Search

Malware family classification is grouping malware samples that have the same or similar characteristics into the same family. It plays a crucial role in understanding notable malicious patterns and recovering from malware infections. Although many machine learning approaches have been devised for this problem, there are still several open questions including, “Which features, classifiers, and evaluation metrics are better for malware familial classification”? In this paper, we propose a machine learning approach to Android malware family classification using built-in and custom permissions. Each Android app must declare proper permissions to access restricted resources or to perform restricted actions. Permission declaration is an efficient and obfuscation-resilient feature for malware analysis. We developed a malware family classification technique using permissions and conducted extensive experiments with several classifiers on a well-known dataset, DREBIN. We then evaluated the classifiers in terms of four metrics: macrolevel F1-score, accuracy, balanced accuracy (BAC), and the Matthews correlation coefficient (MCC). BAC and the MCC are known to be appropriate for evaluating imbalanced data classification. Our experimental results showed that: (i) custom permissions had a positive impact on classification performance, (ii) even when the same classifier and the same feature information were used, there was a difference up to 3.67% between accuracy and BAC, (iii) LightGBM and AdaBoost performed better than other classifiers we considered.

Conventional assembly methods using robots need to change end-effectors or operate two robot arms for assembly. In this study, we propose a screwdriving gripper that can perform the tasks required for the assembly using a single robot arm. The proposed screwdriving gripper mimics a human-two-handed operation and has three features: (1) it performs pick-and-place, peg-in-hole, and screwdriving tasks required for assembly with a single gripper; (2) it uses a flexible link that complies with the contact force in the environment; and (3) it employs the same joints as the pronation and supination of the wrist, which help the manipulator to create a path. We propose a new gripper with 3 fingers and 12 degrees of freedom to implement these features; this gripper is composed of grasping and screwdriving parts. The grasping part has two fingers with a roll-yaw-pitch-pitch joint configuration. Its pitch joint implements wrist pronation and supination. The screwdriving part includes one finger with a roll-pitch-pitch joint configuration and a flexible link that can comply with the environment; this facilitates compliance based on the direction of the external force. The end of the screwdriving finger has a motor with a hex key attached, and an insert tip is attached to the back of the motor. A prototype of the proposed screwdriving gripper is manufactured, and a strategy for assembly using a prototype is proposed. The features of the proposed gripper are verified through screwdriving task experiments using a cooperative robotic arm. The experiments showed that the screwdriving gripper can perform tasks required for the assembly such as pick and place, peg-in-hole, and screwdriving.

Software filtering systems can be employed to detect and filter out pirated or counterfeit software on the Web sites and peer-to-peer networks. They determine whether a suspicious program is legal or not by comparing it with original programs in a database or in the market. To identify pirated or counterfeit software, software filtering systems need to measure software similarity when comparing a suspicious program with original ones. In this case, the comparison overhead might be very high because the suspicious program is compared with all programs in the database or market in the worst case. This paper proposes a software classification scheme for efficient software filtering systems. The scheme focuses specifically on the Windows portable executable files which have been prime targets for software pirates. The scheme extracts software characteristics from a suspicious program and classifies it into one of pre-defined categories quickly based on the characteristics. The suspicious program is compared only with the programs in the one of pre-defined categories in most cases; thus, the comparison overhead is reduced. We propose two classification methods. The first one extracts strings from GUI-related resources of a program and computes the relevance of the program to each category based on the pre-computed score of the strings. The second one extracts API call frequency from a program's execution codes and uses Random Forest technique to classify the program. Experimental results show that the proposed scheme can classify programs effectively and can reduce the comparison overhead significantly.

The paper proposes a new technique to detect Android malware effectively based on converting malware binaries into images and applying machine learning techniques on those images. Existing research converts the whole executable files (e.g., DEX files in Android application package) of target apps into images and uses them for machine learning. However, the entire DEX file (consisting of header section, identifier section, data section, optional link data area, etc.) might contain noisy information for malware detection. In this paper, we convert only data sections of DEX files into grayscale images and apply machine learning on the images with Convolutional Neural Networks (CNN). By using only the data sections for 5,377 malicious and 6,249 benign apps, our technique reduces the storage capacity by 17.5% on average compared to using the whole DEX files. We apply two CNN models, Inception-v3 and Inception-ResNet-v2, which are known to be efficient in image processing, and examine the effectiveness of our technique in terms of accuracy. Experiment results show that the proposed technique achieves better accuracy with smaller storage capacity than the approach using the whole DEX files. Inception-ResNet-v2 with the stochastic gradient descent (SGD) optimization algorithm reaches 98.02% accuracy.

In recent years, the convergence phenomenon of the IT (information technology) industry with other traditional industries has deepened. Particularly, the IT industry has been strongly characterized as a base industry leading the convergence era and also pointed out as a key sector in the convergence era. In this paper, we describe what IT convergence is and introduce the Korea's five core traditional industries which are supported by combining with IT. And, we present how it is contributing to enhance the competitiveness of the traditional industries in Korea. We also explain the Korea's technology development roadmap and look at the current development status set by the Korea's traditional industries. We finally present the short and long-term strategy for national research and development plan for IT convergence technology development in the five core traditional industries.

For the health of software ecosystems, we should detect and filter out pirated and counterfeit software on the Web sites and peer-to-peer (P2P) networks. Whenever a suspicious program is found on the Internet or software market, we can adopt a software filtering system that determines whether the program is legal one or not by comparing it with the all programs maintained in the market. That is, we need to measure similarity between a suspicious program and one of the programs in the market for determining whether the suspicious program is one of pirated or hacked versions from its original. In this case, it is necessary to reduce the number of programs to be compared since there are so many programs in the market. This paper proposes a machine learning-based software classification scheme to reduce the number of comparisons for measuring software similarity. The scheme extracts API call frequency from a suspicious program, and classifies the program automatically through a machine learning technique like random forests. Experimental results show that the proposed scheme can effectively classify a program into one of nine categories and can reduce the time to determine whether the program is illegal version or not.

This letter proves the finish time predictability of EDZL (Earliest Deadline Zero Laxity) scheduling algorithm for multiprocessor real-time systems, which is a variant of EDF. Based on the results, it also shows that EDZL can successfully schedule any periodic task set if its total utilization is not greater than (m + 1)/2, where m is the number of processors.

Multiprocessor architecture becomes common on real-time systems as the workload of real-time systems increases. Recently new deadline-based (EDF-based) multiprocessor scheduling algorithms are devised, and comparative studies on the performance of these algorithms are necessary. In this paper, we compare EDZL, a hybrid of EDF and LLF, with other deadline-based scheduling algorithms such as EDF, EDF-US[m(2m-1)], and fpEDF. We show EDZL schedules all task sets schedulable by EDF. The experimental results show that the number of preemptions of EDZL is comparable to that of EDF and the schedulable utilization bound of EDZL is higher than those of other algorithms we consider.

Our goal is to design a dexterous robot hand driven by motor. For this, we studied a human hand analysis and constructed a DH model. We verified it by using Visual tracker. Also, we calculated workspace, manipulability, Opposition Angle of a human hand DH model and made the Kapandji test. By using this human hand analysis data, we designed new robot hand and analyzed the newly designed robot hand. Also we compared with analysis data of other robot hands.