Design and implementation of robust systems for secure malware detection

Malicious software (malware) have significantly increased in terms of number and effectiveness during the past years. Until 2006, such software were mostly used to disrupt network infrastructures or to show coders’ skills. Nowadays, malware constitute a very important source of economical profit, and are very difficult to detect. Thousands of novel variants are released every day, and modern obfuscation techniques are used to ensure that signature-based anti-malware systems are not able to detect such threats. This tendency has also appeared on mobile devices, with Android being the most targeted platform. To counteract this phenomenon, a lot of approaches have been developed by the scientific community that attempt to increase the resilience of anti-malware systems. Most of these approaches rely on machine learning, and have become very popular also in commercial applications. However, attackers are now knowledgeable about these systems, and have started preparing their countermeasures. This has lead to an arms race between attackers and developers. Novel systems are progressively built to tackle the attacks that get more and more sophisticated. For this reason, a necessity grows for the developers to anticipate the attackers’ moves. This means that defense systems should be built proactively, i.e., by introducing some security design principles in their development. The main goal of this work is showing that such proactive approach can be employed on a number of case studies. To do so, I adopted a global methodology that can be divided in two steps. First, understanding what are the vulnerabilities of current state-of-the-art systems (this anticipates the attacker’s moves). Then, developing novel systems that are robust to these attacks, or suggesting research guidelines with which current systems can be improved. This work presents two main case studies, concerning the detection of PDF and Android malware. The idea is showing that a proactive approach can be applied both on the X86 and mobile world. The contributions provided on this two case studies are multifolded. With respect to PDF files, I first develop novel attacks that can empirically and optimally evade current state-of-the-art detectors. Then, I propose possible solutions with which it is possible to increase the robustness of such detectors against known and novel attacks. With respect to the Android case study, I first show how current signature-based tools and academically developed systems are weak against empirical obfuscation attacks, which can be easily employed without particular knowledge of the targeted systems. Then, I examine a possible strategy to build a machine learning detector that is robust against both empirical obfuscation and optimal attacks. Finally, I will show how proactive approaches can be also employed to develop systems that are not aimed at detecting malware, such as mobile fingerprinting systems. In particular, I propose a methodology to build a powerful mobile fingerprinting system, and examine possible attacks with which users might be able to evade it, thus preserving their privacy. To provide the aforementioned contributions, I co-developed (with the cooperation of the researchers at PRALab and Ruhr-Universität Bochum) various systems: a library to perform optimal attacks against machine learning systems (AdversariaLib), a framework for automatically obfuscating Android applications, a system to the robust detection of Javascript malware inside PDF files (LuxOR), a robust machine learning system to the detection of Android malware, and a system to fingerprint mobile devices. I also contributed to develop Android PRAGuard, a dataset containing a lot of empirical obfuscation attacks against the Android platform. Finally, I entirely developed Slayer NEO, an evolution of a previous system to the detection of PDF malware. The results attained by using the aforementioned tools show that it is possible to proactively build systems that predict possible evasion attacks. This suggests that a proactive approach is crucial to build systems that provide concrete security against general and evasion attacks.

The development of learner autonomy through Internet resources and its impact on English language attainment

Wydział Neofilologii: Instytut Filologii Angielskiej

Current Issues in Teacher Autonomy

This paper provides a review of a selection of the literature in the field of English foreign language teaching related to teacher autonomy. The focus is on the core themes recurring in the literature, which comprise: rationale for teacher autonomy, definitions of the concept, descriptions of an autonomous teacher, recognition of the constraints on autonomy and suggestions for teacher education promoting teacher autonomy.

Segmenting Foreground Objects from a Dynamic Textured Background via a Robust Kalman Filter

The algorithm presented in this paper aims to segment the foreground objects in video (e.g., people) given time-varying, textured backgrounds. Examples of time-varying backgrounds include waves on water, clouds moving, trees waving in the wind, automobile traffic, moving crowds, escalators, etc. We have developed a novel foreground-background segmentation algorithm that explicitly accounts for the non-stationary nature and clutter-like appearance of many dynamic textures. The dynamic texture is modeled by an Autoregressive Moving Average Model (ARMA). A robust Kalman filter algorithm iteratively estimates the intrinsic appearance of the dynamic texture, as well as the regions of the foreground objects. Preliminary experiments with this method have demonstrated promising results.

Robust Tracking of Human Motion

This technical report presents a combined solution for two problems, one: tracking objects in 3D space and estimating their trajectories and second: computing the similarity between previously estimated trajectories and clustering them using the similarities that we just computed. For the first part, trajectories are estimated using an EKF formulation that will provide the 3D trajectory up to a constant. To improve accuracy, when occlusions appear, multiple hypotheses are followed. For the second problem we compute the distances between trajectories using a similarity based on LCSS formulation. Similarities are computed between projections of trajectories on coordinate axes. Finally we group trajectories together based on previously computed distances, using a clustering algorithm. To check the validity of our approach, several experiments using real data were performed.

Visible Volume: a Robust Measure for Protein Structure Characterization

We propose a new characterization of protein structure based on the natural tetrahedral geometry of the β carbon and a new geometric measure of structural similarity, called visible volume. In our model, the side-chains are replaced by an ideal tetrahedron, the orientation of which is fixed with respect to the backbone and corresponds to the preferred rotamer directions. Visible volume is a measure of the non-occluded empty space surrounding each residue position after the side-chains have been removed. It is a robust, parameter-free, locally-computed quantity that accounts for many of the spatial constraints that are of relevance to the corresponding position in the native structure. When computing visible volume, we ignore the nature of both the residue observed at each site and the ones surrounding it. We focus instead on the space that, together, these residues could occupy. By doing so, we are able to quantify a new kind of invariance beyond the apparent variations in protein families, namely, the conservation of the physical space available at structurally equivalent positions for side-chain packing. Corresponding positions in native structures are likely to be of interest in protein structure prediction, protein design, and homology modeling. Visible volume is related to the degree of exposure of a residue position and to the actual rotamers in native proteins. In this article, we discuss the properties of this new measure, namely, its robustness with respect to both crystallographic uncertainties and naturally occurring variations in atomic coordinates, and the remarkable fact that it is essentially independent of the choice of the parameters used in calculating it. We also show how visible volume can be used to align protein structures, to identify structurally equivalent positions that are conserved in a family of proteins, and to single out positions in a protein that are likely to be of biological interest. These properties qualify visible volume as a powerful tool in a variety of applications, from the detailed analysis of protein structure to homology modeling, protein structural alignment, and the definition of better scoring functions for threading purposes.

Head Tracking via Robust Registration in Texture Map Images

A novel method for 3D head tracking in the presence of large head rotations and facial expression changes is described. Tracking is formulated in terms of color image registration in the texture map of a 3D surface model. Model appearance is recursively updated via image mosaicking in the texture map as the head orientation varies. The resulting dynamic texture map provides a stabilized view of the face that can be used as input to many existing 2D techniques for face recognition, facial expressions analysis, lip reading, and eye tracking. Parameters are estimated via a robust minimization procedure; this provides robustness to occlusions, wrinkles, shadows, and specular highlights. The system was tested on a variety of sequences taken with low quality, uncalibrated video cameras. Experimental results are reported.

Robust Identification of Shared Losses Using End-to-End Unicast Probes

ERRATA: We present corrections to Fact 3 and (as a consequence) to Lemma 1 of BUCS Technical Report BUCS-TR-2000-013 (also published in IEEE INCP'2000)[1]. These corrections result in slight changes to the formulae used for the identifications of shared losses, which we quantify.

An Improved Robust Fuzzy Extractor

We consider the problem of building robust fuzzy extractors, which allow two parties holding similar random variables W, W' to agree on a secret key R in the presence of an active adversary. Robust fuzzy extractors were defined by Dodis et al. in Crypto 2006 [6] to be noninteractive, i.e., only one message P, which can be modified by an unbounded adversary, can pass from one party to the other. This allows them to be used by a single party at different points in time (e.g., for key recovery or biometric authentication), but also presents an additional challenge: what if R is used, and thus possibly observed by the adversary, before the adversary has a chance to modify P. Fuzzy extractors secure against such a strong attack are called post-application robust. We construct a fuzzy extractor with post-application robustness that extracts a shared secret key of up to (2m−n)/2 bits (depending on error-tolerance and security parameters), where n is the bit-length and m is the entropy of W . The previously best known result, also of Dodis et al., [6] extracted up to (2m − n)/3 bits (depending on the same parameters).

Robust Identification of Shared Losses Using End-to-End Unicast Probes

Current Internet transport protocols make end-to-end measurements and maintain per-connection state to regulate the use of shared network resources. When two or more such connections share a common endpoint, there is an opportunity to correlate the end-to-end measurements made by these protocols to better diagnose and control the use of shared resources. We develop packet probing techniques to determine whether a pair of connections experience shared congestion. Correct, efficient diagnoses could enable new techniques for aggregate congestion control, QoS admission control, connection scheduling and mirror site selection. Our extensive simulation results demonstrate that the conditional (Bayesian) probing approach we employ provides superior accuracy, converges faster, and tolerates a wider range of network conditions than recently proposed memoryless (Markovian) probing approaches for addressing this opportunity.

Robust Sketching and Aggregation of Distributed Data Streams

The data streaming model provides an attractive framework for one-pass summarization of massive data sets at a single observation point. However, in an environment where multiple data streams arrive at a set of distributed observation points, sketches must be computed remotely and then must be aggregated through a hierarchy before queries may be conducted. As a result, many sketch-based methods for the single stream case do not apply directly, as either the error introduced becomes large, or because the methods assume that the streams are non-overlapping. These limitations hinder the application of these techniques to practical problems in network traffic monitoring and aggregation in sensor networks. To address this, we develop a general framework for evaluating and enabling robust computation of duplicate-sensitive aggregate functions (e.g., SUM and QUANTILE), over data produced by distributed sources. We instantiate our approach by augmenting the Count-Min and Quantile-Digest sketches to apply in this distributed setting, and analyze their performance. We conclude with experimental evaluation to validate our analysis.

Clinical autonomy and nurse/physician collaboration in emergency nurses

Aim: To investigate clinical autonomy and Nurse/Physician collaboration among emergency nurses and the relationship between these concepts, personal characteristics and organisational influences. Background: Nurses have been identified as having a significant role in addressing the challenges of providing modern healthcare. Emergency nurses have reported competence in a wide range of emergency care skills. However, there is evidence that Emergency Department (ED) nurses may have lower levels of clinical autonomy than other areas of practice. Levels of clinical autonomy appear to be influenced by levels of collaboration with physicians and the organisations in which nurses work Methods: A descriptive correlational study using a survey design with a purposive convenience sample of 141 ED staff nurses (response 70.9%) from 3 EDs in Ireland. Data were collected using the Dempster Practice Behaviours Scale (DPBS) the Nurse/Physician Collaboration Scale (NPCS) and the newly developed Organisational Influences on Nursing Scale. Demographic information was also sought from participants. Results: Participants were largely female (87%), relatively young (mean age 35.57, SD=7.83) and educated to degree level (48%) or higher (31%) with 40% posessing specialist emergency nursing qualifications. Participants reported moderate levels of clinical autonomy and Nurse/Physician collaboration. No relationships were found between sample characteristics and clinical autonomy and Nurse/Physician collaboration among emergency nurses. Relationships were found between levels of clinical autonomy and Nurse/Physician collaboration (r=-0.395, n=100, p<0.001), and organisational influence on nursing (r=0.455, p<0.001) and also between Nurse/Physician collaboration and organisational influence on nursing (r=-0.413, p<0.001). Discussion: Clinical autonomy of nurses has been linked with quality outcomes in healthcare. The quest for quality in modern healthcare in a challenging environment should acknowledge that strategies need to focus beyond education and skills provision and include essential elements such as Nurse/Physician collaboration and the organisational influence on nursing to ensure the greater involvement of nurses in patient care.

"Ladyes, damesels, and jantilwomen": female autonomy and authority in Sir Thomas Malory's Morte Darthur

Popular medieval English romances were composed and received within the social consciousness of a distinctly patriarchal culture. This study examines the way in which the dynamic of these texts is significantly influenced by the consequences of female endeavour, in the context of an autonomous feminine presence in both the real and imagined worlds of medieval England, and the authority with which this is presented in various narratives, with a particular focus on Sir Thomas Malory’s Morte Darthur. Chapter One of this study establishes the social and economic positioning of the female in fifteenth-century England, and her capacity for literary engagement; I will then apply this model of female autonomy and authority to a wider discussion of texts contemporary with Malory in Chapters Two and Three, in anticipation of a more detailed study of Le Morte Darthur in Chapters Four and Five. My research explores the female presence and influence in these texts according to certain types: namely the lover, the victim, the ruler, and the temptress. In the case of Malory, the crux of my observations centres on the paradox of the capacity for power in perceived vulnerability, incorporating the presentation of women in this patriarchal culture as being vulnerable and in need of protection, while simultaneously acting as a significant threat to chivalric society by manipulating this apparent fragility, to the detriment of the chivalric knight. In this sense, women can be perceived as being an architect of the romance world, while simultaneously acting as its saboteur. In essence, this study offers an innovative interpretation of female autonomy and authority in medieval romance, presenting an exploration of the physical, intellectual, and emotional placement of women in both the historical and literary worlds of fifteenth-century England, while examining the implications of female conduct on Malory’s Arthurian society.

Insertion of metal oxides into block copolymer nanopatterns as robust etch masks for nanolithography

Directed self-assembly (DSA) of block copolymers (BCPs) is a prime candidate to further extend dimensional scaling of silicon integrated circuit features for the nanoelectronic industry. Top-down optical techniques employed for photoresist patterning are predicted to reach an endpoint due to diffraction limits. Additionally, the prohibitive costs for “fabs” and high volume manufacturing tools are issues that have led the search for alternative complementary patterning processes. This thesis reports the fabrication of semiconductor features from nanoscale on-chip etch masks using “high χ” BCP materials. Fabrication of silicon and germanium nanofins via metal-oxide enhanced BCP on-chip etch masks that might be of importance for future Fin-field effect transistor (FinFETs) application are detailed.

Robust test method for time-course microarray experiments.

BACKGROUND: In a time-course microarray experiment, the expression level for each gene is observed across a number of time-points in order to characterize the temporal trajectories of the gene-expression profiles. For many of these experiments, the scientific aim is the identification of genes for which the trajectories depend on an experimental or phenotypic factor. There is an extensive recent body of literature on statistical methodology for addressing this analytical problem. Most of the existing methods are based on estimating the time-course trajectories using parametric or non-parametric mean regression methods. The sensitivity of these regression methods to outliers, an issue that is well documented in the statistical literature, should be of concern when analyzing microarray data. RESULTS: In this paper, we propose a robust testing method for identifying genes whose expression time profiles depend on a factor. Furthermore, we propose a multiple testing procedure to adjust for multiplicity. CONCLUSIONS: Through an extensive simulation study, we will illustrate the performance of our method. Finally, we will report the results from applying our method to a case study and discussing potential extensions.