text:
Play interactive tourEdit tour

# Analysis Report NQQWym075C.exe

## Overview

### General Information

 Sample Name: NQQWym075C.exe Analysis ID: 321308 MD5: bf75ed61e1b1f7b310ec1d999077c4dd SHA1: cdced77e176e38ff459cdea08941de26861647cd SHA256: 69357684ec8f83d428d2030db5f3d586718207e86457465e7fd37b3b4b7c4db2 Tags: exeFormbook Most interesting Screenshot:

### Detection

FormBook
 Score: 100 Range: 0 - 100 Whitelisted: false Confidence: 100%

### Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara signature match

### Classification

 System is w10x64NQQWym075C.exe (PID: 5264 cmdline: 'C:\Users\user\Desktop\NQQWym075C.exe' MD5: BF75ED61E1B1F7B310EC1D999077C4DD)RegAsm.exe (PID: 5368 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)wlanext.exe (PID: 1844 cmdline: C:\Windows\SysWOW64\wlanext.exe MD5: CD1ED9A48316D58513D8ECB2D55B5C04)cmd.exe (PID: 808 cmdline: /c del 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)conhost.exe (PID: 5232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)cscript.exe (PID: 6064 cmdline: C:\Windows\SysWOW64\cscript.exe MD5: 00D3041E47F99E48DD5FFFEDF60F6304)NQQWym075C.exe (PID: 1744 cmdline: 'C:\Users\user\Desktop\NQQWym075C.exe' MD5: BF75ED61E1B1F7B310EC1D999077C4DD)RegAsm.exe (PID: 5776 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)cleanup

## Malware Configuration

No configs have been found
SourceRuleDescriptionAuthorStrings
00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
• 0x85c8:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x8952:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x14655:\$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
• 0x14141:\$sequence_2: 3B 4F 14 73 95 85 C9 74 91
• 0x14757:\$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
• 0x148cf:\$sequence_4: 5D C3 8D 50 7C 80 FA 07
• 0x936a:\$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
• 0x133bc:\$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
• 0xa0e2:\$sequence_7: 66 89 0C 02 5B 8B E5 5D
• 0x19747:\$sequence_8: 3C 54 74 04 3C 74 75 F4
• 0x1a7ea:\$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
• 0x16679:\$sqlite3step: 68 34 1C 7B E1
• 0x1678c:\$sqlite3step: 68 34 1C 7B E1
• 0x166a8:\$sqlite3text: 68 38 2A 90 C5
• 0x167cd:\$sqlite3text: 68 38 2A 90 C5
• 0x166bb:\$sqlite3blob: 68 53 D8 7F 8C
• 0x167e3:\$sqlite3blob: 68 53 D8 7F 8C
00000002.00000002.274059450.00000000011F0000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
00000002.00000002.274059450.00000000011F0000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
• 0x85c8:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x8952:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x14655:\$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
• 0x14141:\$sequence_2: 3B 4F 14 73 95 85 C9 74 91
• 0x14757:\$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
• 0x148cf:\$sequence_4: 5D C3 8D 50 7C 80 FA 07
• 0x936a:\$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
• 0x133bc:\$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
• 0xa0e2:\$sequence_7: 66 89 0C 02 5B 8B E5 5D
• 0x19747:\$sequence_8: 3C 54 74 04 3C 74 75 F4
• 0x1a7ea:\$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
Click to see the 34 entries
SourceRuleDescriptionAuthorStrings
2.2.RegAsm.exe.400000.0.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
2.2.RegAsm.exe.400000.0.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
• 0x85c8:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x8952:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x14655:\$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
• 0x14141:\$sequence_2: 3B 4F 14 73 95 85 C9 74 91
• 0x14757:\$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
• 0x148cf:\$sequence_4: 5D C3 8D 50 7C 80 FA 07
• 0x936a:\$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
• 0x133bc:\$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
• 0xa0e2:\$sequence_7: 66 89 0C 02 5B 8B E5 5D
• 0x19747:\$sequence_8: 3C 54 74 04 3C 74 75 F4
• 0x1a7ea:\$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
2.2.RegAsm.exe.400000.0.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
• 0x16679:\$sqlite3step: 68 34 1C 7B E1
• 0x1678c:\$sqlite3step: 68 34 1C 7B E1
• 0x166a8:\$sqlite3text: 68 38 2A 90 C5
• 0x167cd:\$sqlite3text: 68 38 2A 90 C5
• 0x166bb:\$sqlite3blob: 68 53 D8 7F 8C
• 0x167e3:\$sqlite3blob: 68 53 D8 7F 8C
2.2.RegAsm.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
2.2.RegAsm.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
• 0x77c8:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x7b52:\$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
• 0x13855:\$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
• 0x13341:\$sequence_2: 3B 4F 14 73 95 85 C9 74 91
• 0x13957:\$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
• 0x13acf:\$sequence_4: 5D C3 8D 50 7C 80 FA 07
• 0x856a:\$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
• 0x125bc:\$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
• 0x92e2:\$sequence_7: 66 89 0C 02 5B 8B E5 5D
• 0x18947:\$sequence_8: 3C 54 74 04 3C 74 75 F4
• 0x199ea:\$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
Click to see the 13 entries

## Sigma Overview

No Sigma rule has matched

## Signature Overview

### AV Detection:

 Multi AV Scanner detection for submitted file Show sources
 Source: NQQWym075C.exe Virustotal: Detection: 30% Perma Link Source: NQQWym075C.exe ReversingLabs: Detection: 48%
 Yara detected FormBook Show sources
 Source: Yara match File source: 00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000002.00000002.274059450.00000000011F0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000005.00000002.261367442.0000000000400000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000005.00000002.262643764.0000000001290000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000002.00000002.273804408.00000000011C0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000004.00000002.495195854.0000000004A75000.00000004.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000004.00000002.498598158.0000000005FE0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000005.00000002.262773877.00000000012C0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000006.00000002.483267910.0000000000DF0000.00000004.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000006.00000002.484905555.0000000003240000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000000.00000003.241045829.000000000176E000.00000004.00000001.sdmp, type: MEMORY Source: Yara match File source: 0000000A.00000002.276248841.0000000002960000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000004.00000002.485157307.0000000001124000.00000004.00000020.sdmp, type: MEMORY Source: Yara match File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Source: Yara match File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Source: Yara match File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Source: Yara match File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Source: Yara match File source: 4.2.NQQWym075C.exe.5fe0000.3.unpack, type: UNPACKEDPE Source: Yara match File source: 4.2.NQQWym075C.exe.5fe0000.3.raw.unpack, type: UNPACKEDPE
 Machine Learning detection for sample Show sources
 Source: NQQWym075C.exe Joe Sandbox ML: detected
 Antivirus or Machine Learning detection for unpacked file Show sources
 Source: 2.2.RegAsm.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen Source: 5.2.RegAsm.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen Source: 4.2.NQQWym075C.exe.5fe0000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
 Found inlined nop instructions (likely shell or obfuscated code) Show sources
 Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then pop ebx 2_2_00406899 Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then pop ebx 5_2_00406899 Source: C:\Windows\SysWOW64\wlanext.exe Code function: 4x nop then pop ebx 6_2_03246899 Source: C:\Windows\SysWOW64\cscript.exe Code function: 4x nop then pop ebx 10_2_02966899

### Networking:

 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) Show sources
 Source: Traffic Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.3:49728 Source: Traffic Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.3:49730 Source: Traffic Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 23.227.38.64:80 -> 192.168.2.3:49731 Source: Traffic Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 35.186.238.101:80 -> 192.168.2.3:49744 Source: Traffic Snort IDS: 1201 ATTACK-RESPONSES 403 Forbidden 34.102.136.180:80 -> 192.168.2.3:49745
 HTTP GET or POST without a user agent Show sources
 Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=ldw93ncdIRpnK2+SYFZ4XxcSdaL1EJRCuxI9ZUy/FVTDpSzjKcQcxAtGWqTUr4WUWqsB HTTP/1.1Host: www.ussouthernhome.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?6l=3sSzGDKqeoVzrX5Sn8ux2WAGTszDSWdOTpKicZCtYQqt6BLZU/lZy9O7FBLa6j9xXLzf&Rh=Y2MlpveH8ZUh0bF HTTP/1.1Host: www.myreviewandbonuses.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=jRDzq8l+sUykxws9W99RfZyinw9UtZsC3+WzPyJGQo9muB/nYvZVAbl6dW3bW8Aotu+H HTTP/1.1Host: www.thrust-board.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?6l=kNK7qyUr0rsKRGX6DQjm/XfEOCgL/rCBvSt6iCqDIwEC5hd1LlIznMkcIp/u79mXMRr7&Rh=Y2MlpveH8ZUh0bF HTTP/1.1Host: www.teelinkz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=9Sq28+gy4k4CrtJhpK8mM8fwBZ3GLEhrr70589yX6MfPm6K+L9JTnWLRwUnCkAdg62kX HTTP/1.1Host: www.not-taboo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=M16LsldnfrVP1zxs4qqy0X/sNN1zWVH6uxw1Og8LqWL4V8CpTN5QES3cWjsEPZlyN24a HTTP/1.1Host: www.tnicholson.designConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?6l=QJ1vQpsCk7HoC7tcDYJYOCEFb+6oaJChP7LjIwOmauzAYwlZDD68O4FtKEqtEO5AoeDi&Rh=Y2MlpveH8ZUh0bF HTTP/1.1Host: www.sabaicraft.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=6yhb1plVNlXQq+RzpSC3aP+nXZqT+h1u1iqVXpUKlvKLd7IxuSoQjy9XoIojNuJhzNIO HTTP/1.1Host: www.deadroommn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=r4u6PaE5VJhGb5HfNIqoFHA5GyORyqjhLy9oIJBoAQE4G0DswHvYnpLSr9alOGw3azvw HTTP/1.1Host: www.keitakora.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
 IP address seen in connection with other malware Show sources
 Source: Joe Sandbox View IP Address: 35.186.238.101 35.186.238.101 Source: Joe Sandbox View IP Address: 198.49.23.141 198.49.23.141 Source: Joe Sandbox View IP Address: 23.227.38.64 23.227.38.64
 Internet Provider seen in connection with other malware Show sources
 Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS Source: Joe Sandbox View ASN Name: GOOGLEUS GOOGLEUS Source: Joe Sandbox View ASN Name: CLAYERLIMITED-AS-APClayerLimitedHK CLAYERLIMITED-AS-APClayerLimitedHK
 Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=ldw93ncdIRpnK2+SYFZ4XxcSdaL1EJRCuxI9ZUy/FVTDpSzjKcQcxAtGWqTUr4WUWqsB HTTP/1.1Host: www.ussouthernhome.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?6l=3sSzGDKqeoVzrX5Sn8ux2WAGTszDSWdOTpKicZCtYQqt6BLZU/lZy9O7FBLa6j9xXLzf&Rh=Y2MlpveH8ZUh0bF HTTP/1.1Host: www.myreviewandbonuses.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=jRDzq8l+sUykxws9W99RfZyinw9UtZsC3+WzPyJGQo9muB/nYvZVAbl6dW3bW8Aotu+H HTTP/1.1Host: www.thrust-board.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?6l=kNK7qyUr0rsKRGX6DQjm/XfEOCgL/rCBvSt6iCqDIwEC5hd1LlIznMkcIp/u79mXMRr7&Rh=Y2MlpveH8ZUh0bF HTTP/1.1Host: www.teelinkz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=9Sq28+gy4k4CrtJhpK8mM8fwBZ3GLEhrr70589yX6MfPm6K+L9JTnWLRwUnCkAdg62kX HTTP/1.1Host: www.not-taboo.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=M16LsldnfrVP1zxs4qqy0X/sNN1zWVH6uxw1Og8LqWL4V8CpTN5QES3cWjsEPZlyN24a HTTP/1.1Host: www.tnicholson.designConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?6l=QJ1vQpsCk7HoC7tcDYJYOCEFb+6oaJChP7LjIwOmauzAYwlZDD68O4FtKEqtEO5AoeDi&Rh=Y2MlpveH8ZUh0bF HTTP/1.1Host: www.sabaicraft.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=6yhb1plVNlXQq+RzpSC3aP+nXZqT+h1u1iqVXpUKlvKLd7IxuSoQjy9XoIojNuJhzNIO HTTP/1.1Host: www.deadroommn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii: Source: global traffic HTTP traffic detected: GET /o56q/?Rh=Y2MlpveH8ZUh0bF&6l=r4u6PaE5VJhGb5HfNIqoFHA5GyORyqjhLy9oIJBoAQE4G0DswHvYnpLSr9alOGw3azvw HTTP/1.1Host: www.keitakora.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
 Performs DNS lookups Show sources
 Source: unknown DNS traffic detected: queries for: www.ussouthernhome.com
 Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 20 Nov 2020 19:14:52 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: Apache/2Last-Modified: Fri, 10 Jan 2020 16:03:34 GMTAccept-Ranges: bytesAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 404 Error - Page Not Found
 Urls found in memory or binary data Show sources
 Source: explorer.exe, 00000003.00000000.252651061.0000000008907000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0 Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0 Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/? Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8 Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers? Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/ Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr Source: wlanext.exe, 00000006.00000002.485637823.00000000034A5000.00000004.00000020.sdmp String found in binary or memory: http://www.sz360buy.com/d Source: wlanext.exe, 00000006.00000002.485456630.0000000003496000.00000004.00000020.sdmp String found in binary or memory: http://www.sz360buy.com/o56q/?6l=2CtK5nvmO Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease Source: explorer.exe, 00000003.00000000.253203842.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn Source: wlanext.exe, 00000006.00000002.489818929.0000000003DA2000.00000004.00000001.sdmp String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js

### E-Banking Fraud:

 Yara detected FormBook Show sources
 Source: Yara match File source: 00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000002.00000002.274059450.00000000011F0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000005.00000002.261367442.0000000000400000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000005.00000002.262643764.0000000001290000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000002.00000002.273804408.00000000011C0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000004.00000002.495195854.0000000004A75000.00000004.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000004.00000002.498598158.0000000005FE0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000005.00000002.262773877.00000000012C0000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000006.00000002.483267910.0000000000DF0000.00000004.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000006.00000002.484905555.0000000003240000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000000.00000003.241045829.000000000176E000.00000004.00000001.sdmp, type: MEMORY Source: Yara match File source: 0000000A.00000002.276248841.0000000002960000.00000040.00000001.sdmp, type: MEMORY Source: Yara match File source: 00000004.00000002.485157307.0000000001124000.00000004.00000020.sdmp, type: MEMORY Source: Yara match File source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Source: Yara match File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Source: Yara match File source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Source: Yara match File source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Source: Yara match File source: 4.2.NQQWym075C.exe.5fe0000.3.unpack, type: UNPACKEDPE Source: Yara match File source: 4.2.NQQWym075C.exe.5fe0000.3.raw.unpack, type: UNPACKEDPE

### System Summary:

 Malicious sample detected (through community Yara rule) Show sources
 Source: 00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000002.00000002.272602970.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000002.00000002.274059450.00000000011F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000002.00000002.274059450.00000000011F0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000005.00000002.261367442.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000005.00000002.261367442.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000005.00000002.262643764.0000000001290000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000005.00000002.262643764.0000000001290000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000002.00000002.273804408.00000000011C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000002.00000002.273804408.00000000011C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000004.00000002.495195854.0000000004A75000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000004.00000002.495195854.0000000004A75000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000004.00000002.498598158.0000000005FE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000004.00000002.498598158.0000000005FE0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000005.00000002.262773877.00000000012C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000005.00000002.262773877.00000000012C0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000006.00000002.483267910.0000000000DF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000006.00000002.483267910.0000000000DF0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000006.00000002.484905555.0000000003240000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000006.00000002.484905555.0000000003240000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000000.00000003.241045829.000000000176E000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000000.00000003.241045829.000000000176E000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 0000000A.00000002.276248841.0000000002960000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 0000000A.00000002.276248841.0000000002960000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 00000004.00000002.485157307.0000000001124000.00000004.00000020.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 00000004.00000002.485157307.0000000001124000.00000004.00000020.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 2.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 5.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 5.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 4.2.NQQWym075C.exe.5fe0000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 4.2.NQQWym075C.exe.5fe0000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group Source: 4.2.NQQWym075C.exe.5fe0000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com Source: 4.2.NQQWym075C.exe.5fe0000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
 Contains functionality to call native functions Show sources


text:
# NIPS Proceedingsβ

## Unified View of Matrix Completion under General Structural Constraints

A note about reviews: "heavy" review comments were provided by reviewers in the program committee as part of the evaluation process for NIPS 2015, along with posted responses during the author feedback period. Numerical scores from both "heavy" and "light" reviewers are not provided in the review link below.

[PDF] [BibTeX] [Supplemental] [Reviews]

### Abstract

Matrix completion problems have been widely studied under special low dimensional structures such as low rank or structure induced by decomposable norms. In this paper, we present a unified analysis of matrix completion under general low-dimensional structural constraints induced by {\em any} norm regularization.We consider two estimators for the general problem of structured matrix completion, and provide unified upper bounds on the sample complexity and the estimation error. Our analysis relies on generic chaining, and we establish two intermediate results of independent interest: (a) in characterizing the size or complexity of low dimensional subsets in high dimensional ambient space, a certain \textit{\modified}~complexity measure encountered in the analysis of matrix completion problems is characterized in terms of a well understood complexity measure of Gaussian widths, and (b) it is shown that a form of restricted strong convexity holds for matrix completion problems under general norm regularization. Further, we provide several non-trivial examples of structures included in our framework, notably including the recently proposed spectral $k$-support norm.

format: plain


text:
chapter
9 Pages

## of of

The total mass of the sample was 147.2 g. (a) Plot the particle-size distribution curve and describe the soil. Comment on the flat part

of the curve (b) State the effective grain size

3.36 A liquid limit test carried out on a sample of inorganic soil taken from below the water table gave the following results:

Fall cone penetration y (mm) 15.5 18.2 21.4 23.6 Moisture content, wy % 34.6 40.8 48.2 53.4

A plastic limit test gave a value of 33%. Determine the average liquid limit and plasticity index of this soil and give its classification.


text:
# How do you solve -7\geq 6u - 43?

Jan 12, 2018

See a solution process below:

#### Explanation:

First, add $\textcolor{red}{43}$ to each side of the inequality to isolate the $u$ term while keeping the inequality balanced:

$- 7 + \textcolor{red}{43} \ge 6 u - 43 + \textcolor{red}{43}$

$36 \ge 6 u - 0$

$36 \ge 6 u$

Now, divide each side of the inequality by $\textcolor{red}{6}$ to solve for $u$ while keeping the inequality balanced:

$\frac{36}{\textcolor{red}{6}} \ge \frac{6 u}{\textcolor{red}{6}}$

$6 \ge \frac{\textcolor{red}{\cancel{\textcolor{b l a c k}{6}}} u}{\cancel{\textcolor{red}{6}}}$

$6 \ge u$

We can reverse or "flip" the entire inequality to state the solution in terms of $u$:

$u \le 6$


text:
generate a Jaehne array - Maple Help

Home : Support : Online Help : Science and Engineering : Signal Processing : Signal Generation : SignalProcessing/GenerateJaehne

SignalProcessing[GenerateJaehne] - generate a Jaehne array

 Calling Sequence GenerateJaehne(n, mag)

Parameters

 n - posint, number of samples mag - realcons, magnitude of the signal to be generated

Description

 • The GenerateJaehne(n, mag) command generates an n-dimensional Jaehne array. The result is returned in an Array with datatype float[8].
 • The Jaehne array of length $n$ is defined by computing the $k$-th sample as $m\mathrm{sin}\left(\frac{\mathrm{\pi }{k}^{2}}{2n}\right)$, where $m$ is the magnitude of the signal.
 • If the container=C option is provided, then the results are put into C and C is returned. With this option, no additional memory is allocated to store the result. The container must be an Array of size n having datatype float[8].

 • The SignalProcessing[GenerateJaehne] command is thread-safe as of Maple 17.

Examples

 > $\mathrm{with}\left(\mathrm{SignalProcessing}\right):$
 > $A:=\mathrm{GenerateJaehne}\left(10,1\right)$
 ${A}{:=}\left[\begin{array}{cccccccccc}{0.}& {0.156434465040231}& {0.587785252292473}& {0.987688340595138}& {0.587785252292473}& {-}{0.707106781186547}& {-}{0.587785252292473}& {0.987688340595138}& {-}{0.587785252292473}& {0.156434465040231}\end{array}\right]$ (1)
 > $c:=\mathrm{Array}\left(1..10,'\mathrm{datatype}'={'\mathrm{float}'}_{8},'\mathrm{order}'='\mathrm{C_order}'\right):$
 > $A:=\mathrm{GenerateJaehne}\left(10,1,'\mathrm{container}'=c\right)$
 ${A}{:=}\left[\begin{array}{cccccccccc}{0.}& {0.156434465040231}& {0.587785252292473}& {0.987688340595138}& {0.587785252292473}& {-}{0.707106781186547}& {-}{0.587785252292473}& {0.987688340595138}& {-}{0.587785252292473}& {0.156434465040231}\end{array}\right]$ (2)
 > $c$
 $\left[\begin{array}{cccccccccc}{0.}& {0.156434465040231}& {0.587785252292473}& {0.987688340595138}& {0.587785252292473}& {-}{0.707106781186547}& {-}{0.587785252292473}& {0.987688340595138}& {-}{0.587785252292473}& {0.156434465040231}\end{array}\right]$ (3)
 > $\mathrm{plots}:-\mathrm{listplot}\left(\mathrm{GenerateJaehne}\left(500,1\right)\right)$


text:
# Event shape engineering for inclusive spectra and elliptic flow in Pb--Pb collisions at $\sqrt{s_{NN}}$ = 2.76 TeV

Submission Date:
22/07/2015
Article Information
Submission Form
System:
Pb-Pb
Energy:
2.76 TeV
Abstract Plain Text:

Recent measurements and model calculations indicate strong event-by-event fluctuations in anisotropic
flow. This makes the selection of the events corresponding to the same centrality, but very dif-
ferent average flow, possible: the so-called event shape engineering (ESE). We report the first re-
sults obtained by the ALICE collaboration with the ESE technique applied to Pb-Pb collisions at
$\sqrt{s_{NN}}$ = 2.76 TeV. We find the effect of event-shape selection on the elliptic flow coefficient v$_{2}$ to be
almost independent on transverse momentum p$_{T}$ , indicating p$_{T}$ independence of flow fluctuations,
as expected if these are due to fluctuations in the initial geometry of the system. Charged hadrons
and identified particle spectra are found to be harder in events with higher-than-average elliptic flow,
indicating an interplay between radial flow and the initial configuration of the system.

Paper proposal talk: https://indico.cern.ch/event/330026/session/1/contribution/0/material/sl...


text:
## LATEX-L@LISTSERV.UNI-HEIDELBERG.DE

 Options: Use Forum View Use Monospaced Font Show Text Part by Default Condense Mail Headers Message: [<< First] [< Prev] [Next >] [Last >>] Topic: [<< First] [< Prev] [Next >] [Last >>] Author: [<< First] [< Prev] [Next >] [Last >>]

Morten Høgholm writes:
> On Sun, 09 Dec 2007 22:33:12 +0100, Lars Hellström wrote:
>
> Hi Lars,
>
> > 9 dec 2007 kl. 20.14 skrev Morten Høgholm:
> >>
> >> So perhaps an alternative could be to use something like
> >>   \int_set:Nr <int> {expression}% r for register?
> >>
> >> Opinions?
> >
> > How would such an r be different from x?
>
> Technically there wouldn't be any difference of course. Only the
> implication that everywhere else, x means there is also an n base
> function, which is also more or less why I chose the n form initially.

and with good reason I think.

Let us step back and reevaluate what the arg forms are supposed to mean:

\foo:abc  % abc are placeholders for real arg specifiers

is intended to be a short form for saying

- do "a" with the first argument do "b" with the second and do "c" with the
third argument prior to passing the argument values to the base function
\foo:nnn

- it is really only a short form of  \exp_args:Nabc \foo:nnn

It makes no statements about what \foo:nnn does with the arguments it

Some people have suggested we shouldn't provide the short forms, though I feel
that they make life much easier once you get the hang of it, but in any
case they are only shorts for "manipulate some arguments prior to passing them
to a function"

There is a bit of inconsistency here in that something like T F are arg


text:
Wasserstein-Riemannian Geometry of Positive-definite Matrices

The Wasserstein distance on multivariate non-degenerate Gaussian densities is a Riemannian distance. After reviewing the properties of the distance and the metric geodesic, we derive an explicit form of the Riemannian metrics on positive-definite matrices and compute its tensor form with respect to the trace scalar product. The tensor is a matrix, which is the solution of a Lyapunov equation. We compute explicit form for the Riemannian exponential, the normal coordinates charts, the Riemannian gradient, and discuss the gradient flow of the entropy. Finally, the Levi-Civita covariant derivative is computed in matrix form together with the differential equation for the parallel transport. While all computations are given in matrix form, notheless we discuss the use of a special moving frame. Applications are briefly discussed.

Authors

• 12 publications
• 1 publication
• 7 publications
• Bures-Wasserstein Geometry

The Bures-Wasserstein distance is a Riemannian distance on the space of ...
01/21/2020 ∙ by Jesse van Oostrum, et al. ∙ 0

We derive new gradient flows of divergence functions in the probability ...
05/11/2019 ∙ by Wuchen Li, et al. ∙ 1

• Positive definite matrices and the S-divergence

Positive definite matrices abound in a dazzling variety of applications....
10/08/2011 ∙ by Suvrit Sra, et al. ∙ 0

• Riemannian level-set methods for tensor-valued data

We present a novel approach for the derivation of PDE modeling curvature...
05/02/2007 ∙ by Mourad Zerai, et al. ∙ 0

• Gaussian distributions on Riemannian symmetric spaces in the large N limit

We consider Gaussian distributions on certain Riemannian symmetric space...
02/15/2021 ∙ by Simon Heuveline, et al. ∙ 0

• Geodesic regression

The theory of geodesic regression aims to find a geodesic curve which is...
05/04/2020 ∙ by Frank Hansen, et al. ∙ 0

• Computation and verification of contraction metrics for exponentially stable equilibria

The determination of exponentially stable equilibria and their basin of ...
09/20/2019 ∙ by Peter Giesl, et al. ∙ 0

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1 Introduction

Given two probability measures

and on

, with finite second moments, consider the set

of probability measures on the product sample space , such that the two -dimensional margins have the prescribed distributions, and . The index

 W2=inf\setof\expectatμ\normofX1−X22μ∈P(ν1,ν2)

as a measure of dissimilarity between distributions has been considered by many classical authors e.g., C. Gini, P. Levy, and M.R. Fréchet. There is considerable contemporary literature discussing the index , which is usually called Wasserstein distance. E.g., the monograph by C. Villani villani:2008optimal . We want also to mention Y. Brenier brenier:1991 and R.J. McCann mccann:2001 .

There is an important particular case, where the above problem reduces to the Monge transport problem. Borrowing the argument from M. Knott and C.S. Smith knott|smith:1984 , assume is a smooth strictly convex function and . Clearly, the condition

 \expectatμ\normofX1−∇Φ(X1)2≤\expectatμ\normofX1−X22,μ∈P(ν1,ν2) ,

turns out to be equivalent to . Latter inequality shows that the minimum quadratic distance is attained. In view of the new formulation, let us provide a proof.

If denotes the convex conjugate of . We have

 X1⋅X2≤Φ(X1)+Ψ(X2)

and the equality case is

 X1⋅∇Φ(X1)=Φ(X1)+Ψ(∇ΦX1) .

By assumption so that

 \expectatμX1⋅∇Φ(X1)=\expectatμΦ(X1)+Ψ(∇Φ(X1))=\expectatμΦ(X1)+Ψ(X2)≥\expectatμX1⋅X2 .

This argument, including an existence proof, is in Y. Brenier brenier:1991 . In the present paper we shall study the same problem where all the involved distributions are Gaussian. It would be feasible to reduce the Gaussian case to the general one. However, we resort to methods specially suited for this case.

1.1 The Gaussian case

Given two Gaussian distributions , , consider the set of Gaussian distributions on such that the two -dimensional margins have the prescribed distributions, . The corresponding index is

 W2=inf\setof\expectatμ\normofX1−X22μ∈G(ν1,ν2) . (1)

Observe that if and is a symmetric matrix such that , then the previous argument applies by means of the convex function .

The value of in Eq. (1) as a function of the mean and the dispersion matrix has been computed by some authors, in particular: I. Olkin and F. Pukelsheim olkin|pukelsheim:1982 , D. C. Dowson and B. V. Landau dowson|landau:1982 , C. R. Givens and R. M. Shortt givens|shortt:1984 , M. Gelbrich gelbrich:1990 . They found the (equivalent) forms

 W2 =\normofμ1−μ22+\traceofΣ1+Σ2−2(Σ1/21Σ2Σ1/21)1/2 (2) =\normofμ1−μ22+\traceofΣ1+Σ2−2(Σ1Σ2)1/2 .

Further interpretations of are available. R. Bhatia et al. bhatia|jain|lim:2018 showed that is also the solution of constrained minimization problems for the Frobenius matrix norm , when . Especially,

 W=min\setof\normofΣ1/21U−Σ1/22VU and V % orthogonal .

Notice that is the generic transformation of the standard Gaussian to the Gaussian with dispersion matrix .

Because of the exponent 2 in Eq. (1), the distance is more precisely called -Wasserstein distance. Other exponents or other distances could be used in the definition. The quadratic case is particularly relevant as is a Riemannian distance. More references will be given later.

In an Information Geometry perspective, we can mimic the argument of the seminal paper by Amari amari:1998natural

, who derived the notion of both Fisher metric and natural gradient, from the second order approximation of the Kullback-Leibler divergence.

It will be shown (see Sec. 2) that the value of Eq. (2) has the differential second-order expansion for small :

 \traceofΣ+(Σ+H)−2(Σ1/2(Σ+H)Σ1/2)1/2≃\traceof\lyapunovΣHΣ\lyapunovΣH , (3)

where is the solution to the Lyapunov equation .

The quadratic form in the RHS of Eq. (3) provides a candidate to be the Riemannian inner product associated with the distance . In addition, if is a smooth real function defined on a small -sphere. i.e., for small , then the increment is maximized along the direction

It is remarkable that all geometric objects shown in the previous equations above may be expressed as matrix operations. In this paper, we proceed in developing systematically the Wasserstein geometry of Gaussian models according to such a formalism.

1.2 Relations with the literature on the general transport theory

The Wasserstein distance and its relevant geometry can be studied non-parametrically also for general distributions. We do not pursue in this direction and refer to the monograph by C. Villani villani:2008optimal . The -Wasserstein metric geometry has been shown to be Riemannian by F. Otto (otto:2001, , §4) and J. Lott lott:2008calculations . Cf. the earlier account by J.D. Lafferty lafferty:1988 .

Let us briefly discuss Otto’s approach in the language of Information Geometry, i.e., with reference to S. Amari and H. Nagaoka amari|nagaoka:2000 . In view of the non-parametric approach first introduced in pistone|sempi:95 , and denoted by the set of

-dimensional Gaussian densities with zero mean, the vector bundle

 HM=\setof(ρ,ϕ)ρ∈M,ϕ∈L2(ρ),∫ϕ ρ=0

is the Amari Hilbert bundle on . The Hilbert bundle contains the statistical bundle whose fibers consist of the scores for all smooth curves with . In turn, the statistical bundle is the tangent space of considered as an exponential manifold, see pistone|sempi:95 ; pistone:2013GSI .

In our present case, since the model is an exponential family, the natural parameter is the concentration matrix . The log-likelihood is

 logρ(y;C)=−12log2π+12logdetC−12y∗Cy .

If is a symmetric matrix, the derivative of in the direction is

 dVlogρ(y;C)=12\traceofC−1V−12y∗Vy=\traceofϕ(y;C)V

where is a symmetric matrix identified with a linear operator on symmetric matrices , equipped with the Frobenius inner product. The fiber at consists of the vector space of functions , . The inner product in the Hilbert bundle, restricted to the parameterized statistical bundle, is the Fisher metric

 FC(U,V)=∫dUlogρ(y;C)dVlogρ(y;C) ρ(y;C) dy=−∫dU\traceofϕ(y;C)V ρ(y;C) dx=12\traceofUC−1VC−1 . (4)

The study of the Fisher metric in the Gaussian case has been done first by L.T. Skovgaard skovgaard:1984 .

F. Otto (otto:2001, , §1.3)

, who was motivated by the study of a class of partial differential equation, considered a inner product defined on smooth functions of the

-fiber of the Hilbert bundle, as

 (ϕ1,ϕ2)↦∫∇ϕ1(x)⋅∇ϕ2(x) ρ(x) dx . (5)

In the non-parametric case, Otto’s metric of Eq. (5) is related to the Wasserstein distance, for a detailed study of such a metric see J. Lott lott:2008calculations .

If we apply this definition to our score and , the gradient is and the metric becomes

 GC(U,V)=∫∇\traceofϕ(y;C)U⋅∇\traceofϕ(y;C)V ρ(y;C) dy=∫y∗VUy ρ(y;Σ) dy=\traceofUC−1V . (6)

The equivalence between the metric in Eq. (6) and the one in Eq. (4) can be seen by a change of parameterization both in and in each fiber. First, one must define the inner product at to be the inner product computed in the bijection , to get , which is the form of the metric provided by A. Takatsu (takatsu:2011osaka, , Prop. A). Second, one has to change the parameterization on each fiber of the statistical bundle by . The involved change of parameterization in the statistical bundle whose inverse is produces the desired inner product.

We mention also that the Machine Learning literature discusses a divergence introduced by A. Hyvärinen

MR2249836 , which is related to Otto’s metric. Precisely, in the concentration parameterization the Hyvärinen divergence is

 \KHDC=12∫\aval∇logρ(y;D)−∇logρ(y;C)2ρ(y;C) dy=12∫\avalDy−Cy2ρ(y;C) dy=\traceofC−1(D−C)2 ,

and the second derivative of at is

 d2\KHCC[X,Y]=\traceofXC−1Y .

In Statistics, Hyvärinen divergence is related to local proper scoring rules, see M. Parry et al. parry|dawid|lauritzen:2012 .

1.3 Overview

The first two sections of the paper are mostly review of known material. In Sec. 2 we recall some properties of the space of symmetric matrices. In particular: Riccati equation, Lyapunov equation, and the calculus regarding to the two mappings and . The mapping , where is a non-singular square matrix is shown to be a submersion and the horizontal vectors at each point is computed. Despite of our manifold being finite dimensional, there is no need of choosing a basis, as all operations of interest are matrix operations. For that reason, we rely on the language of non-parametric differential geometry of W. Klingenberg klingenberg:1995 and S. Lang lang:1995 .

In Sec. 3 we discuss known results about the metric geometry induced by the Wasserstein distance. These results are re-stated in Prop. 3 and, for sake of completeness, we provide a further proof inspired by dowson|landau:1982 . It is possible to write down an explicit metric geodesic as done by R.J. McCann (mccann:2001, , Example 1.7), see Prop. 4. The space of non-degenerate Gaussian measures (or, equivalently, the space of positive definite matrices) can be endowed with a Riemann structure that induces the Wasserstein distance. This is elaborated in Sec. 4, where we use the presentation given by takatsu:2011osaka , cf. also bhatia|jain|lim:2018 , which in turn adapts to the Gaussian case the original work (otto:2001, , §4).

The remaining part of the paper is offered as a new contribution to this topic. The Wasserstein Riemannian metric turns out to be

 WΣ(U,V)=\traceof\lyapunovΣUΣ\lyapunovΣV=12\traceof\lyapunovΣUV , (7)

at each matrix , and where are symmetric matrices. By submersion methods we study the more general problem of the horizontal surfaces in , characterized in Prop. 8. As a specialized case we get the Riemannian geodesic which agrees with the metric geodesic of Section 3.

The explicit form of Riemannian exponential is obtained in Sec. 5. The natural (Riemannian) gradient is discussed in Sec. 6 and some applications to optimization are provided in Sec. 6.1. The analysis of the second-order geometry is treated in Sec. 7, where we compute the Levi-Civita covariant derivative, the Riemannian Hessian, and discuss other related topics. However, the curvature tensor will not be taken into consideration in the present paper.

In the final Sec. 8, we discuss the results in view of applications and in Information Geometry of statistical sub-models of the Gaussian manifold.

2 Symmetric matrices

The set of Gaussian distributions on is in 1-to-1 correspondence with the space of its parameters . Moreover, is closed for the weak convergence and the identification is continuous in both directions. A reference for Gaussian distributions is the monograph T.W. Anderson anderson:2003 .

For ease of later reference, we recall a few results on spaces of matrices. General references are the monographs by P. R. Halmos halmos:1958 , J. R. Magnus and H. Neudecker magnus|neudecker:1999 , and R. Bhatia bhatia:2007PDM .

The vector space of real matrices is denoted by , while square matrices are denoted . It is an Euclidean space of dimension and the vectorization mapping is an isometry for the Frobenius inner product .

Symmetric matrices form a vector subspace of whose orthogonal complement is the space of anti-symmetric matrices . We will find it convenient the use, with regard to symmetric matrices, of the equivalent inner product , see e.g. Eq. (18) below. The closed pointed cone of non-negative-definite symmetric matrices is denoted by and its interior, the open cone of the positive-definite symmetric matrices, by .

Given , the equation is called Riccati equation. If and , then the equation has unique solution . In fact, from it follows and, in turn, because . Hence, the solution to Riccati equation is

 T=A−1/2(A1/2BA1/2)1/2A−1/2 . (8)

Notice that , consequently if

. In terms of random variables, if

and , then is the unique matrix of such that .

A more compact closed-form solution of the Riccati equation is available. Given and , observe that

. By similarity, the eigenvalues of

are non-negative, hence the square root

 (AB)1/2=A1/2(A1/2BA1/2)1/2A−1/2 (9)

is well defined, see (bhatia:2007PDM, , Ex. 4.5.2). Therefore, an equivalent formulation of Eq. (8) is

 T=A−1A1/2(A1/2BA1/2)1/2A−1/2=A−1(AB)1/2 . (10)

Since , the eigenvalues of and are identical, so that the same argument used before yields too

 T=(BA)1/2A−1 . (11)

The square mapping is an injection of onto itself with derivative . Hence, the derivative operator is invertible. An alternative notation for the derivative we find convenient to use now and then is .

For each assigned matrix , the matrix is the unique solution in the space to the Lyapunov equation

 V=XA+AX . (12)

Its solution will be written . Clearly we have also

 V=\lyapunovAVA+A\lyapunovAVandX=\lyapunovAXA+AX . (13)

The Lyapunov operator itself can be seen as a derivative. In fact, the inverse of the square mapping is the square root mapping . By the derivative-of-the-inverse rule,

 dV\SQRT(Σ)=(d\SQ(\SQRT(Σ)))−1[V]=\lyapunovΣ1/2V . (14)

If is the dispersion of a non-singular Gaussian distribution, then is the concentration matrix and represents an alternative and useful parameterization. From the Lyapunov equation we obtain , hence

 \lyapunovΣV=\lyapunovΣ−1Σ−1VΣ−1% and\lyapunovΣ−1U=\lyapunovΣΣUΣ .

Likewise, another useful formula is

 \lyapunovΣV=Σ−1/2\lyapunovΣΣ−1/2VΣ−1/2Σ−1/2 . (15)

There is also a relation between the Lyapunov equation and the trace. From , it follows . Then

 \traceof\lyapunovΣV=12\traceofΣ−1V . (16)

We will later need the derivative of the mapping , for a fixed . Differentiating the first identity in Eq. (13) in the direction , we have

Hence is the solution to the Lyapunov equation

 dU\lyapunovAVA+A dU\lyapunovAV=−(\lyapunovAVU+U\lyapunovAV) ,

so that we get

 dU\lyapunovAV=−\lyapunovA\lyapunovAVU+U\lyapunovAV . (17)

It will be useful in the following to evaluate the second derivative of the mapping . From Eqs. (14) and (17) it follows

 d2\SQRT(Σ)[U,V]=\lyapunovΣ1/2\lyapunovΣ1/2V\lyapunovΣ1/2U+\lyapunovΣ1/2U\lyapunovΣ1/2V .

Lyapunov equation plays a crucial role, as the linear operator enters the expression of the Riemannian metric with respect to the standard inner product, see Eq. (7). As a consequence, the numerical implementation of the inner product will require the computation of the matrix . There are many ways to write down the closed-form solution to Eq. (12). They are discussed in bhatia:2007PDM . However, efficient numerical solutions are not based on the closed forms, but rely on specialized numerical algorithms, as discussed by E. L. Wachspress wachspress:2008 and by V. Simoncini simoncini:2016 .

We now turn to the computation of the second-order approximation of in Eq. (2).

Fix and let so that . Hence, for all . Consider the expression of with , , , namely

 θ↦W2(Σ,Σ+θH)=2\traceofΣ+θ\traceofH−2\traceof(Σ2+θΣ1/2HΣ1/2)1/2 .

By Eq. (14) and Eq. (16), the first-order derivative is

 \derivbyθW2(Σ,Σ+θH)=\traceofH−2\traceof\lyapunov(Σ2+θΣ1/2HΣ1/2)1/2Σ1/2HΣ1/2=\traceofH−\traceof(Σ2+θΣ1/2HΣ1/2)−1/2(Σ1/2HΣ1/2) .

Observe that .

The second derivative is

 \dderivbyθW2(Σ,Σ+θH)=\traceof\derivbyθ(Σ2+θΣ1/2HΣ1/2)−1/2(Σ1/2HΣ1/2)

with

 \derivbyθ(Σ2+θΣ1/2HΣ1/2)−1/2=(Σ2+θΣ1/2HΣ1/2)−1/2×\lyapunov(Σ2+θΣ1/2HΣ1/2)1/2Σ1/2HΣ1/2(Σ2+θΣ1/2HΣ1/2)−1/2 ,

so that

 \dderivbyθW2(Σ,Σ+θH)∣∣θ=0=\traceofΣ−1\lyapunovΣΣ1/2HΣ1/2Σ−1Σ1/2HΣ1/2=\traceofΣ−1/2\lyapunovΣΣ1/2HΣ1/2Σ−1/2H=\traceof\lyapunovΣHH ,

where Eq. (15) has been used. Finally, observe that

 \traceof\lyapunovΣHΣ\lyapunovΣH=\traceof\lyapunovΣH\lyapunovΣHΣ=12\traceof\lyapunovΣH(\lyapunovΣHΣ+Σ\lyapunovΣH)=12\traceof\lyapunovΣHH (18)

We can conclude that

 W2(Σ,Σ+θH)=θ22\traceof\lyapunovΣHH+\smallo(θ2)=θ2\traceof\lyapunovΣHΣ\lyapunovΣH+\smallo(θ2) .

Therefore, the bi-linear form in the RHS suggests the form of the Riemannian metric to be derived.

2.1 The mapping A↦AA∗

We study now the extension of the square operation to general invertible matrices, namely the mapping , defined by . Next proposition shows that this operation is a submersion. We recall first its definition, see (docarmo:1992, , Ch. 8, Ex. 8–10) or (lang:1995, , §II.2 ).

Let be an open set of the Hilbert space , and a smooth surjection from the Hilbert space onto a manifold , i.e., assume that for each the derivative at , is surjective. In such a case, for each , the fiber is a sub-manifold. Assigned a point , a vector is called vertical if it is tangent to the manifold . Each such a tangent vector is the velocity at of some smooth curve with and . Precisely, from for all we derive the characterization of vertical vectors. We have i.e., the tangent space at is . The orthogonal space to the tangent space is called the space of horizontal vectors at ,

 HA=Ker(df(A))⊥=Im(df(A)∗) .

Let us apply this argument to our specific case. Let be the open set of invertible matrices; the subgroup of of orthogonal matrices; the subspace of of anti-symmetric matrices.

Proposition 1
1. For each given we have the orthogonal splitting

 M(n)=Sym(n)A⊕Sym⊥(n)(A∗)−1 .
2. The mapping

 \MMT:GL(n)∋A↦AA∗∈Sym++(n)

has derivative at given by . It is a submersion with fibers

 \MMT−1(C)=\setofC1/2RR∈\Oofn .
3. The kernel of the differential is

 Ker(dσ(A))=Sym⊥(n)(A∗)−1

and its orthogonal complement, is

 HA=Sym(n)A.
4. The orthogonal projection of onto is .

Proof

We provide here the proof for sake of completeness. See also takatsu:2011osaka and bhatia|jain|lim:2018 .

1. If , for all i.e., , then , so that that is, .

2. Let the matrix be an element in the fiber manifold . The derivative of at , , is surjective, because for each we have . Hence is a submersion and the fiber is a sub-manifold of .

3. Let us compute the splitting of into the kernel of and its orthogonal: . The vector space tangent to at is the kernel of the derivative at :

 \kerofdσ(A)={X∈M(n)| XA∗+AX∗=0}={X∈M(n)| (AX∗)∗=−AX∗} .

Therefore, if, and only if, , i.e., . We have just proved that this implies .

4. Consider the decomposition of into the horizontal and the vertical part: with and . By transposition, we get . From the previous two equations, we obtain the two equations and . The sum of the two previous equations is , which is a Lyapunov equation having solution . It follows that the projection is

3 Wasserstein distance

The aim of this section is to discuss the Wasserstein distance for the Gaussian case as well as the equation for the associated metric geodesic. Most of its content is an exposition of known results.

3.1 Block-Gaussian

Let us suppose that the dispersion matrix is partitioned into blocks, and consider random variables and such that

 [XY]∼N2n(μ,Σ),Σ=[Σ1KK∗Σ2] ,

so that if and . It follows that , which in turn imply the bounds

 ∥K∥22≤Tr(Σ1)Tr(Σ2)andsupij∣∣Kij∣∣≤12(Tr(Σ1)+Tr(Σ2)) . (19)

For mean vectors and dispersion matrices , define the set of jointly Gaussian distributions with given marginals to be

 G((μ1,Σ1),(μ2,Σ2))={N2n([μ1μ2],[Σ1KK∗Σ2])} ,

and the Gini dissimilarity index

 (20)

Actually, in view of either of the bounds in Eq. (19), the set is compact and the is attained.

It is easy to verify that

 W((μ1,Σ1),(μ2,Σ2))=√min\setofE[∥X−Y∥2][XY]∼γ,γ∈G((μ1,Σ1),(μ2,Σ2))

defines a distance on the space . The symmetry of is clear as well as the triangle inequality, by considering Gaussian distributions on with given marginals. To conclude, assume that the is reached at some . Then

 0=W((μ1,Σ1),(μ2,Σ2))=E¯¯¯γ[|X−Y|2]⇔μ1=μ2and% Σ1=Σ2 .

A further observation is that distance is homogeneous i.e.,

 W((λμ1,λ2Σ1),(λμ2,λ2Σ2))=λW((μ1,Σ1),(μ2,Σ2)),λ≥0 .

3.2 Computing the quadratic dissimilarity index

We will present a proof as given by Dowson and Landau dowson|landau:1982 , but with some corrections.

Given , each admissible ’s in (20) belongs to a compact set of thanks to bound (19), so the maximum of the function is reached. Therefore, we are led to study the problem

 (21)

The value of the similar problem with replaced by will be denoted by

Proposition 2
1. Let . Then

 α(Σ1,Σ2)=2Tr((Σ1/21Σ2Σ1/21)1/2) and β(Σ1,Σ2)=−α(Σ1,Σ2) .
2. If moreover , then

 α(Σ1,Σ2)=2\traceof(Σ1Σ2)1/2 .
Proof (point (1))

A symmetric matrix is non-negative defined if, and only if, it is of the form , with . Given the block structure of in (21), we can write

 [Σ1KK∗Σ2]=[AB][A∗B∗]=[AA∗AB∗BA∗BB∗],

where and are two matrices in

Therefore, problem (21) becomes

 ⎧⎪ ⎪⎨⎪ ⎪⎩α(Σ1,Σ2)=maxA,B∈M(n×2n)2Tr(AB∗)subject toΣ1=AA∗,Σ2=BB∗

We have already observed that the optimum exists, so the necessary conditions of Lagrange theorem allows us to characterize this optimum. However, the two constraints and are not necessarily regular at every point (i.e., the Jacobian of the transformation may fail to be of full rank at some point), so we must take into account that the optimum could be an irregular point. To this purpose, as a customary, we shall adopt Fritz John first-order formulation for the Lagrangian (see mangasarian|fromovitz:1967 ).

We shall initially assume that both and are non-singular.

Let then , , where the symmetric matrices and are the Lagrange multipliers. The Lagrangian function will be

 L =2ν0Tr(AB∗)−Tr(ΛAA∗)−Tr(ΓBB∗) =2ν0Tr(AB∗)−Tr(A∗ΛA)−Tr(B∗ΓB)

The first-order conditions of lead to

 {ν0B=ΛA,ν0A=ΓBΣ1=AA∗,Σ2=BB∗ . (22)

In the case i.e., the case of stationary regular points, Eq. (22) becomes

 {B=ΛA,A=ΓBΣ1=AA∗,Σ2=BB∗ , (23)

which in turn implies

 {ΛΣ1Λ=Σ2ΓΣ2Γ=Σ1,Λ,Γ∈Sym(n) (24)

and further

 K=Σ1Λ=ΓΣ2.

Of course, Eqs. (24) could be more general than Eqs. (23) and thus possibly contain undesirable solutions. In this light, we establish the following facts, in which both matrices and must be nonsingular. Notice that in this case Eqs. (24) imply that both and are nonsingular as well.

Claim 1: If is a solution to (24) and , then the couple are Lagrange multipliers of Problem (21).

Actually, let , be any representation of the matrix . Define so that . Moreover

 BB∗=ΛAA∗Λ=ΛΣ1Λ=Σ2 ,

and so are multipliers associated with the feasible point .

Claim 2: The set of solutions to (24), such that , is not empty. In particular, there is a unique pair where both and are positive definite.

We have already observed that Eqs. (24) imply that and are nonsingular. Moreover, we have . Recalling that Riccati’s equation has one and only one solution in the class of positive definite matrices, then .

Now we proceed to study the solutions to and we shall show that Eq (


text:
# All Questions

123 views

### How many messages needs to be send to server to get AES key in Cache-timing Attack

I'm trying to evaluate the correlation between key length and the number of messages that needs to be send to server during Cache timing Attack. I read both D. Bernstein, “Cache-timing attacks on ...
233 views

### Does BouncyCastle (for ECC) resist timing attacks?

I need to extend the TLS protocol to be able to use other key exchange scheme based on elliptic curves. I am planning to use BouncyCastle's implementation in Java and in .NET. I am worring about ...
506 views

### Decrypting a message without the private key using CRT

I am given 5 different encryption modulus, $N$, each ranging from 78 to 88 numbers long. Then for the encryption exponent, each has the same which is 5. Then I am given 5 different encrypted messages, ...
213 views

### How to perform benchmark of block/stream ciphers?

I would like to perform some benchmarking of different block and stream ciphers for general data (lossless and lossy data) encryption and decryption (with focus on power consumption). To get general ...
66 views

### How does Dissent protect against Sybil Attacks?

Dissent claims to be able to be resistant to Sybil attacks. Dissent seeks to offer accountable anonymity, giving users strong guarantees of anonymity while also protecting online groups or forums ...
617 views

### How is the initial permutation of DES created?

I am creating a program in C language with DES (Data Encryption Standard) functionality, but don't know how to apply the initial permutation. Is it achieved by swapping the values? If "yes", then ...
337 views

### RSA Attack with some known values

There is an RSA implementation which I need to attack to get the encrypted messages. Some of the values are known. Plain text value for input. So if I enter a message, say it "A", the plain text is ...
73 views

### LogSpace Merkle Traversal

I am studying LogSpace Merkle Tree Traversal algorithm in "Post Quantum Cryptography". I don't understand the Table 1 on page 58. My question is: Why within of the $2^h$ rounds for $NEED_h$ exist ...
461 views

### Keepass Twofish plugin security

Keepass is a well known open-source password manager program, with plugin support. One of the offered plugin is a twofish encryption mode of operation in lieu of the build-in AES algorithm ...
127 views

### Can anyone explain most popular RSA attacks like I'm 5?

Suppose I implement RSA myself in C and I use just the formulas from number theory. What attacks would my implementation be vulnerable to? Can anyone explain this to me like I'm 5?
187 views

### IV and Headers inside cipher text

I am a bit confused about the use of IV, and key hash. Is the key hash and IV stored inside the headers of the cipher text? Isn't it a security risk to store this header information? By key hash I ...
111 views

### Merkle path authentication

In point 4 of the Algorithm 4.2 (Classic Merkle Tree Traversal) of *"Post_Quantum_Cryptography.pdf"* shows *"Stack_h.update(2)"* each stack receives two updates. I am trying understand to understand ...
114 views

### openssl logs showing keyblock length of only 88 bytes instead of 136 bytes

I was decrypting TLS encrypted data from wireshark using the openssl(TLS1.0 version) TLS logs which provides the complete key block which of size 136 bytes.Now i moved to TLS(1.2 version) in that Key ...
57 views

### Are there any bi-bidirectionally indistinguishable Asymmetric Encryption Algorithms

I have been using Asymmetric Encryption for a while, and I have come across an interesting concept, and it would be cool if it could be done. Are there any Asymmetric Encryption Algorithms where the ...
95 views

### can permutation matrix be found in parallel processing technique?

Let us say there exists a permutation matrix $n \times n$ for some large $n$. Then, there are $n!$ possible permutations. If one to use brute-force to find the secret permutation among $n!$ ...
89 views

### Rating a steganographic system using Blum Blum Shub to locate hidden bits

Currently I'm building a toy steganography system based in a web browser. Besides all the obvious issues with building a system requiring extreme privacy into a browser (this is a toy!), I was curious ...
335 views

### Non-malleable file encryption using AES XTS 256?

I'm looking to do file encryption of a bunch of individual files, some small, some quite large. The files will be write-once/read-many, so I could use CBC, however, since the read-access needs to ...
162 views

### How is key rotation defined?

I'm aware that it's advisable to rotate cryptographic keys periodically. HKDF accepts high-entropy input (IKM - Input Key Material), and expands it to an arbitrary length. It also accepts a salt, ...
71 views

127 views

### Quadratic Sieve Bottleneck, Multiple Polynomials an option?

After my failed attempt at trying to implement the ECM, I started working on the quadratic sieve. It works, but the bottleneck is finding smooth values over the factor base. The way I implemented it ...
109 views

### Timestamping services authorities, utilizing Linked, hybrid and other than PKI schemes

What are well respected Cryptographic Timestamping authorities utilizing more sophisticated than just PKI (RFC 3161) schemes, like Linked, Linked and signed, distributed hash trees (maybe P2P?), ...
195 views

### Is TOTP or a timestamp encryption a better timestamp-based authentication token system?

Are there advantages to using TOTP over encrypting a timestamp with a shared secret, in cases where the readability or ease of typing the token are not important?
192 views

### Proper formatting of symmetric algorithm secret key

Given this description from RFC 4880 sec 5.1: The value "m" in the above formulas is derived from the session key as follows. First, the session key is prefixed with a one-octet algorithm ...
220 views

### Most frequently used digital signature schemes in the recent years

I am looking to understand if there are any hard figures on which digital signature schemes are most commonly in use today. I'm only really interested in what is employed recently (ie. last couple ...
3 views

### Difference between Kerberos and GDOI?

What is the difference between Kerberos and GDOI, I know first is more toward authentication and latter is more toward multicast key management, can I use Kerberose protocol in GDOI for server and ...

15 30 50 per page


text:
# Measurement noise assessment¶

In this notebook, we illustrate how to use pyABC with different noise models. For simplicity, we use a simple ODE model of a conversion reaction. For simplicity, we consider a single parameter:

[1]:

import numpy as np
import scipy as sp
import matplotlib.pyplot as plt
import pyabc
%matplotlib inline

init = np.array([1, 0])

def f(y, t0, theta1, theta2=np.exp(-2)):
x1, x2 = y
dx1 = - theta1 * x1 + theta2 * x2
dx2 =   theta1 * x1 - theta2 * x2
return dx1, dx2

theta1_true = np.exp(-2.5)
theta_true = {'theta1': theta1_true}

theta_min, theta_max = 0.05, 0.15
prior = pyabc.Distribution(
theta1=pyabc.RV("uniform", theta_min, theta_max-theta_min))

n_time = 10
measurement_times = np.linspace(0, 10, n_time)

We assume that the underlying dynamics of our observations follow the following model:

[2]:

def model(pars):
sol = sp.integrate.odeint(
f, init, measurement_times,
args=(pars["theta1"],))
return {'X_2': sol[:,1]}

true_trajectory = model(theta_true)

However, we assume that our measurements are subject to additive Gaussian noise:

[3]:

sigma = 0.02

def model_noisy(pars):
sim = model(pars)
return {'X_2': sim['X_2'] + sigma * np.random.randn(n_time)}

measured_data = model_noisy(theta_true)

# plot data
plt.plot(measurement_times, true_trajectory['X_2'], color="C0",
label='Simulation')
plt.scatter(measurement_times, measured_data['X_2'],
color="C1", label='Data')
plt.xlabel('Time $t$')
plt.ylabel('Measurement $Y$')
plt.title('Conversion reaction: True parameters fit')
plt.legend()
plt.show()

## Ignoring noise¶

In the notebook “Ordinary Differential Equations: Conversion Reaction”, this model is used without accounting for a noise model, which is strictly speaking not correct. In this case, we get the following result:

[4]:

def distance(simulation, data):
return np.absolute(data["X_2"] - simulation["X_2"]).sum()

abc = pyabc.ABCSMC(model, prior, distance)
abc.new(pyabc.create_sqlite_db_id(), measured_data)
history = abc.run(max_nr_populations=10)

INFO:Sampler:Parallelizing the sampling on 4 cores.
INFO:History:Start <ABCSMC(id=128, start_time=2020-06-15 19:23:37.333605, end_time=None)>
INFO:ABC:Calibration sample before t=0.
INFO:Epsilon:initial epsilon is 0.5624782572935602
INFO:ABC:t: 0, eps: 0.5624782572935602.
INFO:ABC:Acceptance rate: 100 / 229 = 4.3668e-01, ESS=1.0000e+02.
INFO:ABC:t: 1, eps: 0.3394877969449191.
INFO:ABC:Acceptance rate: 100 / 201 = 4.9751e-01, ESS=9.9892e+01.
INFO:ABC:t: 2, eps: 0.19851989584245494.
INFO:ABC:Acceptance rate: 100 / 210 = 4.7619e-01, ESS=9.9249e+01.
INFO:ABC:t: 3, eps: 0.15919232295862715.
INFO:ABC:Acceptance rate: 100 / 200 = 5.0000e-01, ESS=9.9827e+01.
INFO:ABC:t: 4, eps: 0.14438278698726847.
INFO:ABC:Acceptance rate: 100 / 215 = 4.6512e-01, ESS=9.9683e+01.
INFO:ABC:t: 5, eps: 0.1370462087460876.
INFO:ABC:Acceptance rate: 100 / 223 = 4.4843e-01, ESS=9.9604e+01.
INFO:ABC:t: 6, eps: 0.1346182762154195.
INFO:ABC:Acceptance rate: 100 / 198 = 5.0505e-01, ESS=9.8976e+01.
INFO:ABC:t: 7, eps: 0.13449453193467115.
INFO:ABC:Acceptance rate: 100 / 239 = 4.1841e-01, ESS=9.4218e+01.
INFO:ABC:t: 8, eps: 0.13444005696155228.
INFO:ABC:Acceptance rate: 100 / 209 = 4.7847e-01, ESS=9.5063e+01.
INFO:ABC:t: 9, eps: 0.13439720882423833.
INFO:ABC:Acceptance rate: 100 / 256 = 3.9062e-01, ESS=9.8735e+01.
INFO:History:Done <ABCSMC(id=128, start_time=2020-06-15 19:23:37.333605, end_time=2020-06-15 19:23:41.795215)>

As one can see in the below plot, this converges to a point estimate as $$\varepsilon\rightarrow 0$$, and does not correctly represent the posterior. In particular, in general this point estimate will not capture the correct parameter value (indicated by the grey line).

[5]:

_, ax = plt.subplots()
for t in range(history.max_t + 1):
pyabc.visualization.plot_kde_1d_highlevel(
history, x="theta1", t=t, refval=theta_true, refval_color='grey',
xmin=theta_min, xmax=theta_max, numx=100, ax=ax, label=f"Iteration {t}")
ax.legend()
plt.show()

## Add noise to the model output¶

To correctly account for noise, there are essentially two possibilities: Firstly, we can use the noisified model output:

[6]:

abc = pyabc.ABCSMC(model_noisy, prior, distance)
abc.new(pyabc.create_sqlite_db_id(), measured_data)
history_noisy_output = abc.run(max_nr_populations=10)

INFO:Sampler:Parallelizing the sampling on 4 cores.
INFO:History:Start <ABCSMC(id=129, start_time=2020-06-15 19:23:42.824635, end_time=None)>
INFO:ABC:Calibration sample before t=0.
INFO:Epsilon:initial epsilon is 0.6026361265317445
INFO:ABC:t: 0, eps: 0.6026361265317445.
INFO:ABC:Acceptance rate: 100 / 201 = 4.9751e-01, ESS=1.0000e+02.
INFO:ABC:t: 1, eps: 0.40307937702819413.
INFO:ABC:Acceptance rate: 100 / 183 = 5.4645e-01, ESS=9.9927e+01.
INFO:ABC:t: 2, eps: 0.26804878544751437.
INFO:ABC:Acceptance rate: 100 / 254 = 3.9370e-01, ESS=9.8752e+01.
INFO:ABC:t: 3, eps: 0.23005068461777956.
INFO:ABC:Acceptance rate: 100 / 269 = 3.7175e-01, ESS=8.7397e+01.
INFO:ABC:t: 4, eps: 0.19748032366319818.
INFO:ABC:Acceptance rate: 100 / 535 = 1.8692e-01, ESS=9.5180e+01.
INFO:ABC:t: 5, eps: 0.18275242228026406.
INFO:ABC:Acceptance rate: 100 / 793 = 1.2610e-01, ESS=8.6146e+01.
INFO:ABC:t: 6, eps: 0.16605305697113107.
INFO:ABC:Acceptance rate: 100 / 1622 = 6.1652e-02, ESS=7.6403e+01.
INFO:ABC:t: 7, eps: 0.15351169146934754.
INFO:ABC:Acceptance rate: 100 / 3122 = 3.2031e-02, ESS=8.4115e+01.
INFO:ABC:t: 8, eps: 0.1418635171783479.
INFO:ABC:Acceptance rate: 100 / 5402 = 1.8512e-02, ESS=8.8656e+01.
INFO:ABC:t: 9, eps: 0.12830890205714054.
INFO:ABC:Acceptance rate: 100 / 12580 = 7.9491e-03, ESS=8.4644e+01.
INFO:History:Done <ABCSMC(id=129, start_time=2020-06-15 19:23:42.824635, end_time=2020-06-15 19:23:59.654520)>

[7]:

_, ax = plt.subplots()
for t in range(history_noisy_output.max_t + 1):
pyabc.visualization.plot_kde_1d_highlevel(
history_noisy_output, x="theta1", t=t,
refval=theta_true, refval_color='grey',
xmin=theta_min, xmax=theta_max, ax=ax, numx=200, label=f"Iteration {t}")
ax.legend()

[7]:

<matplotlib.legend.Legend at 0x7feef67a5ac0>

This curve is much broader and, as one can show, closer to the correct posterior.

## Modify the acceptance step¶

Secondly, we can alternatively use the non-noisy model, but adjust the acceptance step:

[8]:

acceptor = pyabc.StochasticAcceptor()
kernel = pyabc.IndependentNormalKernel(var=sigma**2)
eps = pyabc.Temperature()

abc = pyabc.ABCSMC(model, prior, kernel, eps=eps, acceptor=acceptor)
abc.new(pyabc.create_sqlite_db_id(), measured_data)
history_acceptor = abc.run(max_nr_populations=10)

INFO:Sampler:Parallelizing the sampling on 4 cores.
INFO:History:Start <ABCSMC(id=130, start_time=2020-06-15 19:24:00.496237, end_time=None)>
INFO:ABC:Calibration sample before t=0.
INFO:ABC:t: 0, eps: 18.524729283158507.
INFO:ABC:Acceptance rate: 100 / 383 = 2.6110e-01, ESS=1.0000e+02.
INFO:ABC:t: 1, eps: 2.384675437876244.
INFO:ABC:Acceptance rate: 100 / 349 = 2.8653e-01, ESS=9.8885e+01.
INFO:ABC:t: 2, eps: 1.0.
INFO:ABC:Acceptance rate: 100 / 190 = 5.2632e-01, ESS=9.6103e+01.
INFO:ABC:Stopping: minimum epsilon.
INFO:History:Done <ABCSMC(id=130, start_time=2020-06-15 19:24:00.496237, end_time=2020-06-15 19:24:04.042482)>

We use a pyabc.StochasticAcceptor for the acceptor, replacing the default pyabc.UniformAcceptor, in order to accept when

$\frac{\pi(D|y,\theta)}{c}\geq[0,1],$

where $$\pi(D|y,\theta)$$ denotes the distribution of noisy data $$D$$ given non-noisy model output $$y$$ and parameters $$\theta$$. Here, we use a pyabc.IndependentNormalKernel in place of a pyabc.Distance to capture the normal noise $$\pi(D|y,\theta)\sim\mathcal{N}(D|y,\theta,\sigma)$$. Also other noise models are possible, including Laplace or binomial noise. In place of the pyabc.Epsilon, we employ a pyabc.Temperature which implements schemes to decrease a temperature $$T\searrow 1$$, s.t. in iteration $$t$$ we sample from

$\pi(\theta,y|D) \propto \pi(D|y,\theta)^{1/T_t}p(y|\theta)\pi(\theta),$

where $$p(y|\theta)$$ denotes the model output likelihood, and $$\pi(\theta)$$ the parameters prior.

Each of acceptor, kernel and temperature offers various configuration options, however the default parameters have shown to be quite stable already.

[9]:

_, ax = plt.subplots()
for t in range(history_acceptor.max_t + 1):
pyabc.visualization.plot_kde_1d_highlevel(
history_acceptor, x="theta1", t=t,
refval=theta_true, refval_color='grey',
xmin=theta_min, xmax=theta_max, ax=ax, numx=200, label=f"Iteration {t}")
ax.legend()
plt.show()

We see that we get essentially the same posterior distribution as with the noisy output (a bit more peaked, showing that the approximation error with the noisy output was not negligible yet), however at a much lower computational cost, as the below plot shows:

[10]:

histories = [history_noisy_output, history_acceptor]
labels = ["noisy model", "stochastic acceptor"]

pyabc.visualization.plot_sample_numbers(histories, labels)
plt.show()

Thus, the stochastic acceptor is the proposed method to use in practice. For further details consult the API documentation.

## Estimate noise parameters¶

Our formulation of the modified acceptance step allows the noise model to be parameter-dependent (so does in theory also the noisified model output). Thus one can estimate parameters like e.g. the standard deviation of Gaussian noise on-the-fly. A parameter-dependent noise model is specified by passing a function to the kernel, which takes the parameters and returns an array of variances corresponding to the data. This is currently implemented for the pyabc.IndependentNormalKernel, pyabc.IndependentLaplaceKernel, pyabc.BinomialKernel.

Parameters are often estimated on a logarithmic scale if fold changes are of interest. We show this here exemplarily with the example of the standard deviation of a normal noise kernel:

[11]:

theta_true_var = {'theta1': theta1_true, 'std': np.log10(sigma)}

prior = pyabc.Distribution(
theta1=pyabc.RV("uniform", theta_min, theta_max-theta_min),
std=pyabc.RV("uniform", -2.5, 2))

def var(p):
return 10**(2*p['std']) * np.ones(n_time)

acceptor = pyabc.StochasticAcceptor()
kernel = pyabc.IndependentNormalKernel(var=var)
eps = pyabc.Temperature()

abc = pyabc.ABCSMC(model, prior, kernel, eps=eps, acceptor=acceptor, population_size=100)
abc.new(pyabc.create_sqlite_db_id(), measured_data)
history_acceptor_var = abc.run(max_nr_populations=10)

INFO:Sampler:Parallelizing the sampling on 4 cores.
INFO:History:Start <ABCSMC(id=131, start_time=2020-06-15 19:24:04.966413, end_time=None)>
INFO:ABC:Calibration sample before t=0.
INFO:ABC:t: 0, eps: 18.853333200943837.
INFO:ABC:Acceptance rate: 100 / 315 = 3.1746e-01, ESS=9.9992e+01.
INFO:ABC:t: 1, eps: 11.24653846776521.
INFO:ABC:Acceptance rate: 100 / 313 = 3.1949e-01, ESS=8.5619e+01.
INFO:ABC:t: 2, eps: 7.119315454596579.
INFO:ABC:Acceptance rate: 100 / 323 = 3.0960e-01, ESS=7.6864e+01.
INFO:ABC:t: 3, eps: 4.827923867251667.
INFO:ABC:Acceptance rate: 100 / 423 = 2.3641e-01, ESS=8.3261e+01.
INFO:ABC:t: 4, eps: 3.7136446447402682.
INFO:ABC:Acceptance rate: 100 / 367 = 2.7248e-01, ESS=6.6476e+01.
INFO:ABC:t: 5, eps: 2.8565397729146036.
INFO:ABC:Acceptance rate: 100 / 347 = 2.8818e-01, ESS=6.6422e+01.
INFO:ABC:t: 6, eps: 2.1972537102600755.
INFO:ABC:Acceptance rate: 100 / 377 = 2.6525e-01, ESS=7.4152e+01.
INFO:ABC:t: 7, eps: 1.6901301053216593.
INFO:ABC:Acceptance rate: 100 / 367 = 2.7248e-01, ESS=6.8683e+01.
INFO:ABC:t: 8, eps: 1.1783208490227317.
INFO:ABC:Acceptance rate: 100 / 389 = 2.5707e-01, ESS=6.4552e+01.
INFO:ABC:t: 9, eps: 1.0.
INFO:ABC:Acceptance rate: 100 / 266 = 3.7594e-01, ESS=7.6172e+01.
INFO:ABC:Stopping: minimum epsilon.
INFO:History:Done <ABCSMC(id=131, start_time=2020-06-15 19:24:04.966413, end_time=2020-06-15 19:24:15.057312)>

[12]:

fig, ax = plt.subplots(1, 2)
for t in range(history_acceptor_var.max_t + 1):
pyabc.visualization.plot_kde_1d_highlevel(
history_acceptor_var, x="theta1", t=t,
refval=theta_true_var, refval_color='grey',
xmin=theta_min, xmax=theta_max, ax=ax[0], numx=200, label=f"Iteration {t}")
pyabc.visualization.plot_kde_1d_highlevel(
history_acceptor_var, x="std", t=t,
refval=theta_true_var, refval_color='grey',
xmin=-2.5, xmax=-0.5, ax=ax[1], numx=200, label=f"Iteration {t}")
ax[1].set_xlabel("log10(std)")
ax[1].set_ylabel(None)
ax[1].legend()
fig.set_size_inches((8, 4))
fig.tight_layout()
plt.show()

We see that we are able to estimate both parameters quite reasonably (the exact details of course depending on the data and model). For the present model, one could still derive the analytical posterior distribution, which we here omit for computational reasons. For an example, see this notebook.


text:
Common Lisp is a dynamically, but strongly typed language. The variables carry the type information that can be fetched at runtime, and hence, the type errors are detected dynamically. In this way, it is most similar to Python, which, too, is a dynamically but strongly typed language.

All values in Common Lisp conceptually are references objects. Assigning a new value to a variable only makes it refer to the new object. It does not change the referrent. This is very much like how Python names and bindings work and unlike C++ references, which themselves are always const. Of course, if a variable holds a reference to a mutable object, it is always possible to modify it via the reference, and the changes will be visible via all other references to that object.

A binding is the runtime manifestation of a variable. For example, when a function is called, the variables in the parameter list of the function definition are bound by Lisp to the objects that are the actual arguments of that particular call. A single variable can end up having many different bindings during the run of a program - it can even have multiple bindings at the same time, e.g., for a function parameter variable during a recursive function calls.

## The LET special operator

Apart from DEFUN, another way of introducing variables is the LET special operator. The general form of a LET command is this:

(let (variable*)
body-form*)

Here, each variable is a variable initialization form, which is either a list containing a variable name and an initial value or just a variable name, which gets an initial value of NIL.

(let ((x 10) (y 20) z)
(list x y z))

;; (10 20 NIL)

That code binds the variables x, y and z to values 10, 20 and NIL, respectively.

When a LET form is encountered, all the initialization forms are evaluated first and then new bindings are created for the variables to the initial values before any of the body forms are executed. Within the body of LET, the variable names refer to the newly created bindings. After the LET, the names refer to whatever they were referring to before the LET. Everytime a LET is entered, the variables are rebound. The return value of a LET form is the value of the last expression evaluated in its body.

## Scope

The scope of both LET variables and function parameters is delimited by the form they were introduced in, which in turn is called the binding form. Nesting binding forms that introduce variables with the same name causes the binding of the innermost variable shadows all outer bindings.

CL-USER> (defun foo (x)
(format t "Parameter: ~a~%" x)
(let ((x 2))
(format t "Outer LET: ~a~%" x)
(let ((x 3))
(format t "Inner LET: ~a~%" x))
(format t "Outer LET: ~a~%" x))
(format t "Parameter: ~a~%" x))

FOO
CL-USER> (foo 4)
Parameter: 4
Outer LET: 2
Inner LET: 3
Outer LET: 2
Parameter: 4
NIL

In general, any construct that introduces a new variable name that is usable only within that construct is a binding form. For example, the DOTIMES macro, which is a basic counting loop, introduces a counter variable that is incremented at every iteration, upto a certain count.

(dotimes (x 10) (format t "~a " x))
;; 0 1 2 3 4 5 6 7 8 9

Another binding form, called LET* allows one to use previously defined variables in the variable list to initialize a variable. e.g., this is possible:

(let* ((x 10)
(y (* x x)) ; note that x was used to initialize y.
(list x y))

## Lexical variables and closures

Lexical variables in Lisp are like the lexically scoped local variables of other languages like Python, C++. A lexical variable binding can be accessed by all code that lies textually within the binding form of that variable. But there is a twist, when nested functions come into the play.

(let ((count 0))
#'(lambda ()
(setf count (1+ count))))

Here, as we enter the LET, a binding for count gets created, and the value returned from the LET is a function that accesses the count binding from its enclosing scope. All fine so far, since the lambda itself lies textually within the binding form of the count variable. But, when this lambda is returned to the caller of the LET, and invoked from there, that code is not textually within the LET. But as it turns out, this works perfectly fine.

(defparameter *fn* (let ((count 0))
#'(lambda ()
(setf count (1+ count)))))
(funcall *fn*) ;; 1
(funcall *fn*) ;; 2
(funcall *fn*) ;; 3
...

As we can see, if count is a lexical variable, any bindings created for it are retained for as long as needed, in this case, for as long as someone holds a reference to the returned lambda. The inner lambda is a full closure.

The key point to note is that it is the bindings that are captured in an inner function, and not just the value, which means that not only can the inner function access the value of the captured variable, it can also assign new values to it and they will persist between calls.

A single closure can close over multiple variable bindings by simply referring to them. Similarly, multiple closures can also capture the same binding.

# Common Lisp - Dynamic variables

Sometimes global variables are needed to store stuff like standard I/O stream handles. In lisp, global variables are nicer to manage than their counterparts in other languages. These variables are called dynamic variables in Lisp, and as a convention, their names start and end with a *. There are two ways to define dynamic variables, DEFVAR and DEFPARAMETER. DEFVAR assigns to the variable only if it is undefined, while DEFPARAMETER works regardless. Both DEFVAR and DEFPARAMETER take a variable name, an initial value and an optional documentation string. One can leave out the initial value in a DEFVAR, which results in an unbound dynamic variable.

(defvar *count* 0
"Count of widgets made so far.")

(defparameter *gap-tolerance* 0.001
"Tolerance to be allowed in widget gaps.")

## Rebinding dynamic variables

Sometimes, we need to be able to change the value of a global variable just for a part of our code. For example, the *standard-output* global variable is bound to the standard output stream. One might want a part of the code calling functions that write to *standard-output* to actually write to a file instead of writing it to stdout. We can do this by assigning to *standard-output* a handle to our file, executing our code and resetting *standard-output* to stdout. But a neater a way is provided by Lisp. Whenever a form introduces a variable having the same name as a dynamic variable, all code within the binding form and all code called by this code see the new binding. So for example, we can do this:

(format t "This will be printed to stdout.~%")

(let ((*standard-output* *some-other-stream*))
(format t "This will be printed to a file.~%"))

(format t "This will again be printed to stdout.~%")

What is important to note is that while lexical variable bindings are seen only by code textually within the binding form of the variables(and closures, of course), all code CALLED from a binding form of a dynamic variable also sees the new binding. The binding is restored as soon as the binding form is done executing.

An example:

CL-USER> (defvar *x* 10)
*X*
CL-USER> (defun foo () (format t "x: ~d~%" *x*))
STYLE-WARNING: redefining COMMON-LISP-USER::FOO in DEFUN
FOO
CL-USER> (foo)
x: 10
NIL
CL-USER> (let ((*x* 100)) (foo))
x: 100
NIL
CL-USER> (foo)
x: 10
NIL

All variables defined using DEFVAR and DEFPARAMETER are declared globally special. This means that whenever a binding form tries to create a binding for a variable that has been declared special, a dynamic binding is created instead of a normal, lexical binding.

These examples I got from folks in #lisp on Freenode made the difference between lexical bindings and dynamic bindings even clearer to me:

(defun foo (x)
(let ((l (lambda () x))
(x 3))
(funcall l)))

(foo 1) ;; returns 1

(let ((l lambda () *x*)
(*x* 3))
(funcall l)) ;; returns 3

## Constants

Constants can be defined using DEFCONSTANT, which has the same form as DEFPARAMETER,

(defconstant name initial-value-form [documentation-string])

Constants declared in this way are always global. They can’t be rebound in any way. The convention while naming a constant is to have the name start and end with +plus-signs+.

## Assignment

Since all symbols evaluate to the value of the variable they name, getting the value of a variable is as easy as referring to it. The workhorse for assignment in Common Lisp is the SETF macro, which by virtue of being a macro, can examine its arguments, and hence be a generic assignment operator. The general form is

(setf place value)

e.g.,

(setf x 10)

assigns the value 10 to the variable x. Assigning a new value to a binding has no effect on any other bindings of that variable or on the actual value stored in the binding prior to the assignment. Thus calling foo:

(defun foo (x)
(setf x 10))

will not have any effect on any value outside foo. Concretely, a form like:

(let ((y 20))
(foo y)
(print y))

prints 20, not 10.

Multiple assignments can be done with one SETF:

(setf x 1 y 2)

will assign 1 to x and 2 to y. Also, since setf(like assignment operators in most other languages) returns the assigned value, assignments can be chained:

(setf x (setf y (random 10)))

will set both x and y to the same random number. Note that this is similar to x = y = random.randint(0, 10) in Python.

SETF can be used to assign not only to variables, but to any place that can hold a value. Examples include, an array element, a field slot of a user-defined object, an entry in a hashtable, etc. This is intuitive, as the assignment operator = works in exactly the same way in most other languages - it can be used to assign to object members, array elements, hashtable entries, regular variables, etc.

SETFing a place which is a part of a larger object has the same semantics as regular SETF on a variable - it does not affect the value that was stored previously in that place. This is just like how Python/Java do it.

## Other ways to modify places

While SETF is a very general assignment tool that is the go to place for almost all assignment needs, certain assignment patterns are common enough to justify the inclusion of their own operators. e.g., the increment operation, which is used to increment a value by 1, can be written using SETF as

(setf x (+ x 1))

But increments and decrements are very commonplace and having more concise ways of performing them makes sense.

(incf x) ;; Equivalent to (setf x (+ x 1))

(decf x) ;; Equivalent to (setf x (- x 1))

INCF and DECF belong to a class of macros called modifier macros. Modifier macros are built on top of SETF to modify the value at a place. When the place argument to a modifier macro is an expression that needs to be evaluated once (which typically is the case when evaluation of the place form results in some side-effects), modify macros do the right thing. Generally, they are guaranteed to evaluate both their arguments and the subforms of the place form exactly once. For example, let us consider the following INCF:

;; Increment a random element in *array*
(incf (aref *array* (random (length  *array))))

A naive translation to SETF might look like this:

(setf (aref *array* (random (length *array*)))
(1+ (aref *array* (random (length *array*)))))

But that call to RANDOM is not deterministic, the second AREF might not give the same element of the array as the first call. A more sane approach here would be to use a temporary variable to hold the random number in a LET and then use that in both the AREFs. INCF takes care of all this.

Two other useful modifier macros are ROTATEF and SHIFTF. ROTATEF rotates the values between the places it takes as arguments.

(rotatef a b) ;; swap the values in a and b

CL-USER> (let ((a 0) (b 1) (c 2))
(format t "~a~%" (list a b c))
(rotatef a b c)
(format t "~a~%" (list a b c)))
(0 1 2)
(1 2 0)
NIL

SHIFTF shifts the values in the places in its argument list, till the second last argument, one place to the left. The second last place itself is given the last argument’s value.

CL-USER> (let ((a 0) (b 1) (c 2))
(format t "~a~%" (list a b c))
(shiftf a b c)
(format t "~a~%" (list a b c)))
(0 1 2)
(1 2 2)
NIL

So here, a gets b’s value, b gets c’s. But c being the last argument, it is treated as a filler value for the second last argument, b, and is not itself modified. The value of the first argument is the return value of SHIFTF.

All in all, variables in Lisp are pretty easy to grok, especially if one understands how names/bindings work in Python(as was the case with me). It is fascinating how one of the earliest programming languages just gets variables right, complete with dynamic typing.