Zero-day malware detection based on supervised learning algorithms of API call signatures

Zero-day or unknown malware are created using code obfuscation techniques that can modify the parent code to produce offspring copies which have the same functionality but with different signatures. Current techniques reported in literature lack the capability of detecting zero-day malware with the required accuracy and efficiency. In this paper, we have proposed and evaluated a novel method of employing several data mining techniques to detect and classify zero-day malware with high levels of accuracy and efficiency based on the frequency of Windows API calls. This paper describes the methodology employed for the collection of large data sets to train the classifiers, and analyses the performance results of the various data mining algorithms adopted for the study using a fully automated tool developed in this research to conduct the various experimental investigations and evaluation. Through the performance results of these algorithms from our experimental analysis, we are able to evaluate and discuss the advantages of one data mining algorithm over the other for accurately detecting zero-day malware successfully. The data mining framework employed in this research learns through analysing the behavior of existing malicious and benign codes in large datasets. We have employed robust classifiers, namely Naïve Bayes (NB) Algorithm, k−Nearest Neighbor (kNN) Algorithm, Sequential Minimal Optimization (SMO) Algorithm with 4 differents kernels (SMO - Normalized PolyKernel, SMO – PolyKernel, SMO – Puk, and SMO- Radial Basis Function (RBF)), Backpropagation Neural Networks Algorithm, and J48 decision tree and have evaluated their performance. Overall, the automated data mining system implemented for this study has achieved high true positive (TP) rate of more than 98.5%, and low false positive (FP) rate of less than 0.025, which has not been achieved in literature so far. This is much higher than the required commercial acceptance level indicating that our novel technique is a major leap forward in detecting zero-day malware. This paper also offers future directions for researchers in exploring different aspects of obfuscations that are affecting the IT world today.

A longitudinal evaluation of a project-based learning initiative in an engineering undergraduate programme

Project-based learning (PBL) is a well-known student-centred methodology for engineering design education. The methodology claims to offer a number of educational benefits. This paper evaluates the student perceptions of the initial and second offering of a first-year design unit at Griffith University in Australia. It builds on an earlier evaluation conducted after the initial offering of the unit. It considers the implementation of the recommended changes. Evaluations of the two offerings reveal that students (in both the initial and second offering) generally enjoyed the experience, but that the second offering was found to be a significantly more enjoyable learning experience. Students in the second offering also reported a significantly better understanding of what they needed to do for the design projects and where to find the requisite information. The oral presentation aspect of the initial and second offerings received the lowest satisfaction rating. The inclusion (and delivery) of the computer-aided drawing component of the unit is seen as a positive aspect by some students, but many others comment on it negatively. The best aspects of the PBL unit and those aspects needing further improvement were similar to the findings of other investigations documented in the literature.

Exploring second life as a learning environment for computer programming

Computer programming can be challenging for beginners because of the need to understand abstract programming concepts. In this paper, we study the use of the Second Life (SL) virtual world for learning computer programming concepts. We conduct an empirical study for learning computer programming in SL by addressing affordances of SL for experiential problem-based learning pedagogies. We present preliminary findings, the promises and the limitations of Second Life as an environment for learning computer programming.

Bandit-Based Algorithms for Budgeted Learning

We explore the problem of budgeted machine learning, in which the learning algorithm has free access to the training examples’ labels but has to pay for each attribute that is specified. This learning model is appropriate in many areas, including medical applications. We present new algorithms for choosing which attributes to purchase of which examples in the budgeted learning model based on algorithms for the multi-armed bandit problem. All of our approaches outperformed the current state of the art. Furthermore, we present a new means for selecting an example to purchase after the attribute is selected, instead of selecting an example uniformly at random, which is typically done. Our new example selection method improved performance of all the algorithms we tested, both ours and those in the literature.

Network-based stochastic semisupervised learning

Semisupervised learning is a machine learning approach that is able to employ both labeled and unlabeled samples in the training process. In this paper, we propose a semisupervised data classification model based on a combined random-preferential walk of particles in a network (graph) constructed from the input dataset. The particles of the same class cooperate among themselves, while the particles of different classes compete with each other to propagate class labels to the whole network. A rigorous model definition is provided via a nonlinear stochastic dynamical system and a mathematical analysis of its behavior is carried out. A numerical validation presented in this paper confirms the theoretical predictions. An interesting feature brought by the competitive-cooperative mechanism is that the proposed model can achieve good classification rates while exhibiting low computational complexity order in comparison to other network-based semisupervised algorithms. Computer simulations conducted on synthetic and real-world datasets reveal the effectiveness of the model.

Design, implementation and evaluation of a virtual laboratory for Computer Engineering Education

Broad consensus has been reached within the Education and Cognitive Psychology research communities on the need to center the learning process on experimentation and concrete application of knowledge, rather than on a bare transfer of notions. Several advantages arise from this educational approach, ranging from the reinforce of students learning, to the increased opportunity for a student to gain greater insight into the studied topics, up to the possibility for learners to acquire practical skills and long-lasting proficiency. This is especially true in Engineering education, where integrating conceptual knowledge and practical skills assumes a strategic importance. In this scenario, learners are called to play a primary role. They are actively involved in the construction of their own knowledge, instead of passively receiving it. As a result, traditional, teacher-centered learning environments should be replaced by novel learner-centered solutions. Information and Communication Technologies enable the development of innovative solutions that provide suitable answers to the need for the availability of experimentation supports in educational context. Virtual Laboratories, Adaptive Web-Based Educational Systems and Computer-Supported Collaborative Learning environments can significantly foster different learner-centered instructional strategies, offering the opportunity to enhance personalization, individualization and cooperation. More specifically, they allow students to explore different kinds of materials, to access and compare several information sources, to face real or realistic problems and to work on authentic and multi-facet case studies. In addition, they encourage cooperation among peers and provide support through coached and scaffolded activities aimed at fostering reflection and meta-cognitive reasoning. This dissertation will guide readers within this research field, presenting both the theoretical and applicative results of a research aimed at designing an open, flexible, learner-centered virtual lab for supporting students in learning Information Security.

La didattica della traduzione specializzata dallo spagnolo in italiano: competenza traduttiva, genere testuale e nuove tecnologie

Il progetto di ricerca che presentiamo nasce dalla virtuosa combinazione di teoria e prassi didattica nello spirito della ricerca-azione. Scopo del presente lavoro è elaborare un percorso didattico di formazione alla traduzione specializzata in ambito medico-scientifico, tecnico ed economico-giuridico per la combinazione linguistica spagnolo-italiano all’interno della cornice istituzionale concreta dell’università italiana oggi. La nostra proposta formativa si fonda su tre elementi: la ricognizione del mercato attuale della traduzione per la combinazione linguistica indicata, l’individuazione degli obiettivi formativi in base al modello di competenza traduttiva scelto, l’elaborazione del percorso didattico per competenze e basato sull’enfoque por tareas di traduzione. Nella progettazione delle modalità didattiche due sono gli aspetti che definiscono il percorso proposto: il concetto di genere testuale specializzato per la traduzione e la gestione delle informazioni mediante le nuove tecnologie (corpora, banche dati terminologiche e fraseologiche, memorie di traduzione, traduzione controllata). Il presente lavoro si articola in due parti: la prima parte (quattro capitoli) presenta l’inquadramento teorico all’interno del quale si sviluppa la riflessione intorno alla didattica della traduzione specializzata; la seconda parte (due capitoli) presenta l’inquadramento metodologico e analitico all’interno del quale si elabora la nostra proposta didattica. Nel primo capitolo si illustrano i rapporti fra traduzione e mondo professionale; nel secondo capitolo si presenta il concetto di competenza traduttiva come ponte tra la formazione e il mondo della traduzione professionale; nel terzo capitolo si ripercorrono le tappe principali dell’evoluzione della didattica della traduzione generale; nel quarto capitolo illustriamo alcune tra le più recenti e complete proposte didattiche per la traduzione specializzata in ambito tecnico, medico-scientifico ed economico-giuridico. Nel quinto capitolo si introduce il concetto di genere testuale specializzato per la traduzione e nel sesto capitolo si illustra la proposta didattica per la traduzione specializzata dallo spagnolo in italiano che ha motivato il presente lavoro.

Una prospettiva storico-filosofica sull'evoluzione del curricolo di fisica nella scuola: problemi e innovazioni pedagogiche

Negli ultimi vent’anni sono state proposte al livello internazionale alcune analisi dei problemi per le scienze nella scuola e diverse strategie per l’innovazione didattica. Molte ricerche hanno fatto riferimento a una nuova nozione di literacy scientifica, quale sapere fondamentale dell’educazione, indipendente dalle scelte professionali successive alla scuola. L’ipotesi di partenza di questa ricerca sostiene che alcune di queste analisi e l’idea di una nuova literacy scientifica di tipo non-vocazionale mostrino notevoli limiti quando rapportate al contesto italiano. Le specificità di quest’ultimo sono state affrontate, innanzitutto, da un punto di vista comparativo, discutendo alcuni documenti internazionali sull’insegnamento delle scienze. Questo confronto ha messo in luce la difficoltà di ottenere un insieme di evidenze chiare e definitive sui problemi dell’educazione scientifica discussi da questi documenti, in particolare per quanto riguarda i dati sulla crisi delle vocazioni scientifiche e sull’attitudine degli studenti verso le scienze. Le raccomandazioni educative e alcuni progetti curricolari internazionali trovano degli ostacoli decisivi nella scuola superiore italiana anche a causa di specificità istituzionali, come particolari principi di selezione e l’articolazione dei vari indirizzi formativi. Il presente lavoro si è basato soprattutto su una ricostruzione storico-pedagogica del curricolo di fisica, attraverso l’analisi delle linee guida nazionali, dei programmi di studio e di alcuni rappresentativi manuali degli ultimi decenni. Questo esame del curricolo “programmato” ha messo in luce, primo, il carattere accademico della fisica liceale e la sua debole rielaborazione culturale e didattica, secondo, l’impatto di temi e problemi internazionali sui materiali didattici. Tale impatto ha prodotto dei cambiamenti sul piano delle finalità educative e degli strumenti di apprendimento incorporati nei manuali. Nonostante l’evoluzione di queste caratteristiche del curricolo, tuttavia, l’analisi delle conoscenze storico-filosofiche utilizzate dai manuali ha messo in luce la scarsa contestualizzazione culturale della fisica quale uno degli ostacoli principali per l’insegnamento di una scienza più rilevante e formativa.

Efficient ultrasonic signal processing techniques for aided medical diagnostics

Ultrasound imaging is widely used in medical diagnostics as it is the fastest, least invasive, and least expensive imaging modality. However, ultrasound images are intrinsically difficult to be interpreted. In this scenario, Computer Aided Detection (CAD) systems can be used to support physicians during diagnosis providing them a second opinion. This thesis discusses efficient ultrasound processing techniques for computer aided medical diagnostics, focusing on two major topics: (i) Ultrasound Tissue Characterization (UTC), aimed at characterizing and differentiating between healthy and diseased tissue; (ii) Ultrasound Image Segmentation (UIS), aimed at detecting the boundaries of anatomical structures to automatically measure organ dimensions and compute clinically relevant functional indices. Research on UTC produced a CAD tool for Prostate Cancer detection to improve the biopsy protocol. In particular, this thesis contributes with: (i) the development of a robust classification system; (ii) the exploitation of parallel computing on GPU for real-time performance; (iii) the introduction of both an innovative Semi-Supervised Learning algorithm and a novel supervised/semi-supervised learning scheme for CAD system training that improve system performance reducing data collection effort and avoiding collected data wasting. The tool provides physicians a risk map highlighting suspect tissue areas, allowing them to perform a lesion-directed biopsy. Clinical validation demonstrated the system validity as a diagnostic support tool and its effectiveness at reducing the number of biopsy cores requested for an accurate diagnosis. For UIS the research developed a heart disease diagnostic tool based on Real-Time 3D Echocardiography. Thesis contributions to this application are: (i) the development of an automated GPU based level-set segmentation framework for 3D images; (ii) the application of this framework to the myocardium segmentation. Experimental results showed the high efficiency and flexibility of the proposed framework. Its effectiveness as a tool for quantitative analysis of 3D cardiac morphology and function was demonstrated through clinical validation.

Ambienti innovativi per l'apprendimento: Modelli interpretativi e contributi di esperienze. Uno studio sull'organizzazione di Scuola-Città Pestalozzi a Firenze

La tesi affronta il tema dell'innovazione della scuola, oggetto di costante attenzione da parte delle organizzazioni internazionali e dei sistemi educativi nazionali, per le sue implicazioni economiche, sociali e politiche, e intende portare un contributo allo studio sistematico e analitico dei progetti e delle esperienze di innovazione complessiva dell'ambiente di apprendimento. Il concetto di ambiente di apprendimento viene approfondito nelle diverse prospettive di riferimento, con specifica attenzione al framework del progetto "Innovative Learning Environments" [ILE], dell’Organisation For Economic And Cultural Development [OECD] che, con una prospettiva dichiaratamente olistica, individua nel dispositivo dell’ambiente di apprendimento la chiave per l’innovazione dell’istruzione nella direzione delle competenze per il ventunesimo Secolo. I criteri presenti nel quadro di riferimento del progetto sono stati utilizzati per un’analisi dell’esperienza proposta come caso di studio, Scuola-Città Pestalozzi a Firenze, presa in esame perché nell’anno scolastico 2011/2012 ha messo in pratica appunto un “disegno” di trasformazione dell’ambiente di apprendimento e in particolare dei caratteri del tempo/scuola. La ricerca, condotta con una metodologia qualitativa, è stata orientata a far emergere le interpretazioni dei protagonisti dell’innovazione indagata: dall’analisi del progetto e di tutta la documentazione fornita dalla scuola è scaturita la traccia per un focus-group esplorativo attraverso il quale sono stati selezionati i temi per le interviste semistrutturate rivolte ai docenti (scuola primaria e scuola secondaria di primo grado). Per quanto concerne l’interpretazione dei risultati, le trascrizioni delle interviste sono state analizzate con un approccio fenomenografico, attraverso l’individuazione di unità testuali logicamente connesse a categorie concettuali pertinenti. L’analisi dei materiali empirici ha permesso di enucleare categorie interpretative rispetto alla natura e agli scopi delle esperienze di insegnamento/apprendimento, al processo organizzativo, alla sostenibilità. Tra le implicazioni della ricerca si ritengono particolarmente rilevanti quelle relative alla funzione docente.

Learning with Kernels on Graphs: DAG-based kernels, data streams and RNA function prediction.

In many application domains data can be naturally represented as graphs. When the application of analytical solutions for a given problem is unfeasible, machine learning techniques could be a viable way to solve the problem. Classical machine learning techniques are defined for data represented in a vectorial form. Recently some of them have been extended to deal directly with structured data. Among those techniques, kernel methods have shown promising results both from the computational complexity and the predictive performance point of view. Kernel methods allow to avoid an explicit mapping in a vectorial form relying on kernel functions, which informally are functions calculating a similarity measure between two entities. However, the definition of good kernels for graphs is a challenging problem because of the difficulty to find a good tradeoff between computational complexity and expressiveness. Another problem we face is learning on data streams, where a potentially unbounded sequence of data is generated by some sources. There are three main contributions in this thesis. The first contribution is the definition of a new family of kernels for graphs based on Directed Acyclic Graphs (DAGs). We analyzed two kernels from this family, achieving state-of-the-art results from both the computational and the classification point of view on real-world datasets. The second contribution consists in making the application of learning algorithms for streams of graphs feasible. Moreover,we defined a principled way for the memory management. The third contribution is the application of machine learning techniques for structured data to non-coding RNA function prediction. In this setting, the secondary structure is thought to carry relevant information. However, existing methods considering the secondary structure have prohibitively high computational complexity. We propose to apply kernel methods on this domain, obtaining state-of-the-art results.

Studio longitudinale sulle capacità cognitive del cane: discriminazione di quantità ed apprendimento per imitazione in relazione all'attaccamento

Il presente studio ha indagato e valutato alcune abilità cognitive del cane: la capacità di discriminare quantità e le capacità di apprendimento mediante imitazione; quest’ultima è poi stata messa in relazione con l’attaccamento nei confronti del proprietario. Per l’esecuzione della prima indagine sono stati messi appunto due test: il primo si è basato esclusivamente sulla presentazione di uno stimolo visivo: diversi quantitativi di cibo, differenti tra loro del 50%, sono stati presentati al cane; la scelta effettuata dai soggetti testati è stata premiata con differenti tipi di rinforzo differenziale o non differenziale. Il secondo test è stato diviso in due parti: sono stati presentati al cane diversi quantitativi di cibo sempre differenti tra loro del 50% ma nella prima parte del test l’input sensoriale per il cane è stato esclusivamente uditivo mentre nella seconda parte è stato sia uditivo che visivo. Ove è stato possibile è stato applicato ai cani un cardiofrequenzimetro al fine di eseguire una valutazione delle variazioni della frequenza cardiaca nel corso del test. Lo scopo è stato quello di valutare se i soggetti testati erano in grado di discriminare la quantità maggiore. La seconda indagine ha analizzato le capacità di apprendimento di 36 soggetti che sono stati suddivisi in cani da lavoro e pet. I soggetti protagonisti dello studio hanno eseguito il Mirror Test per la valutazione dell’apprendimento per imitazione. I soggetti presi in considerazione, sono stati sottoposti a scansione termografica all’inizio ed al termine del test ed è stata rilevata la loro frequenza respiratoria nella fase iniziale e finale del test. In 11 soggetti che hanno eseguito il precedente test è stato possibile eseguire anche il Strange Situation Test per la valutazione dell’attaccamento al proprietario; i test in questione sono stati videoregistrati ed analizzati per mezzo di un software preposto (OBSERVER XT 10).

Deep learning for computer vision: a comparison between convolutional neural networks and hierarchical temporal memories on object recognition tasks

In recent years, Deep Learning techniques have shown to perform well on a large variety of problems both in Computer Vision and Natural Language Processing, reaching and often surpassing the state of the art on many tasks. The rise of deep learning is also revolutionizing the entire field of Machine Learning and Pattern Recognition pushing forward the concepts of automatic feature extraction and unsupervised learning in general. However, despite the strong success both in science and business, deep learning has its own limitations. It is often questioned if such techniques are only some kind of brute-force statistical approaches and if they can only work in the context of High Performance Computing with tons of data. Another important question is whether they are really biologically inspired, as claimed in certain cases, and if they can scale well in terms of "intelligence". The dissertation is focused on trying to answer these key questions in the context of Computer Vision and, in particular, Object Recognition, a task that has been heavily revolutionized by recent advances in the field. Practically speaking, these answers are based on an exhaustive comparison between two, very different, deep learning techniques on the aforementioned task: Convolutional Neural Network (CNN) and Hierarchical Temporal memory (HTM). They stand for two different approaches and points of view within the big hat of deep learning and are the best choices to understand and point out strengths and weaknesses of each of them. CNN is considered one of the most classic and powerful supervised methods used today in machine learning and pattern recognition, especially in object recognition. CNNs are well received and accepted by the scientific community and are already deployed in large corporation like Google and Facebook for solving face recognition and image auto-tagging problems. HTM, on the other hand, is known as a new emerging paradigm and a new meanly-unsupervised method, that is more biologically inspired. It tries to gain more insights from the computational neuroscience community in order to incorporate concepts like time, context and attention during the learning process which are typical of the human brain. In the end, the thesis is supposed to prove that in certain cases, with a lower quantity of data, HTM can outperform CNN.

Estimates of Use of Research-Based Instructional Strategies in Core Electrical or Computer Engineering Courses

Many research-based instruction strategies (RBISs) have been developed; their superior efficacy with respect to student learning has been demonstrated in many studies. Collecting and interpreting evidence about: 1) the extent to which electrical and computer engineering (ECE) faculty members are using RBISs in core, required engineering science courses, and 2) concerns that they express about using them, are important aspects of understanding how engineering education is evolving. The authors surveyed ECE faculty members, asking about their awareness and use of selected RBISs. The survey also asked what concerns ECE faculty members had about using RBISs. Respondent data showed that awareness of RBISs was very high, but estimates of use of RBISs, based on survey data, varied from 10% to 70%, depending on characteristics of the strategy. The most significant concern was the amount of class time that using an RBIS might take; efforts to increase use of RBISs must address this.