Search

In recent years, with the development of the Internet, the attribution classification of APT malware remains an important issue in society. Existing methods have yet to consider the DLL link library and hidden file address during the execution process, and there are shortcomings in capturing the local and global correlation of event behaviors. Compared to the structural features of binary code, opcode features reflect the runtime instructions and do not consider the issue of multiple reuse of local operation behaviors within the same APT organization. Obfuscation techniques more easily influence attribution classification based on single features. To address the above issues, (1) an event behavior graph based on API instructions and related operations is constructed to capture the execution traces on the host using the GNNs model. (2) ImageCNTM captures the local spatial correlation and continuous long-term dependency of opcode images. (3) The word frequency and behavior features are concatenated and fused, proposing a multi-feature, multi-input deep learning model. We collected a publicly available dataset of APT malware to evaluate our method. The attribution classification results of the model based on a single feature reached 89.24% and 91.91%. Finally, compared to single-feature classifiers, the multi-feature fusion model achieves better classification performance. [ABSTRACT FROM AUTHOR]

Binary code similarity detection plays a crucial role in various applications within binary security, including vulnerability detection, malicious software analysis, etc. However, existing methods suffer from limited differentiation in binary embedding representations across different compilation environments, lacking dynamic high-level semantics. Moreover, current approaches often neglect multi-level semantic feature extraction, thereby failing to acquire precise semantic information about the binary code. To address these limitations, this paper introduces a novel detection solution called BinBcla. This method employs an enhanced pre-training model to generate instruction embeddings with dynamic semantics for binary functions. Subsequently, multi-feature fusion technique is utilized to extract local semantic information and long-distance global features from the code, respectively, employing self-attention to comprehend the structure information of the code. Finally, an improved cosine similarity method is employed to learn relationships among all elements of the distance vectors, thereby enhancing the model's robustness to new sample functions. Experiments are conducted across different architectures, compilers, and optimization levels. The results indicate that BinBcla achieves higher accuracy, precision and F1 score compared to existing methods. [ABSTRACT FROM AUTHOR]

Aiming at the problem of fast certification for a constrained iris in the same category caused by the unstable iris features caused by the change of the iris acquisition environment and shooting status under lightweight training samples, a one-to-one fast certification algorithm for constrained unsteady-state iris based on the scale change stable feature and multi-algorithm voting is proposed. Scale change stable features are found by constructing an isometric differential Gaussian space, and a local binary pattern algorithm with extended statistics (ES-LBP), the Haar wavelet with over threshold detection and the Gabor filter algorithm with immune particle swarm optimization (IPSO) are used to represent the stable features as binary feature codes. Iris certification is performed by the Hamming distance. According to the certification results of three algorithms, the final result is obtained by multi-algorithm voting. Experiments with the JLU and CASIA iris libraries under the iris prerequisite conditions show that the correct recognition rate of this algorithm can reach a high level of 98% or more, indicating that this algorithm can improve the operation speed, accuracy and robustness of certification. [ABSTRACT FROM AUTHOR]

With the widespread of multicore systems, automatic parallelization becomes more pronounced, particularly for legacy programs, where the source code is not generally available. An essential operation in any parallelization system is detecting data dependence among parallelization candidate instructions. Conducting dependence analysis at the binary-level is more challenging than that at the source-level due to the much lower semantics of the binary code. In this paper, we consider using the elaborate 'static' analysis of abstract interpretation, for the first time, at runtime for data dependence detection. Specifically, our system interprets instructions at a hot region, while at the same time, collect programs semantics for seen program points, thereby conducting abstract interpretation analysis dynamically. The analysis is guaranteed to be correct as long as execution does not exit the region prematurely. Moreover, successive hot region re-entries will resume previous analysis, albeit much faster in case no major change in the program semantics. Such approach provides for more rigorous analysis than other simple dynamic analysis which would typically miss parallelization opportunities. The proposed approach also does not require any hardware support, availability of the source code, as well as any code re-compilation. To study the performance and accuracy of our approach, we have extended the Padrone dynamic code modification framework, and conduct an initial study on a set of PolyBench kernels and selected programs from SPEC CPU. Experimental results show accurate dependence detection with low overhead. [ABSTRACT FROM AUTHOR]

The olfactory system faces the difficult task of identifying an enormous variety of odors independent of their intensity. Primacy coding, where the odor identity is encoded by the receptor types that respond earliest, might provide a compact and informative representation that can be interpreted efficiently by the brain. In this paper, we analyze the information transmitted by a simple model of primacy coding using numerical simulations and statistical descriptions. We show that the encoded information depends strongly on the number of receptor types included in the primacy representation, but only weakly on the size of the receptor repertoire. The representation is independent of the odor intensity and the transmitted information is useful to perform typical olfactory tasks with close to experimentally measured performance. Interestingly, we find situations in which a smaller receptor repertoire is advantageous for discriminating odors. The model also suggests that overly sensitive receptor types could dominate the entire response and make the whole array useless, which allows us to predict how receptor arrays need to adapt to stay useful during environmental changes. Taken together, we show that primacy coding is more useful than simple binary and normalized coding, essentially because the sparsity of the odor representations is independent of the odor statistics, in contrast to the alternatives. Primacy coding thus provides an efficient odor representation that is independent of the odor intensity and might thus help to identify odors in the olfactory cortex. [ABSTRACT FROM AUTHOR]

Item co-occurrence is an important pattern in recommendation. Due to the difference in correlation, the matching degrees between the target and historical items vary. The higher the matching degree, the greater probability they co-occur. Recently, the recommendation performance has been greatly improved by leveraging item relations. As an important bond imposed by relations, these connected items should have a strong correlation in the calculation of certain measures. This kind of correlation can be the biased knowledge that benefits parameter training. Specifically, we focus on tuples containing the target item and latest relational items that have relations such as complement or substitute with the target item in user's behavior sequence. Such close relations mean the matching degrees between relational items and historical items should be highly affected by that of the target item and historical items. For example, given a relational item having relation complement with the target item, if the target item has high matching degrees with some items in user's behavior sequence, this complementary item should behave similarly for the co-occurrence of complementary items. Under guidance of the above thought, in this work, we propose a target-relation regulated mechanism which converts the biased knowledge of high correlation of matching degrees into a regulation. It integrates the target item and relational items in history as a whole to characterize the matching score between the target item and historical items. Experiments conducted on three real-world datasets demonstrate that our model can significantly outperform a set of state-of-the-art models. [ABSTRACT FROM AUTHOR]

Surveillance is critical for interrupting transmission of global epidemics. Research has highlighted gaps in the surveillance for tuberculosis that range from failure to collect real-time data to lack of standardization of data for informed decision-making at different levels of the health system. Our research aims to advance conceptual and methodological foundations for the development of a learning surveillance system for Tuberculosis, that involves systematic collection, analysis, interpretation, and feedback of outcome-specific data. It would concurrently involve the health care delivery system, public health laboratory, and epidemiologists. For our study, we systemically framed the cyber environment of TB surveillance as an ontology of the learning surveillance system. We validated the ontology by binary coding of dimensions and elements of the ontology with the metadata from an existing surveillance platform—GPMS TB Transportal. Results show GPMS TB Transportal collects a critical range of data for active case investigation and presumptive case screening for identifying and detecting confirmed TB cases. It is therefore targeted at assisting the Active Case Finding program. Building on the results, we demonstrate enhanced surveillance strategies for GPMS that are enumerated as pathways in the ontology. Our analysis reveals the scope for embedding learning surveillance pathways for digital applications in Direct Benefit Transfer, and Drug Resistance Treatment in National TB Elimination Programme in India. We discuss the possibilities of developing the transportal into a multi-level computer-aided decision support system for TB, using the innumerable pathways encapsulated in the ontology. [ABSTRACT FROM AUTHOR]

Input devices such as motor-imagery brain-computer interfaces (BCIs) are often unreliable. In theory, channel coding can be used in the human-machine loop to robustly encapsulate intention through noisy input devices but standard feedforward error correction codes cannot be practically applied. We present a practical and general probabilistic user interface for binary input devices with very high noise levels. Our approach allows any level of robustness to be achieved, regardless of noise level, where reliable feedback such as a visual display is available. In particular, we show efficient zooming interfaces based on feedback channel codes for two-class binary problems with noise levels characteristic of modalities such as motor-imagery based BCI, with accuracy <75%. We outline general principles based on separating channel, line and source coding in human-machine loop design. We develop a novel selection mechanism which can achieve arbitrarily reliable selection with a noisy two-state button. We show automatic online adaptation to changing channel statistics, and operation without precise calibration of error rates. A range of visualisations are used to construct user interfaces which implicitly code for these channels in a way that it is transparent to users. We validate our approach with a set of Monte Carlo simulations, and empirical results from a human-in-the-loop experiment showing the approach operates effectively at 50-70% of the theoretical optimum across a range of channel conditions. [ABSTRACT FROM AUTHOR]

The estimation of the Sample Size Requirement (SSR) when using a binary composite endpoint (i.e. two or more outcomes combined in a unique primary endpoint) is not trivial. Besides information about the rate of events for each outcome, information about the strength of association between the outcomes is crucial, since it can determine an increase or decrease of the SSR. Specifically, the greater the strength of association between outcomes the higher the SSR. We present Bin-CE, a free tool to assist clinicians for computing the SSR for binary composite endpoints. In a first step, the user enters a set of candidate outcomes, the assumed rate of events for each outcome and the assumed effect of therapy on each outcome. Since the strength of the association between outcomes is usually unknown, a semi-parametric approach linking the a priori clinical knowledge of the potential degree of association between outcomes with the exact values of these parameters was programmed with Bin-CE. Bin-CE works with a recursive algorithm to choose the best combination of outcomes that minimizes the SSR. In addition, Bin-CE computes the sample size using different algorithms and shows different figures plotting the magnitude of the sample size reduction, and the effect of different combinations of outcomes on the rate of the primary endpoint. Finally, Bin-CE is programmed to perform sensitivity analyses. This manuscript presents the mathematic bases and introduces the reader to the use of Bin-CE using a real example. [ABSTRACT FROM AUTHOR]

Multiple datasets of two consecutive vintages of replicated grape and wines from six different deficit irrigation regimes are characterized and compared. The process consists of four temporal-ordered signature phases: harvest field data, juice composition, wine composition before bottling and bottled wine. A new computing paradigm and an integrative inferential platform are developed for discovering phase-to-phase pattern geometries for such characterization and comparison purposes. Each phase is manifested by a distinct set of features, which are measurable upon phase-specific entities subject to the common set of irrigation regimes. Throughout the four phases, this compilation of data from irrigation regimes with subsamples is termed a space of media-nodes, on which measurements of phase-specific features were recoded. All of these collectively constitute a bipartite network of data, which is then normalized and binary coded. For these serial bipartite networks, we first quantify patterns that characterize individual phases by means of a new computing paradigm called “Data Mechanics”. This computational technique extracts a coupling geometry which captures and reveals interacting dependence among and between media-nodes and feature-nodes in forms of hierarchical block sub-matrices. As one of the principal discoveries, the holistic year-factor persistently surfaces as the most inferential factor in classifying all media-nodes throughout all phases. This could be deemed either surprising in its over-arching dominance or obvious based on popular belief. We formulate and test pattern-based hypotheses that confirm such fundamental patterns. We also attempt to elucidate the driving force underlying the phase-evolution in winemaking via a newly developed partial coupling geometry, which is designed to integrate two coupling geometries. Such partial coupling geometries are confirmed to bear causal and predictive implications. All pattern inferences are performed with respect to a profile of energy distributions sampled from network bootstrapping ensembles conforming to block-structures specified by corresponding hypotheses. [ABSTRACT FROM AUTHOR]

We introduce a multicolor labeling strategy (Multibow) for cell tracing experiments in developmental and regenerative processes. Building on Brainbow-based approaches that produce colors by differential expression levels of different fluorescent proteins, Multibow adds a layer of label diversity by introducing a binary code in which reporters are initially OFF and then probabilistically ON or OFF following Cre recombination. We have developed a library of constructs that contains seven different colors and three different subcellular localizations. Combining constructs from this library in the presence of Cre generates cells labeled with multiple independently expressed colors based on if each construct is ON or OFF following recombination. These labels form a unique "barcode" that allows the tracking of the cell and its clonal progenies in addition to expression level differences of each color. We tested Multibow in zebrafish which validates its design concept and suggests its utility for cell tracing applications in development and regeneration. [ABSTRACT FROM AUTHOR]