Search

This thesis examines the phenomenon of sell-side financial analysts (analysts hereafter) "doing" corporate governance. The term "doing" is used in the current study to designate the various ways in which some analysts in the US and the UK, across the past decade or so, have made corporate governance visible. The thesis examines how this has occurred, and the mechanisms and devices that have made it possible. Analysts, it is suggested, can be viewed as "agents of transparency", in so far as they have taken the evaluation of companies beyond the financials, to include corporate governance issues. The thesis focuses primarily on the corporate governance reports produced by analysts, the official documents issued by various organisations and institutions, selected financial and business newspapers and magazines, together with other documents such as textbooks of corporate governance, as well as academic and practioner publications on corporate governance. Through an examination of these materials, the thesis investigates the pre-conditions that made possible the appearance and development of the corporate governance work pursued by analysts in the early twenty-first century. It examines the evaluations performed by analysts of the corporate governance procedures adopted by companies. In particular, it focuses on the ways in which analysts benchmarked the corporate governance procedures of companies against formal regulations, and how comparisons of the governance procedures adopted by different companies were undertaken and facilitated by analysts. Benchmarking, and the making of comparisons of corporate governance practices through a range of devices, are examined. The thesis also examines the linking of corporate governance to the financials (such as profitability, stock price performance, and equity valuation) in the investment analyses performed by analysts. It concentrates on the way in which analysts integrated corporate governance issues in the investment decision making process. Attention is paid to the ideas that shaped and articulated the integration, as well as to the tools and devices deployed by analysts. This thesis argues that greater attention is needed to the "doing" of corporate governance by analysts, and its implications for these "agents of transparency" that have broadened the parameters through which transparency is assessed.

In recent times, malware detection and analysis are becoming key issues. A dangerous class of malware is metamorphic malware which is capable of modifying its own code and hiding malicious instructions within normal program code. Current malware detectors are susceptible to metamorphic malware as they are pre-trained to recognize only predicted versions of code. However, if detectors could be trained on a larger set of data that included potential mutant variants, they could be more accurate. The task of finding new evasive variants is challenging - many variants might exist. In this research, a two-phase system is proposed. First, a mutation only Evolutionary Algorithm (EA) is used to search for a diverse set of new, malicious mutants, that evade detection by existing detection algorithms. While this is shown to be successful, it requires multiple runs of the algorithm to produce multiple variants without explicit guarantee of diversity. To address this, a Quality Diversity (QD) algorithm - MAP-Elites, that traverses a high-dimensional search space in search of the best solution at every point of a feature space with low dimension, is then developed to return a large and diverse repertoire of solutions in a single run. This method produces a larger and more diverse archive of solutions than the mutation only Evolutionary Algorithm (EA) and sheds insight into the properties of a sample that lead to them being undetectable by a suite of existing detection engines. Having created a set of evasive and diverse variants, detectors are then trained using a set of classical classification methods (feature-based and sequence-based models) with results showing that classification of metamorphic malware can be improved by augmenting training data with the diverse set of evolved variant samples. This also includes the use of a pretrained Natural Language Processing (NLP) model in a transfer learning setting to show improved classification of metamorphic malware, using the evolved variants as part of the training data.

Malicious agents increasingly use encrypted tunnels to communicate with external servers. Communications may contain ransomware keys, stolen banking details, or other confidential information. Rapid discovery of communicated contents through decrypting tunnelled traffic can support effective means of dealing with these malicious activities. Decrypting communications requires knowledge of cryptographic algorithms and artefacts, such as encryption keys and initialisation vectors. Such artefacts may exist in volatile memory when software applications encrypt. Virtualisation technologies can enable the acquisition of virtual machine memory to support the discovery of these cryptographic artefacts. A framework is constructed to investigate the decryption of potentially malicious communications using novel approaches to identify candidate initialisation vectors, and use these to discover candidate keys. The framework focuses on communications that use the Secure Shell and Transport Layer Security protocols in virtualised environments for different operating systems, protocols, encryption algorithms, and software implementations. The framework minimises virtual machine impact, and functions at an elevated level to make detection by virtual machine software difficult. The framework analyses Windows and Linux memory and validates decrypts for both protocols when the Advanced Encryption Standard symmetric block or ChaCha20 symmetric stream algorithms are used for encryption. It also investigates communications originating from malware clients, such as bot and ransomware, that use Windows cryptographic libraries. The framework correctly decrypted tunnelled traffic with near certainty in almost all experiments. The analysis durations ranged from sub-second to less than a minute, demonstrating that decryption of malicious activity before network session completion is possible. This can enable in-line detection of unknown malicious agents, timely discovery of ransomware keys, and knowledge of exfiltrated confidential information.