The ability to recognize quickly inside network flows to be executable is prerequisite for malware detection. For this purpose, we introduce an instruction transition probability matrix (ITPX) which is comprised of th...
详细信息
The ability to recognize quickly inside network flows to be executable is prerequisite for malware detection. For this purpose, we introduce an instruction transition probability matrix (ITPX) which is comprised of the IA-32 instruction sets and reveals the characteristics of executable code's instruction transition patterns. And then, we propose a simple algorithm to detect executable code inside network flows using a reference ITPX which is learned from the known Windows Portable executable files. We have tested the algorithm with more than thousands of executable and non-executable codes. The results show that it is very promising enough to use in real world.
executable code not effectively inspected and authorized before its execution has been one of the key reasons for wild spread of malicious codes. This paper proposes a program file authorization model based on an inte...
详细信息
ISBN:
(纸本)9780769532585
executable code not effectively inspected and authorized before its execution has been one of the key reasons for wild spread of malicious codes. This paper proposes a program file authorization model based on an integrity measurement and access control combined methodology. It measures integrity signature of each program file and verifies it with the its original value before its execution. By allowing only running of known and trusted programs, it is able to disable invokes of malicious programs. To protect from attacks which don't modify a program file, an active code authorization scheme is proposed It divides a program file into an ordered series of code blocks by the return and jump instructions, constructs the integrity signatures of all code blocks respectively at compiling time, then measures and verifies them at run-time. By disallowing unexpected code blocks from running, it is able to prevent invokes of malicious codes injected by attackers.
This paper introduces novel approach for identification of switch tables in executable code. Compared to existing solutions based on SSA intermediate representation and different propagation techniques, developed algo...
详细信息
ISBN:
(纸本)9785757704937
This paper introduces novel approach for identification of switch tables in executable code. Compared to existing solutions based on SSA intermediate representation and different propagation techniques, developed algorithm is more accurate and has greater flexibility. Set of iterative algorithms based on Pearson, weighted Pearson and Spearman correlation coefficients is introduced in this paper. Simple noise value filtering and improved segmentation algorithm are described.
The problem of developing software architecture and its platform implementation for scalable cloud services is addressed in the paper. New scheme of distributed software developing and executing is presented with argu...
详细信息
ISBN:
(纸本)9785757704937
The problem of developing software architecture and its platform implementation for scalable cloud services is addressed in the paper. New scheme of distributed software developing and executing is presented with argumentation and main principles behind solution. Performance evaluation of one of the platform components (data storage) is described.
The pharmaceutical industry is continually evolving as it meets the on-going demands of external pressures such as rising development costs, patents, regulatory bodies and patients. Programmers can contribute by, acce...
详细信息
The pharmaceutical industry is continually evolving as it meets the on-going demands of external pressures such as rising development costs, patents, regulatory bodies and patients. Programmers can contribute by, accelerating the time to approval; ensuring patients receive treatment as quickly as possible. One area in particular where programmers can make a difference in accelerating the decision making, is by providing health authorities with executable code as part of the e-submission in the US. At Roche we have developed a standard approach with tools to facilitate this process. [ABSTRACT FROM AUTHOR]
In this paper, we demonstrate how to design protocols with the platform independent modeling language for multiagent systems (DSML4MAS) and discuss a model-driven approach to use protocol descriptions as a base for ge...
详细信息
ISBN:
(纸本)9781615673346
In this paper, we demonstrate how to design protocols with the platform independent modeling language for multiagent systems (DSML4MAS) and discuss a model-driven approach to use protocol descriptions as a base for generating the corresponding agent behaviors which can finally be executed with Jack Intelligent Agents.
Memory corruption is a serious class of software vulnerabilities, which requires careful attention to be detected and removed from applications before getting exploited and harming the system users. Symbolic execution...
详细信息
Memory corruption is a serious class of software vulnerabilities, which requires careful attention to be detected and removed from applications before getting exploited and harming the system users. Symbolic execution is a well-known method for analyzing programs and detecting various vulnerabilities, e.g., memory corruption. Although this method is sound and complete in theory, it faces some challenges, such as path explosion, when applied to real-world complex programs. In this paper, we present a method for improving the efficiency of symbolic execution and detecting four classes of memory corruption vulnerabilities in executable codes, i.e., heap-based buffer overflow, stack-based buffer overflow, use-after-free, and double-free. We perform symbolic execution only on test units rather than the whole program to lower the chance of path explosion. In our method, test units are considered parts of the program's code, which might contain vulnerable statements and are statically identified based on the specifications of memory corruption vulnerabilities. Then, each test unit is symbolically executed to calculate path and vulnerability constraints for each statement of the unit, which determine the conditions on unit input data for executing that statement or activating vulnerabilities in it, respectively. Solving these constraints gives us input values for the test unit, which execute the desired statements and reveal vulnerabilities in them. Finally, we use machine learning to approximate the correlation between system and unit input data. Thereby, we generate system inputs that enter the program, reach vulnerable instructions in the desired test unit, and reveal vulnerabilities in them. This method is implemented as a plug-in for angr framework and evaluated using a group of benchmark programs. The experiments show its superiority over similar tools in accuracy and performance.
For Web services composition problem, this paper proposes an executable code creation algorithm to model Web services composition based on Petri net model, and develops an executable composition code automatic creatio...
详细信息
For Web services composition problem, this paper proposes an executable code creation algorithm to model Web services composition based on Petri net model, and develops an executable composition code automatic creation tool. This tool can achieve the automatic creation process from composition model to executable code, and more meaningfully makes it possible to analyze and validate composition process logically. Finally, experiment results have proven that the tool of this paper is feasible.
We developed a method of annotating pre-existing software so that an end-user can change the underlying program via an interface created from the annotations and generate new executable code.
ISBN:
(纸本)9780769529875
We developed a method of annotating pre-existing software so that an end-user can change the underlying program via an interface created from the annotations and generate new executable code.
Remote evaluation (REV) is a construct for building distributed systems that involves sending executable code from one computer to another computer via a communication network. How REV can reduce communication and imp...
详细信息
Remote evaluation (REV) is a construct for building distributed systems that involves sending executable code from one computer to another computer via a communication network. How REV can reduce communication and improve performance for certain classes of distributed applications is explained. Implementation issues are discussed. REV is incorporated into a high-level programming language by defining its syntax and its semantics. The compile-time and run-time support for REV is discussed in both heterogeneous and homogeneous systems and compared to that needed by a remote procedure call implementation. Sample performance measurements are included. Experience with a prototype REV implementation is summarized.
暂无评论