentially deceptive messages of other people as true rather than as false (so-called truth bias). This judgmental bias has been shown to depend on how people weigh the error of judging a true message as a lie (error 1) and the error of judging a lie as a true message (error 2). The weight of these errors has been further shown to be affected by situational variables. Given that research on terror management theory has found evidence that mortality salience (MS) increases the sensitivity toward the compliance of cultural norms, especially when they are of focal attention, we assumed that when the honesty norm is activated, MS affects judgmental error weighing and, consequently, judgmental biases. Specifically, activating the norm of honesty should decrease the weight of error 1 (the error of judging a true message as a lie) and increase the weight of error 2 (the error of judging a lie as a true message) when mortality is salient. In a first study, we found initial evidence for this assumption. Furthermore, the change in error weighing should reduce the truth bias, automatically resulting in better detection accuracy of actual lies and worse accuracy of actual true statements. In two further studies, we manipulated MS and honesty norm activation before participants judged several videos containing actual truths or lies. Results revealed evidence for our prediction. Moreover, in Study 3, the truth bias was increased after MS when group solidarity was previously emphasized.

A genomic approach for improved detection of annual ryegrass toxicity

Annual Ryegrass Toxicity is a severe and constant threat to the Australian agricultural industry. Current diagnostic and detection strategies to predict and monitor ARGT are limited. This thesis utilised genomic-based technologies to develop improved strategies for detection of molecular indicators of toxicity in field and livestock to facilitate pre-clinical detection.

Smart RFID reader protocol for malware detection

Radio frequency identification (RFID) is a remote identification technique promises to revolutionize the way a specific object use to identify in our industry. However, large scale implementation of RFID sought for protection, against Malware threat, information privacy and un-traceability, for low cost RFID tag. In this paper, we propose a framework to provide privacy for tag data and to provide protection for RFID system from malware. In the proposed framework, malware infected tag is detected by analysing individual component of the RFID tag. It uses sanitization technique for analysing individual component. Here authentication based shared unique parameters is used as a method to protect privacy. This authentication protocol will be capable of handling forward and backward security and identifying rogue reader better than existing protocols. Using this framework, the RFID system will be protected from malware and the privacy of the tag will be ensured as well.

Keynote : Detection of and defense against distributed denial-of-service (DDoS) attacks

Distributed denial-of-service (DDoS) attacks typically exhaust bandwidth, processing capacity, or memory of a targeted machine, service or network. Despite enormous efforts in combating DDoS attacks in the past decade, DDoS attacks are still a serious threat to the security of cyberspace. In this talk I shall outline the recent efforts of my research group in detection of and defence against DDoS attacks. In particular, this talk will concentrate on the following three critical issues related to DDoS attacks: (1) Traceback of DDoS attacks; (2) Detection of low-rate DDoS attacks; and (3) Discriminating DDoS attacks from flash crowds.

Malware detection and prevention in RFID systems

The threat that malware poses to RFID systems was identified only recently. Fortunately, all currently known RFID malware is based on SQLIA. Therefore, in this chapter we propose a dual pronged, tag based SQLIA detection and prevention method optimized for RFID systems. The first technique is a SQL query matching approach that uses simple string comparisons and provides strong security against a majority of the SQLIA types possible on RFID systems. To provide security against second order SQLIA, which is a major gap in the current literature, we also propose a tag data validation and sanitization technique. The preliminary evaluation of our query matching technique is very promising, showing 100% detection rates and 0% false positives for all attacks other than second order injection.

Malicious code detection architecture inspired by human immune system

Malicious code is a threat to computer systems globally. In this paper, we outline the evolution of malicious code attacks. The threat is evolving, leaving challenges for attackers to improve attack techniques and for researchers and security specialists to improve detection accuracy. We present a novel architecture for an effective defense against malicious code attack, inspired by the human immune system. We introduce two phases of program execution: Adolescent and Mature Phase. The first phase uses a malware profile matching mechanism, whereas the second phase uses a program profile matching mechanism. Both mechanisms are analogous to the innate immune system

International study to evaluate PCR methods for detection of Trypanosoma cruzi DNA in blood samples from Chagas disease patients.

A century after its discovery, Chagas disease still represents a major neglected tropical threat. Accurate diagnostics tools as well as surrogate markers of parasitological response to treatment are research priorities in the field. The purpose of this study was to evaluate the performance of PCR methods in detection of Trypanosoma cruzi DNA by an external quality evaluation.

Assessing the economic benefits of starling detection and control to Western Australia

The common starling (Sturnus vulgaris) has a proven invasion history in many countries, and at a continental scale in North America and Australasia. In Australia, starlings are firmly established throughout the eastern states and Tasmania. Incursions of starlings into Western Australia (WA) represent a significant threat to this State’s agricultural, public amenity and biodiversity assets. We present models of starling population dynamics that incorporate environmental and control effort variability. We incorporate knowledge of starling ecology with economic data to assess the potential economic cost of starlings establishing in WA, evaluating the cost–benefits for each management scenario. We calculated starling population size will approach carrying capacity in WA within as little as 30 years if left unchecked. A population of this size could cost the WA economy up to $43.7 million annually in 2011/2012 dollars. Over a 50 year horizon, the conservative benefit–cost ratio for ongoing detection and control at the current level of expenditure is 6.03:1. However, even under current levels of control, starling numbers are projected to increase to almost 11 million by 2061. Further improvements in the efficiency of starling detection and control and/or an increased level of expenditure on detection and control are required.

Molecular and Serologic Detection of Ehrlichia spp. in Endangered Brazilian Wild Captive Felids

Ehrlichiosis, an emergent tickborne disease that affects both humans and animals, may represent a threat to the survival and preservation of wild felids in Brazil There are few studies of ehrlichiosis in wild felids in Brazil, but Ehrlichia spp are present in domestic cats Antibodies to Ehrlichia canis have been reported in a puma (Puma concolor) In this study we assessed the presence of these hemoparasites in the blood of Brazilian wild captive felids of the 72 animals tested, 5 (7%) were seropositive for the E cams antigen, and L1 (15%) were positive for E emirs DNA sequences We also performed sequence alignment to establish the identity of the parasite species infecting these animals using 16S rRNA and omp-1 genes Sequences based on 16S rRNA were similar to those found in dogs and cats from Thailand, Brazil, China, and Taiwan and with E canis obtained from a single individual (human) in Venezuela Ehrlichia sp sequence from sampled felines based on omp-1. gene was similar to the p28 and p30 multigene family of E canis To our knowledge, this is the first study of molecular detection of Ehrlichia sp in Brazilian wild feline species

Molecular detection of Hepatozoon spp. in Brazilian and exotic wild carnivores

Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP)