Context-sensitive analysis of obfuscated x86 executables

A method for context-sensitive analysis of binaries that may have obfuscated procedure call and return operations is presented. Such binaries may use operators to directly manipulate stack instead of using native call and ret instructions to achieve equivalent behavior. Since definition of context-sensitivity and algorithms for context-sensitive analysis have thus far been based on the specific semantics associated to procedure call and return operations, classic interprocedural analyses cannot be used reliably for analyzing programs in which these operations cannot be discerned. A new notion of context-sensitivity is introduced that is based on the state of the stack at any instruction. While changes in 'calling'-context are associated with transfer of control, and hence can be reasoned in terms of paths in an interprocedural control flow graph (ICFG), the same is not true of changes in 'stack'-context. An abstract interpretation based framework is developed to reason about stack-contexts and to derive analogues of call-strings based methods for the context-sensitive analysis using stack-context. The method presented is used to create a context-sensitive version of Venable et al.'s algorithm for detecting obfuscated calls. Experimental results show that the context-sensitive version of the algorithm generates more precise results and is also computationally more efficient than its context-insensitive counterpart. Copyright © 2010 ACM.

Context-sensitive analysis of x86 obfuscated executables

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

A Time-Series Analysis of the H alpha Emission Line in V3885 Sagitarii

Flickering is a phenomenon related to mass accretion observed among many classes of astrophysical objects. In this paper we present a study of flickering emission lines and the continuum of the cataclysmic variable V3885 Sgr. The flickering behavior was first analyzed through statistical analysis and the power spectra of lightcurves. Autocorrelation techniques were then employed to estimate the flickering timescale of flares. A cross-correlation study between the line and its underlying continuum variability is presented. The cross-correlation between the photometric and spectroscopic data is also discussed. Periodograms, calculated using emission-line data, show a behavior that is similar to those obtained from photometric datasets found in the literature, with a plateau at lower frequencies and a power-law at higher frequencies. The power-law index is consistent with stochastic events. The cross-correlation study indicates the presence of a correlation between the variability on Ha and its underlying continuum. Flickering timescales derived from the photometric data were estimated to be 25 min for two lightcurves and 10 min for one of them. The average timescales of the line flickering is 40 min, while for its underlying continuum it drops to 20 min.

Detailed analysis of a conservative difference approximation for the time fractional diffusion equation

Diffusion equations that use time fractional derivatives are attractive because they describe a wealth of problems involving non-Markovian Random walks. The time fractional diffusion equation (TFDE) is obtained from the standard diffusion equation by replacing the first-order time derivative with a fractional derivative of order α ∈ (0, 1). Developing numerical methods for solving fractional partial differential equations is a new research field and the theoretical analysis of the numerical methods associated with them is not fully developed. In this paper an explicit conservative difference approximation (ECDA) for TFDE is proposed. We give a detailed analysis for this ECDA and generate discrete models of random walk suitable for simulating random variables whose spatial probability density evolves in time according to this fractional diffusion equation. The stability and convergence of the ECDA for TFDE in a bounded domain are discussed. Finally, some numerical examples are presented to show the application of the present technique.

Reducing the global burden of depression : population level analysis of intervention cost-effectiveness in 14 world regions

International evidence on the cost and effects of interventions for reducing the global burden of depression remain scarce. Aims: To estimate the population-level cost-effectiveness of evidence-based depression interventions and their contribution towards reducing current burden. Method: Primary-care-based depression interventions were modelled at the level of whole populations in 14 epidemiological subregions of the world. Total population-level costs (in international dollars or I$) and effectiveness (disability adjusted life years (DALYs) averted) were combined to form average and incremental cost-effectiveness ratios. Results: Evaluated interventions have the potential to reduce the current burden of depression by 10–30%. Pharmacotherapy with older antidepressant drugs, with or without proactive collaborative care, are currently more cost-effective strategies than those using newer antidepressants, particularly in lower-income subregions. Conclusions: Even in resource-poor regions, each DALYaverted by efficient depression treatments in primary care costs less than 1 year of average per capita income, making such interventions a cost-effective use of health resources. However, current levels of burden can only be reduced significantlyif there is a substantialincrease substantial increase intreatment coverage.