title: Machine learning approaches for malware classification based on hybrid artefacts

authors: Chanajitt, Rajchada

subjects: Static

abstract: Malware could be developed and transformed into various forms to deceive users and evade antivirus and security endpoint detection. Furthermore, if one machine in the network is compromised, it could be used for lateral movement--when malware spreads stealthily without sending an alarm to monitoring systems. Malware attacks pose security threats to modern enterprises and can cause massive financial, reputation, and data loss to major enterprises. Therefore, it is important to detect these attacks effectively to reduce the loss to the minimum level. The current research uses different approaches, including static and dynamic analysis, to detect and analyze malware categories using distinct feature sets, such as imported modules, opcodes, and API calls, which can improve performance in binary and multi-class classification problems.

This thesis proposes a method for identifying and analyzing malware samples via static and dynamic approaches, including memory analysis and consecutive application operation sequences performed on the Windows 10 virtual environment. Standard classifiers and frequently used sequence models are utilized to expose the malware characteristics and benefit predictive capabilities. The features used in these algorithms are extracted from the static and dynamic analysis of malware samples, such as the rich header feature, debug information, temporary files, prefetch files, and event logs. The measurement of the classifiers and the degree of correctness are calculated using the accuracy, f1-score, Mean Absolute Error (MAE), confusion matrix, and Area under the ROC Curve (AUC). Combining two feature sets can provide the best classification performance on static file properties and dynamic analysis results, regardless of whether applying feature selection or not, achieving the accuracy and f1_score at 97% for integrating two datasets. For consecutive sequences, concatenating the Gated Recurrent Unit (GRU) and Transformers model can yield the highest accuracy at 97% for Noriben operations, while GRU can achieve the maximum accuracy for Opcode sequences at 89%.

text: Machine learning approaches for malware classification based on hybrid artefacts Malware could be developed and transformed into various forms to deceive users and evade antivirus and security endpoint detection. Furthermore, if one machine in the network is compromised, it could be used for lateral movement--when malware spreads stealthily without sending an alarm to monitoring systems. Malware attacks pose security threats to modern enterprises and can cause massive financial, reputation, and data loss to major enterprises. Therefore, it is important to detect these attacks effectively to reduce the loss to the minimum level. The current research uses different approaches, including static and dynamic analysis, to detect and analyze malware categories using distinct feature sets, such as imported modules, opcodes, and API calls, which can improve performance in binary and multi-class classification problems.

This thesis proposes a method for identifying and analyzing malware samples via static and dynamic approaches, including memory analysis and consecutive application operation sequences performed on the Windows 10 virtual environment. Standard classifiers and frequently used sequence models are utilized to expose the malware characteristics and benefit predictive capabilities. The features used in these algorithms are extracted from the static and dynamic analysis of malware samples, such as the rich header feature, debug information, temporary files, prefetch files, and event logs. The measurement of the classifiers and the degree of correctness are calculated using the accuracy, f1-score, Mean Absolute Error (MAE), confusion matrix, and Area under the ROC Curve (AUC). Combining two feature sets can provide the best classification performance on static file properties and dynamic analysis results, regardless of whether applying feature selection or not, achieving the accuracy and f1_score at 97% for integrating two datasets. For consecutive sequences, concatenating the Gated Recurrent Unit (GRU) and Transformers model can yield the highest accuracy at 97% for Noriben operations, while GRU can achieve the maximum accuracy for Opcode sequences at 89%.

year: 2023

title: Contemporary pressures on school-based research: A cautionary tale for school leaders

authors: Smith, Megan

subjects: School-based research

abstract: School-based research has historically played an important role within the education system contributing to our understanding of the organisation and practice of formal education. Supported by relevant literature, this article reports on current challenges in conducting school-based research in Aotearoa New Zealand as experienced by one researcher. It suggests that conducting school-based research is becoming increasingly difficult, with possible explanations for this being the divergent workflows of researcher and school-based participant(s), the volume of demands on teachers and schools, and restricted roles for teachers and parents, which increase the risk of research fatigue. The article argues that although school-based research is rarely an immediate priority for school leaders, it is imperative that they support it if they want to be informed by its insights for policy and practice.

text: Contemporary pressures on school-based research: A cautionary tale for school leaders School-based research has historically played an important role within the education system contributing to our understanding of the organisation and practice of formal education. Supported by relevant literature, this article reports on current challenges in conducting school-based research in Aotearoa New Zealand as experienced by one researcher. It suggests that conducting school-based research is becoming increasingly difficult, with possible explanations for this being the divergent workflows of researcher and school-based participant(s), the volume of demands on teachers and schools, and restricted roles for teachers and parents, which increase the risk of research fatigue. The article argues that although school-based research is rarely an immediate priority for school leaders, it is imperative that they support it if they want to be informed by its insights for policy and practice.

year: 2020

title: Street-level bureaucracy and occupational therapy practices in Aotearoa New Zealand. A genealogical critique.

authors: Silcock, Elizabeth Mary

subjects: power

abstract: As a human science that is also part of administering and supporting bureaucracy, occupational therapy functions in multi-layered networks of power  that support many different social structures. Occupational therapists’ work often involves operationalising health, education and social services at the street-level, positioning them between the aspirations of both policy and social activism and material life outcomes. Through a genealogical critique, this thesis problematises the practice of occupational therapy through a Foucauldian lens that views everything as dangerous. By viewing occupational therapy practice as dangerous, the power relations at the street-level of the mundane and taken-for-granted have been problematised as part of much larger social structures of power and discourse. 
Several Foucauldian tools were deployed in order to ensure that a focus on occupational therapy practices was maintained; three distinct research methods were utilised to access a range of heterogeneous genealogical information.  Firstly, an historical archival analysis of the four iterations of the Competencies for Registration for occupational therapists document (1990 to the current day) produced by the regulatory authority, the Occupational Therapy Board of New Zealand, was carried out.  Secondly, practice observations of occupational therapists working in different practice settings were analysed as three individual case studies. Concurrently with these two methods, a critical action method using a research blog was developed to create a medium for public discussion of practice through an open engagement with the profession. The combination of these three methods enabled access to a range of elements for analysis.  Many of these elements inter-linked, overlapped and connected to historically contingent networks of dominant power that have formed through the processes of colonisation, the establishment of the health system and normalised medical practices, and economic forms of governance. The nuances of how occupational therapy is practised at the street-level offered opportunities to contest the dominance of these networks. In all three case studies there was an unspoken understanding and a normalisation of materiality as an accepted and significant element of how the profession practised.  The material regimes of knowledge and material practices in these unspoken norms were highly productive and able to contest other lines of power.  Along with this alternate network of power, the most recent version of the Competencies for Registration offers a further opportunity for occupational therapists to contest dominant power relations in a way that could capitalise on the secure position the profession has developed through its material network of power.  Opportunities for alternate pathways of practice which privilege Te Ao Māori and Te Tiriti o Waitangi are a possibility in the legally sanctioned Competencies. The close connection of occupational therapy practices to real life material outcomes for other people, position the street-level doing of occupational therapists at a juncture where action and decision making can re-configure power relations. Re-thinking practice in terms of what the doing of occupational therapy does in relation to networks of power, is an opportunity for practitioners to enact policy at the street-level in ways that use their ability to influence power from the bottom up whilst being alert to the dangers presented by doing so.

text: Street-level bureaucracy and occupational therapy practices in Aotearoa New Zealand. A genealogical critique. As a human science that is also part of administering and supporting bureaucracy, occupational therapy functions in multi-layered networks of power  that support many different social structures. Occupational therapists’ work often involves operationalising health, education and social services at the street-level, positioning them between the aspirations of both policy and social activism and material life outcomes. Through a genealogical critique, this thesis problematises the practice of occupational therapy through a Foucauldian lens that views everything as dangerous. By viewing occupational therapy practice as dangerous, the power relations at the street-level of the mundane and taken-for-granted have been problematised as part of much larger social structures of power and discourse. 
Several Foucauldian tools were deployed in order to ensure that a focus on occupational therapy practices was maintained; three distinct research methods were utilised to access a range of heterogeneous genealogical information.  Firstly, an historical archival analysis of the four iterations of the Competencies for Registration for occupational therapists document (1990 to the current day) produced by the regulatory authority, the Occupational Therapy Board of New Zealand, was carried out.  Secondly, practice observations of occupational therapists working in different practice settings were analysed as three individual case studies. Concurrently with these two methods, a critical action method using a research blog was developed to create a medium for public discussion of practice through an open engagement with the profession. The combination of these three methods enabled access to a range of elements for analysis.  Many of these elements inter-linked, overlapped and connected to historically contingent networks of dominant power that have formed through the processes of colonisation, the establishment of the health system and normalised medical practices, and economic forms of governance. The nuances of how occupational therapy is practised at the street-level offered opportunities to contest the dominance of these networks. In all three case studies there was an unspoken understanding and a normalisation of materiality as an accepted and significant element of how the profession practised.  The material regimes of knowledge and material practices in these unspoken norms were highly productive and able to contest other lines of power.  Along with this alternate network of power, the most recent version of the Competencies for Registration offers a further opportunity for occupational therapists to contest dominant power relations in a way that could capitalise on the secure position the profession has developed through its material network of power.  Opportunities for alternate pathways of practice which privilege Te Ao Māori and Te Tiriti o Waitangi are a possibility in the legally sanctioned Competencies. The close connection of occupational therapy practices to real life material outcomes for other people, position the street-level doing of occupational therapists at a juncture where action and decision making can re-configure power relations. Re-thinking practice in terms of what the doing of occupational therapy does in relation to networks of power, is an opportunity for practitioners to enact policy at the street-level in ways that use their ability to influence power from the bottom up whilst being alert to the dangers presented by doing so.

year: 2018