9300546
Detecting stealth software with Strider GhostBuster
Stealth malware programs that silently infect enterprise and consumer machines are becoming a major threat to the future of the Internet. Resource hiding is a powerful stealth technique commonly used by malware to evade detection by computer users and anti-malware scanners. In this paper, we focus on a subclass of malware, termed "ghostware", which hide files, configuration settings, processes, and loaded modules from the operating system's query and enumeration application programming interfaces (APIs). Instead of targeting individual stealth implementations, we describe a systematic framework for detecting multiple types of hidden resources by leveraging the hiding behavior as a detection mechanism. Specifically, we adopt a cross-view diff-based approach to ghostware detection by comparing a high-level infected scan with a low-level clean scan and alternatively comparing an inside-the-box infected scan with an outside-the-box clean scan. We describe the design and implementation of the Strider GhostBuster tool and demonstrate its efficiency and effectiveness in detecting resources hidden by real-world malware such as rootkits, Trojans, and key-loggers.
16817937
COMERA: COM Extensible Remoting Architecture
In a distributed object system, remoting architecture refers to the infrastructure that allows client programs to invoke methods on remote server objects in a transparent way. In this paper, we study the strength and limitations of current remoting architecture of COM (Component Object Model), and propose a new architecture called COMERA (COM Extensible Remoting Architecture) to enhance the extensibility and flexibility. We describe several application scenarios and implementations to demonstrate the power of such a componentized remoting architecture.
17187868
Towards dependable home networking: an experience report
As the success of the Web increasingly brings us towards a fully connected world, home networking systems that connect and manage home appliances become the natural next step to complete the connectivity. Although there has been fast-growing interest in the design of smart appliances and environments, there has been little study on the dependability issues, which is essential to making home networking part of our daily lives. The heterogeneity of various in-home networks, the undependable nature of consumer devices, and the lack of knowledgeable system administrators in the home environment introduce both opportunities and challenges for dependability research. We report the dependability problems we encountered and the solutions we adopted in the deployment of the Aladdin home networking system. We propose the use of a soft-state store as a shared heartbeat infrastructure for monitoring the health of diverse hardware and software entities. We also describe a system architecture for connecting powerline devices to enhance dependability, and a monitoring tool for detecting unusual powerline activities potentially generated by intruders, interferences, or ill-behaved devices.
16439255
Privacy Aware Market Basket Data Set Generation: A Feasible Approach for Inverse Frequent Set Mining
Association rule mining has received a lot of attention in the data mining community and several algorithms were proposed to improve the performance of association rule or frequent itemset mining. The IBM Almaden synthetic data generator has been commonly used for performance evaluation. One recent work shows that the data generated is not good enough for benchmarking as it has very different characteristics from real-world data sets. Hence there is a great need to use real-world data sets as benchmarks. However, organizations hesitate to provide their data due to privacy concerns. Recent work on privacy preserving association rule mining addresses this issue by modifying real data sets to hide sensitive or private rules. However, modifying individual values in real data may impact on other, non-sensitive rules. In this paper, we propose a feasible solution to the NPcomplete problem of inverse frequent set mining. Since solving this problem by linear programming techniques is very computationally prohibitive, we apply graph-theoretical results to divide the original itemsets into components that preserve maximum likelihood estimation. We then use iterative proportional fitting method to each component. The technique is experimentally evaluated with two real data sets and one synthetic data set. The results show that our approach is effective and efficient for reconstructing market basket data set from a given set of frequent itemsets while preserving sensitive information.
10128966
Detecting image orientation based on low-level visual content
Accurately and automatically detecting image orientation is of great importance in intelligent image processing. In this paper, we present automatic image orientation detection algorithms based on both the luminance (structural) and chrominance (color) low-level content features. The statistical learning support vector machines (SVMs) are used in our approach as the classifiers. The different sources of the extracted image features, as well as the binary classification nature of SVM, require our system to be able to integrate the outputs from multiple classifiers. Both static combiner (averaging) and trainable combiner (also based on SVMs) are proposed and evaluated in this work. Furthermore, two rejection options (regular and re-enforced ambiguity rejections) are employed to improve orientation detection accuracy by sieving out images with low confidence values during the classification. Large amounts of experiments have been conducted on a database of more than 14,000 images to validate our approaches. Discussions and future directions for this work are also addressed at the end of the paper.
20468093
A Multiplier Structure Based on a Novel Real-time CSD Recoding
Implementation of digital signal processing (DSP) algorithms in hardware, such as field programmable gate arrays (FPGAs), requires a large number of multiplications. In this paper, we introduce a novel multiplier structure that converts from 2's complement to canonical signed digit (CSD) representation in real time. The proposed algorithm increases the number of zero partial products (which can be simplified by shift operations) to approximately 66.7% compared with 50% for modified Booth's recoding. Also, the proposed hardware structure reduces the non-zero partial products to a minimum, and consequently the number of arithmetic operations in the carry-save structure is reduced. So, our proposed hardware decreases both the time required for multiplication and the power consumption of the multiplier. Furthermore, because the proposed structure uses real time CSD recoding, and does not require a fixed value for the multiplier input to be known a priori, the proposed multiplier can be used to implement digital filters with non-fixed filter coefficients, such as adaptive filters.
5958340
Cyclone: A Safe Dialect of C
Cyclone is a safe dialect of C. It has been designed from the ground up to prevent the buffer overflows, format string attacks, and memory management errors that are common in C programs, while retaining C’s syntax and semantics. This paper examines safety violations enabled by C’s design, and shows how Cyclone avoids them, without giving up C’s hallmark control over low-level details such as data representation and memory management.
16143751
Portrait video phone
As the Internet and wirless networks are developed rapidly, the demand of communicating anywhere, anytime on any device emerges. However, most of the current wireless networks still work in low bandwidths, and mobile devices still suffer from weak computational power, short battery lifetime and limited display capability. We developed portrait video phone systems that can run on Pcs and Pocket Pcs at very low bit rates through the Internet. The core technology that portrait video phones employ is the so-called portrait video (or bi-level video) codec. Portrait video codec first converts a full-color video into a black/white image sequence and then compresses it into a black/white portrait-like video. Portrait video processes clearer shape, smoother motion, shorter initial latency, and cheaper computational cost than MPEG2, MPEG4 and H.263 for low bandwidths. Typically the portrait video phone provides QCIF-size video with a frame rate of 5-15 fps for a 9.6 Kbps video bandwidth. The portrait video is so small that it can even be transmitted through an HTTP proxy as text. Experiments show that the portrait video phones work well on ordinary GSM wireless telecommunication networks.