Context-sensitive analysis of obfuscated x86 executables

A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in 'calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart. Copyright © 2010 ACM.

Detailed analysis of a conservative difference approximation for the time fractional diffusion equation

Diffusion equations that use time fractional derivatives are attractive because they describe a wealth of problems involving non-Markovian Random walks. The time fractional diffusion equation (TFDE) is obtained from the standard diffusion equation by replacing the first-order time derivative with a fractional derivative of order α ∈ (0, 1). Developing numerical methods for solving fractional partial differential equations is a new research field and the theoretical analysis of the numerical methods associated with them is not fully developed. In this paper an explicit conservative difference approximation (ECDA) for TFDE is proposed. We give a detailed analysis for this ECDA and generate discrete models of random walk suitable for simulating random variables whose spatial probability density evolves in time according to this fractional diffusion equation. The stability and convergence of the ECDA for TFDE in a bounded domain are discussed. Finally, some numerical examples are presented to show the application of the present technique.

Reducing the global burden of depression : population level analysis of intervention cost-effectiveness in 14 world regions

International evidence on the cost and effects of interventions for reducing the global burden of depression remain scarce. Aims: To estimate the population-level cost-effectiveness of evidence-based depression interventions and their contribution towards reducing current burden. Method: Primary-care-based depression interventions were modelled at the level of whole populations in 14 epidemiological subregions of the world. Total population-level costs (in international dollars or I$) and effectiveness (disability adjusted life years (DALYs) averted) were combined to form average and incremental cost-effectiveness ratios. Results: Evaluated interventions have the potential to reduce the current burden of depression by 10–30%. Pharmacotherapy with older antidepressant drugs, with or without proactive collaborative care, are currently more cost-effective strategies than those using newer antidepressants, particularly in lower-income subregions. Conclusions: Even in resource-poor regions, each DALYaverted by efficient depression treatments in primary care costs less than 1 year of average per capita income, making such interventions a cost-effective use of health resources. However, current levels of burden can only be reduced significantlyif there is a substantialincrease substantial increase intreatment coverage.