Genetic optimization of a vehicle fuzzy decision system for intersections This paper presents a case study in which an autonomous vehicle must cooperate with a supposedly manually driven one to carry out a cross-roads manoeuvre without risk. The main difference with other intersection systems is that the manual vehicle is driven without paying attention to the controlled one, so a cooperative coordination between vehicles is not possible. In this case is the autonomous vehicle the responsible of adapting its speed to the state of the manually driven, for finalizing the manoeuvre both in a safe and efficient way.For this purpose, a three layer hierarchical fuzzy rule-based system (FRBS) is developed with the aim of dealing with such a situation: the first layer is in charge of detecting the kind of manoeuvre that will be necessary; the second, in the case that an intersection is going to be crossed, is in charge of determining the suitable speed to do so without risk; and the third acts on the vehicle's real speed. The first two layers are implemented by means of fuzzy decision systems, with the second being optimized by a genetic algorithm (GA). The GA evaluates candidates in random simulated scenarios taking into account different factors to calculate the fitness. These factors are: implementing a free collision policy, avoiding unnecessary stops, and terminating the manoeuvre as rapidly as possible. Traffic accidents at urban intersections result in a huge cost to society in terms of deaths, injuries, productivity lost, and property damage. Intersection safety is viewed as a high-priority/high-payoff research area since vehicle collisions at intersections account for somewhere between 25 % and 45 % of all collisions [1] . As intersections make up a very small portion of the roadway, this is a wildly disproportionate amount.. Intelligent Transportation Systems (ITS) apply robotic techniques to achieve safe and efficient driving. In the automotive industry, sensors are mainly used to give information to the driver or to advise him about the presence of a dangerous situation [2] . In some cases, they are connected to a computer that performs some guiding actions, attempting to minimize injuries and prevent collisions [3] .. In a simplified way, studies on autonomous driving mainly fall into two groups -longitudinal (or speed) control [4, 5] which involves the management of the throttle and brake (and sometimes gear changes), and lateral (or steering) control [6? ] .. On the open road, vehicles can be more or less completely autonomous thanks to a proper combination of the aforementioned control systems [7] . Furthermore, there is little need for more than the simple behaviour that keeps the vehicle in the lane, maintains a reasonable distance from other vehicles, and avoids obstacles [8] for obtaining the goal of driving like humans.. In urban environments one of the most important challenges is that, even acting optimally, a vehicle can find itself in a situation in which an accident is unavoidable. We believe that this is due to the implicit characteristics of urban driving: vehicles circulating in crossing directions, low speed limits which actually makes speed control enormously difficult [9] , the existence of pedestrians and bicycles, etc.. The present work is motivated by the future necessity in ITS for information to be shared with manually driven vehicles, as well as to act appropriately in far from optimal situations or with incomplete cooperation. To illustrate this, we propose a scenario of an intersection with no traffic light control which two vehicles are approaching. One of them is driven by a human and the other by the proposed system. The actions that the human driver may perform are unknown to the system, and may even be illegal or dangerous, such as not respecting priority. So the controller must develop behaviours oriented to adapt the speed to the information observed from the manually driven vehicle.. For two or more autonomous vehicles to optimally navigate such an intersection without collision, they must cooperatively determine the order in which they traverse the intersection as well as their speeds [10] . But if one of the vehicles is driven manually, such optimal cooperation is not possible.. Intersections controlled by traffic signals are considered in the literature mainly for optimizing the durations of the light sequence in order to make the traffic more efficient [11, 12] or adaptive [13, 14] , usually by means of multi-agent systems [15, 16] or cellular automata [? ] . Intersections without traffic signals are usually dealt with by means of reservation algorithms [17] , trajectory planning [18] or decision systems [19] . In terms of vehicle control, intersection manoeuvres assume cooperation between approaching vehicles in order to control both speeds [20, 21] or, when no cooperation exist, the autonomous vehicle takes a role of to giving way to the approaching vehicle [22? ].. Due to the suitability of manoeuvres involved in driving a vehicle to be described by means of simple rules, fuzzy logic [23] plays a key role in the development of systems designed to deal with complex traffic situations since it allows the actions and decisions involved to be described in terms of simple rules. For example: if a vehicle is stopped in front of me and I am driving very fast then there exists a collision risk. Fuzzy logic has proven to be a technique well suited to the treatment of all kinds of transportation problems [24, 25] .. We here propose a hierarchical Fuzzy Rule-Based System (FRBS) capable of managing autonomously a vehicle in this situation. Three layers are implemented to this end: (i) deciding whether intersection action is going to be necessary; (ii) calculating the proper speed of approach; and (iii) acting in accordance with the calculated proper speed on the vehicle's pedals.. Since cooperation from the manually driven vehicle can not be assured, it is the responsibility of the autonomous system to finalize the manoeuvre without risk.. The module in charge of determining the appropriate speed of the autonomous vehicle with which to cross the intersection is optimized by means of a genetic algorithm [26] . Genetic algorithms have been widely used in literature for fuzzy controller tuning [27, 28] .. In the present work, 81 FRBS with different granularities at input variables evolves to finally infer the optimal speed to follow by the autonomous vehicle in one of two forms: (i) by an absolute speed reference, or (ii) by a speed reference relative to the vehicle's current speed. Making so, a total of 162 controllers to be optimized. Controllers are evaluated in a set of simulated intersection scenarios. For each scenario, a partial fitness is inferred in accordance with the result of the simulation. I.e., if the controller has caused a collision, the controller is penalized; otherwise, the controller is rewarded according to its effectiveness in terms of changing the vehicle's speed as little as possible.. A novelty in the design of this kind of fuzzy system involving a genetic algorithm lies in the choice of the fitness function. This takes into account all possible situations, making the evaluation on the basis of different scenarios in each generation with the aim of covering as many cases as possible. The number of scenarios in which the individuals are evaluated also varies with time, allowing a less exhaustive evaluation in early generations, and hence considerably reducing the computation time.. The article is structured as follows: section 2 presents the proposed scenario in which two vehicles approach an intersection and the non-controlled one does not cooperate. Section 3 describes in detail the fuzzy architecture designed to manage the autonomous vehicle in such situations. Section ?? defines the genetic optimization process designed with the aim of optimizing the fuzzy controllers. The execution of the optimization process is described in section 5, and the 162 resulting controllers are evaluated and compared in terms of performance and safety. Finally, section 6 presents some concluding remarks and describes planned future work. This paper has presented the design of a fuzzy hierarchical architecture and a genetic optimization process. The architecture is in charge of managing a vehicle in an intersection scenario in which the other approaching vehicle does not cooperate, so that optimal manoeuvring is impossible. It is structured into three layers, each responsible for a lower level decision: (i) to determine the existence of the need for an intersection crossing manoeuvre and its nature (from the left, or from the right), (ii) to determine the appropriate speed with which to drive through the intersection without risk, and (iii) to act in consequence on the vehicle's pedals.. This three-layered structure allows the system both to co-exist with other decision systems implanted in the vehicle, since the first layer is in charge of triggering the full process, and to be implemented in any kind of vehicle, since the third actuation layer is independent of the overall system and can be easily changed.. The core of the decision system is thus in the second layer, which is in charge of the hard task of determining the appropriate speed. To a proper design of this layer, a total of 162 fuzzy controllers with different structures (granularities of the input variables) and output meaning (relative or absolute speed) were tuned by means of a genetic optimization process.. The genetic algorithm implemented takes into account various factors of the problem. It generates random intersection situations with the aim of covering most of the possible situations, thus ensuring the safety of the controller. The number of random situations generated varies according to which generation is being processed in order to reduce computation time by simplifying the early stages of the process (when the individuals are almost random). For this reason, the fitness function of the process changes with time, since the fitness calculated in scenarios of a certain generation may not be repeated in the next. The fitness is calculated by simulating the scenario both with and without controlling the vehicle, and takes into account whether the vehicle causes or avoids a collision to distinguish between nine different possible situations and reward each one appropriately.. The optimization process generated 161 fuzzy controllers. They were compared in terms of: (i) safety by running them on a large number of possible scenarios, and logging the number of collisions they avoided, and (ii) a fitness function to ensure that they do not generate a stop always policy which, while it would ensure safety, would not exactly be very intelligent. Comparisons were made in terms of the controllers' complexity, and the results demonstrated their quality and good performance.. Future work will be in the line of implementing more complex controllers that can lead to more precise behaviour in extreme situations, for example, to also control the steering of the vehicle if a collision is about to occur. Another line will be the generation of controllers to manage the situation in which the non-cooperative vehicle is approaching from the left (with no preference). Finally, the present system will be coordinated with others that are used in autonomous vehicles such as adaptive cruise control with respect to a leading vehicle.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O


Finding consensus trees by evolutionary, variable neighborhood search, and hybrid algorithms The consensus tree problem arises in the domain of phylogenetics and seeks to find for a given collection of trees a single tree best representing it. Usually, such a tree collection is obtained by biologists for a given taxa set either via different phylogenetic inference methods or multiple applications of a non-deterministic procedure. There exist various consensus methods which often have the drawback of being very strict, limiting the resulting consensus tree in terms of its resolution and/or precision. A reason for this typically is the coarse granularity of the tree metric used. To find fully resolved (binary) consensus trees of high quality, we consider the fine-grained TreeRank similarity measure and extend a previously presented evolutionary algorithm (EA) to a memetic algorithm (MA) by including different variants of local search using neighborhoods based on moves of single taxa as well as subtrees. Furthermore, we propose a variable neighborhood search (VNS) with an embedded variable neighborhood descent (VND) based on the same neighborhood structures. Finally sequential and intertwined combinations of the EA and MA with the VNS/VND are investigated. We give results on real and artificially generated data indicating in particular the benefits of the hybrid methods. The consensus tree problem has been first described in [1] alongside with a solution method. It frequently appears in the domain of phylogenetics [13] , though it has applications in other clustering domains as well.. A phylogenetic tree is composed of nodes and branches (arcs) and models the evolutionary relationship between a set L of related objects called taxa. These taxa are the labeled leaf nodes of the tree whereas unlabeled inner nodes represent probably extinct ancestors. In this work we will only consider rooted unweighted binary trees, i.e. there exists a single distinguished root node being the common ancestor of all taxa, the relations represented by the tree are not weighted by any means, and each inner node always has exactly two direct descendants.. The phylogeny problem is to infer the intermediate ancestors and branches, thus to derive the evolutionary relationships, from given species data like DNA or RNA sequences. For this purpose a multitude of conceptually different inference methods exists, each having individual advantages and drawbacks [15] .. Unfortunately, it is likely that biologists end up with several different trees for one and the same taxa set L due to (i) having multiple data sets available, (ii) inferring with different methods, or (iii) repeated runs of the same nondeterministic method.. The question is then how to take advantage of these probably high-quality but different and partly contradictory trees beside manually comparing and merging them. A possible solution is to look for a single tree over L "best" representing the collection T . This non-trivial task is known as the consensus tree problem (CTP).. On the one hand the meaning of "best" depends on the desired information to retain in the consensus tree and on the other hand the possible consensus tree is literally restricted by the degree of strictness of the applied method as well as the granularity of the tree metric used, see also [3] . Figure 1 shows a schematic representation of this circumstance. Generally, a strict method and a coarse-grained metric rather lead to poorly resolved trees with few inner nodes having high degrees, and a substantial portion of the information contained in the input trees is lost. In contrast, we aim at deriving fully resolved (thus, binary) high-quality consensus trees inheriting as much information as possible. Our approach is therefore based on maximizing a more specific fine-grained measure, the so-called TreeRank score.. In Section 2 we report on previous as well as related work and define the TreeRank measure. Meaningful tree neigh-fully resolved borhood structures are presented in Section 3. They are applied in a variable neighborhood search (VNS) with an embedded variable neighborhood descent (VND) as described in Section 4. The neighborhoods are further utilized in Section 5 to extend an existing evolutionary algorithm (EA) by local search to a memetic algorithm (MA). Finally, in Section 6 we consider sequential and intertwined combinations of the EA (MA) and VNS (VND). Experimental results on real and artificially generated CTP instances are given in Section 7, followed by concluding remarks in Section 8. In this work, we introduced four meaningful neighborhood structures for the CTP, whereof Step and Rotate are adopted from approaches for deriving phylogenetic trees, SPRr is a restricted variant of SPR and Swap is a specific form of two Step moves and has not been described before. A previously presented evolutionary algorithm using the fine-grained TreeRank similarity measure has been extended to several memetic algorithm variants by embedding a randomized local search utilizing these neighborhood structures. Thereof the variant using the simple progressive search, which changes the neighborhoods over time, performs best. Furthermore, a variable neighborhood descent procedure that also uses these neighborhood structures has been developed and embedded in a variable neighborhood search. The latter performs shaking by applying an increasing number of random Step moves. The evaluation of neighborhoods could be substantially sped up by implementing a (partly) incremental scheme through updates of the Up- Down matrix. Next, we hybridized the EA and MA with the VNS or the VND by running them either in sequential or intertwined order exchanging improved solutions. Performance has been evaluated with extensive tests on agglomerative clustering, scatter search, and carefully generated artificial instances providing more room for improvement. The MA utilizing SPS, the VNS, and the hybrid approaches are usually able to outperform the EA. On our real-world instances, the VNS turned out to be better than the MA, but on the artificial instances the situation was viceversa. We explained this behavior with the VNS' stronger focus on intensification and weaker diversification abilities.. The hybrid approaches generally perform best, clearly exploiting the benefits of the individual algorithms they combine. Especially the intertwined hybrids yield consistently excellent and in most cases the overall best solutions.. Future work should include experiments on more problem instances with different properties. Promising seems to be the investigation of intertwined hybrids with more sophisticated alteration schemes, in particular since we observed that in some cases the EA or MA is not able to improve the solution in later time-slots anymore. Currently, we are investigating extended versions of the Swap, Step, and SPRr neighborhoods where we exploit the given UpDown distance information to realize guided neighborhood explorations biased towards changing "expensive" (i.e. dissimilar) structures first. A further idea is to consider other neighborhood orders for the VND or even a (self-)adaptive strategy.

O O O O O B I I O O O O B I I O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I I O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Making context-sensitive points-to analysis with heap cloning practical for the real world Context-sensitive pointer analysis algorithms with full "heap cloning" are powerful but are widely considered to be too expensive to include in production compilers. This paper shows, for the first time, that a context-sensitive, field-sensitive algorithm with full heap cloning (by acyclic call paths) can indeed be both scalable and extremely fast in practice. Overall, the algorithm is able to analyze programs in the range of 100K-200K lines of C code in 1-3 seconds, takes less than 5% of the time it takes for GCC to compile the code (which includes no whole-program analysis), and scales well across five orders of magnitude of code size. It is also able to analyze the Linux kernel (about 355K lines of code) in 3.1 seconds. The paper describes the major algorithmic and engineering design choices that are required to achieve these results, including (a) using flow-insensitive and unification-based analysis, which are essential to avoid exponential behavior in practice; (b) sacrificing context-sensitivity within strongly connected components of the call graph; and (c) carefully eliminating several kinds of O(N 2 ) behaviors (largely without affecting precision). The techniques used for (b) and (c) eliminated several major bottlenecks to scalability, and both are generalizable to other context-sensitive algorithms. We show that the engineering choices collectively reduce analysis time by factors of up to 3x-21x in our ten largest programs, and that the savings grow strongly with program size. Finally, we briefly summarize results demonstrating the precision of the analysis. Context-sensitive alias analysis algorithms have been studied intensively over the last two decades, with impressive improvements in algorithmic scalability [7, 10, 35, 14, 13, 22, 11, 12, 23, 34] . To achieve true context-sensitivity, such algorithms must distinguish heap objects by (acyclic) call paths, not just by allocation site; this property is sometimes referred to as "heap cloning" [26] . Heap cloning is important because it allows analyses to distinguish different instances of a logical data structure created at different places in a program, even if the data structure is implemented with a common set of functions (e.g., a data structure library) that allocate memory internally. Such programming patterns are increasingly prevalent particularly in object-oriented programs, where reusable libraries are an important feature. For example, in the LLVM compiler system [19] , which is written in C++, there are no less than 25 static occurrences of a single class (vector<unsigned>). Heap cloning also allows analyses to handle allocations that occur through one or more levels of wrappers in a simple, general manner instead of handling them as a special case (e.g., single-level wrappers [15] ). More quantitatively, Nystrom et al. [26] show that for many programs, naming heap objects only by allocation site (the most common alternative) significantly reduces analysis precision compared with heap specialization by call paths, up to some threshold.. Unfortunately, there is widespread skepticism that algorithms with heap cloning can be scalable and fast enough to be included in production compilers. To date, this skepticism is arguably justified: we know of no previous paper that demonstrates that an alias analysis that uses heap cloning is scalable and fast enough for use in production compilers. Section 6 discusses the current state of the art in more detail. Briefly, two recent algorithms that use different forms of cloning with a subset-based (rather than a unificationbased) analysis have been to shown to be scalable but are still quite slow in absolute running times [34, 25] . At least for now, such algorithms appear too slow to be used in a production compiler, although they may be reasonable for static analysis tools. On the other hand, there are several algorithms that use unification to control the exponential blow-up that can occur with context-sensitivity (with or without heap cloning). The MoPPA algorithm by Liang and Harrold [23] uses heap cloning and is quite fast but exhausts available memory on a workstation with 640MB of memory for their largest program, povray. Their results (and many others) justify the common concern that, in practice, memory consumption can be a limiting factor in scaling context-sensitive analyses. Many other context-sensitive alias analysis papers either do not use heap cloning [22, 11, 12] or (particularly in earlier papers) only report results for relatively small programs of a few thousand lines of code or less and typically make limited or no claims about scalability [7, 10, 35, 14, 13, 27] .. In this paper, we describe an algorithm named Data Structure Analysis (DSA), and use it to present strong evidence that a context-sensitive, field-sensitive algorithm with full heap cloning (by acyclic call paths) can indeed be both scalable and extremely fast in practice. DSA is able to analyze programs in the range of 100K-220K lines of C code in 1-3 seconds, taking less than 5% of the time it takes GCC to compile the program at -O3 (which does no whole-program analysis), and scaling well across five orders of magnitude of code size in terms of both analysis time and memory usage. It is also able to analyze the Linux kernel (about 355K lines of compiled code in our configuration) in 3.1 seconds. These analysis times and scaling behavior appear to be very reasonable for production compilers.. More specifically, DSA is a points-to analysis algorithm that is field-sensitive and context-sensitive with full heap cloning (by acyclic call paths). Like several previous papers, we combine these with a flow-insensitive and unification-based approach to improve scalability [22, 11, 12, 23] . There are three novel features in our algorithm itself:. • First, DSA uses a new extension of Tarjan's SCC finding algorithm to incrementally construct a call graph during the analysis without any iteration, even in the presence of function pointers and recursion. An algorithm by Fähndrich et al. [11] is the only previous work we know that achieves the same property, but they do it by using a constraint instantiation method that appears difficult to extend to incomplete programs, which is essential for production compilers in practice.. • Second, it uses a fine-grain "completeness" tracking technique for points-to sets as a unified solution for several difficult problems that have usually been solved via different techniques before (or ignored): (a) supporting field-sensitivity for non-typesafe languages; (b) correctly supporting incomplete programs, i.e., with unknown external functions; and (c) constructing a call graph incrementally during the analysis. This technique can be used in any alias analysis that explicitly tracks reachability of objects (typically, analyses that use an explicit representation of memory rather than just "aliasing pairs" of references [17] ).. • Third, DSA includes several essential engineering choices developed over time to avoid O(N 2 ) behaviors that were a major bottleneck to scalability in practice. Two of these have been described previously (the globals graph [28, 23] and efficient inlining [28] ) but no experimental results on their benefits have been reported. These choices are generalizable to other context-sensitive algorithms. Our experiments show that each choice contributes substantial speedups, and they collectively achieve 3x-21x reduction in analysis time in our ten largest programs. furthermore this reduction increases strongly with program size, demonstrating that they eliminate significant scalability bottlenecks.. In addition to speed and scalability, the algorithm has several practical strengths that we consider valuable for real-world compilers. Perhaps most important, DSA correctly handles incomplete programs (i.e., programs with unknown external functions): it produces conservative results while still trying to provide aliasing information for as much of a program as possible. To our knowledge, none of the previous context-sensitive, unification-based algorithms [22, 11, 12, 23] can correctly handle incomplete programs. The algorithm supports the full generality of C/C++ programs, including type-unsafe code, function pointers, recursion, setjmp/longjmp, C++ exceptions, etc. The algorithm does not require a call graph as input, as noted earlier (even though it is noniterative).. We compare the precision of our algorithm for alias analysis to Andersen's algorithm [2] (a context-insensitive subset-based algorithm), showing that DSA is about as precise Andersen's for many cases, is significantly more precise for some programs, and is only worse in rare cases. Further, other work [18] shows that the mod-/ref information captured by DSA is significantly better than that computed by non-context-sensitive algorithms.. In addition to alias analysis, DSA can also be used to extract limited information about entire linked data structures: identifying instances of these structures, bounding lifetimes of each instance, and extracting available (flow-insensitive) structural and type information for each identified instance (this capability is the source of the name Data Structure Analysis).. Although this information is significantly more limited than full-blown shape analysis [29, 4, 16] , it is sufficient for many interesting applications. One such application is the Automatic Pool Allocation transformation [20] , which segregates heap objects into distinct pools if the points-to graph can distinguish subsets. This can improve spatial locality significantly for recursive data structure traversals, and can enable other compiler and run-time techniques that wish to modify (or measure) per-data-structure behavior [21] . Another example is the SAFECode compiler for C [8] , which enforces safety properties (memory safety, control-flow integrity, type safety for a subset of objects, and analysis soundness) automatically and with relatively low overhead for unmodified C programs. Type homogeneity of points-to sets enables elimination of run-time checks in SAFECode, reducing its overhead.. The full source code for DSA can be downloaded via anonymous CVS at llvm.org. Because only the first ("local") phase of the algorithm directly inspects the program representation, the implementation should be relatively straightforward to incorporate into other mid-level or low-level compiler systems written in C++.. The next section precisely defines the points-to graph representation computed by our analysis. Section 3 describes the algorithm and analyzes its complexity. Section 4 describes several important engineering choices required for scalability. Section 5 describes our experimental results for algorithm cost and very briefly summarizes the results of two studies of algorithm precision. Section 6 discusses related work and Section 7 briefly summarizes the major conclusions. The experimental results in this paper provide strong evidence that a context-sensitive points-to analysis with full heap cloning (by acyclic call paths) can be made efficient and practical for use in production compilers. Our algorithm requires only a few seconds for programs of 100-350K lines of code and scales well across five orders of magnitude of program size. Some of the key technical ideas emerging from this work are the careful design choices to construct the call graph incrementally during the analysis, to eliminate O(N 2 ) behaviors, and to track fine-grained completeness information as a unified solution for several difficult algorithmic problems.. Despite important simplifications for scalability (unification and flow-insensitivity), the analysis is powerful enough to provide better alias analysis precision than Andersen's algorithm in several programs. DSA can distinguish instances of logical data structures in programs and provide useful compile-time information about such data structures, without an expensive shape analysis. In fact, DSA, in combination with Automatic Pool Allocation [20] , enables novel analyses and transformations that can operate on entire recursive data structures instead of individual loads and stores or data elements [18] . There is a vast literature on pointer analysis (e.g., see the survey by Hind [17] ), but the majority of that work focuses on contextinsensitive analyses. We focus here on context-sensitive techniques.. Several algorithms are context-sensitive in the analysis but not the heap naming: they name heap objects by allocation site and not by call path. Liang and Harrold's FICS algorithm processes programs up to 25K lines of code in a few seconds each [22] . Fahndrich et al [11] analyze programs as large as 200K lines of code (the Spec95 version of gcc) in about 3 minutes. The WhaleyLam algorithm takes up to 19 minutes for one program and over 10 minutes for four out of twenty programs [34] . It also potentially considers all possible acyclic call paths (e.g., they report 10 24 paths in one program). Both of these raise concerns for production compilers. Conversely, the GOLF algorithm [6] , which is both fast and scalable, uses only one level of context-sensitivity. The key question is whether full cloning of heap objects, which we term "full context sensitivity," can achieve similar speed and scalability.. The most similar algorithm to ours is called MoPPA [23] . It is also flow-insensitive and context-sensitive, uses unification, and its structure is similar to our algorithm, including Local, Bottom-Up, and Top-Down phases, and uses a separate Globals Graph. MoPPA seems to require much higher memory than our algorithm: it runs out of memory analyzing povray3 with field-sensitivity on a machine with 640M of memory. It has several other practical limitations: it can only use field-sensitivity for completely type-safe programs, requires a complete program, and requires a precomputed call-graph. We avoid these limitations via fine-grain completeness tracking and the use of call nodes for incompletely resolved calls.. Ruf's synchronization removal algorithm for Java [28] also shares several important properties with ours and with MoPPA, including combining context-sensitivity with unification, a noniterative analysis with local, bottom-up and top-down phases, and node flags to mark global nodes. Unlike our algorithm, his work requires a call graph to be specified, it is limited to type-safe programs, and does not appear to handle incomplete programs.. A few papers describe context-sensitive algorithms with full heap cloning without using unification [3, 25] . Although the latter [25] has been shown to scale to quite large programs, which is an impressive result for a non-unification-based context-sensitive analysis, it does not provide convincing evidence that the technique could be used in production compilers. The work of Nystrom et al. is about 2 orders of magnitude slower than ours in absolute compile time, e.g., 192 s. for 176.gcc compared with 3.24 seconds for ours, measured on similar systems.

O B O O O O O O O O O O B B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O B O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


On a rule-based interpretation of default conditionals In nonmonotonic reasoning, a default conditional α → β has most often been informally interpreted as a defeasible version of a classical conditional, usually the material conditional. There is however an alternative interpretation, in which a default is regarded essentially as a rule, leading from premises to conclusion. In this paper, we present a family of logics, based on this alternative interpretation. A general semantic framework under this rule-based interpretation is developed, and associated proof theories for a family of weak conditional logics is specified. Nonmonotonic inference is easily defined in these logics. Interestingly, the logics presented here are weaker than the commonly-accepted base conditional approach for defeasible reasoning. However, this approach resolves problems that have been associated with previous approaches. A major approach in nonmonotonic reasoning is to represent a default as an object that one can reason about, either as a conditional in some object language, or as a nonmonotonic consequence operator. Thus for example "an adult is (typically or normally) employed" might be represented a → e, where → represents a default or normality conditional, distinct from the material conditional ⊃. In such approaches, one can typically derive other defaults from a given set of defaults. There has been J. P. Delgrande (B) School of Computing Science, Simon Fraser University, Burnaby, B.C., Canada V5A 1S6 e-mail: jim@cs.sfu.ca widespread agreement concerning just what principles should constitute a minimalNonmonotonic inference is then defined in the standard way for such approaches: given a default theory T and a classical (i.e. non-default) formula α, β is a default inference from α with respect to T, just if α → β is true in each of the nonmonotonic "extensions" of T.. This distinction between treating a default as a conditional or as a rule has been noted previously; see for example [22] . As well, work on inheritance networks [24] can be viewed as investigating proof theories for the latter interpretation. Work on causality such as [34] also falls in the rule-based framework. However a logic (that is, with both semantics and proof theory) capturing this interpretation has not been investigated previously, nor has a fully general nonmonotonic closure operator been developed under this interpretation. Last, it is suggested in the conclusion that this alternative interpretation may be widely applicable. In particular, it is suggested that this approach may be an appropriate vehicle for representing counterfactual reasoning [33] , which previously has been treated via the stronger interpretation.. The next section reviews previous work in conditional approaches to nonmonotonic reasoning. Section 3 informally reviews the approach while Section 4 describes a family of weak conditional logics. Section 5 considers the incorporation of a nonmonotonic extension to a conditional knowledge base. We conclude with Section 6. Proofs of theorems are contained in an Appendix. We have argued that there are two interpretations of a default conditional: first as a weak (typically material) implication, and second as something akin to a rule of inference. The former interpretation is explicit in, for example, circumscriptive abnormality theories, and implicit in approaches such as conditional entailment and rational closure. It is clear that there are many, and varied, applications in which the first interpretation is appropriate. However we have also noted that there are various reasons to suppose that this is not the only such interpretation: First, other authors have argued against principles of the "core" logic underlying this first interpretation (specifically, against CC/And and CA/Or). Second, there are examples (such as Example 2.6) in the underlying (monotonic) logic that give results that are too strong. Third, there are various examples of inferences in approaches such as rational closure or in conditional entailment that are either too weak or too strong. Last, there are emerging areas (such as causal reasoning) in which a "weak material implication" interpretation is not appropriate. While this distinction has been recognized previously, what is new here is the development of a family of logics, with a novel semantic theory and proof theory along with a specification of nonmonotonic inference, for the "rule-based" interpretation. All of the logics presented here are quite weak, at least compared to the so-called "conservative core" or, equivalently, the system P of [27] . We argue however that such lack of inferential capability is characteristic of a "rule-based" interpretation of a conditional. Moreover it proves to be the case that nonmonotonic reasoning is defined very easily in these logics, and allows a rich set of inferences concerning the incorporation of irrelevant properties and of property inheritance.. An open question concerns how informal, commonsense defaults should be classified -whether as a defeasible classical (material) conditional or as a rule. As discussed, the great majority of past work has favoured the "defeasible classical conditional" interpretation. Such previous work includes non-default conditionals, such as Lewis' system-of-spheres semantics for counterfactual assertions [33] . However, a case can be made that such non-default examples, formerly interpreted as belonging to the first category, may be better interpreted as belonging to the "rule" category. Consider the following example of counterfactual assertions in which the following statements, concerning a past party, are given [33] :. "If John had gone it would have been a good party" and "If John and Mary had gone it would have not been a good party." From these assertions, we deduce in Lewis' "official" counterfactual logic VC that "if John had gone, Mary would not have gone." 15 This, to most readers, is a strange result: John's going and Mary's going are (presumably) independent events. Arguably this result ought not to obtain, and so perhaps counterfactuals, as previously modelled by Lewis' sphere semantics, may also be better interpreted via the "rule" interpretation. ¬α) ⊃ ¬(¬α → ¬α)). >From the equivalence C α ≡ (¬α ≡ ⊥) we obtain C α ⊃ (¬(⊥ → ¬α) ⊃ ¬(¬α → ¬α)). Given axiom NA, this is equivalent to C α ⊃ ¬(¬α → ¬α). The converse, C ¬(¬α → ¬α) ⊃ α is an instance of the contrapositive of RR.. In the following proofs, we make extensive use of the fact that in the canonical model, for a set of worlds X, there is a formula γ such that |γ | = X. This is a simple consequence of the fact that the set of atomic sentences P is finite, and so W also is finite. For example, for X ⊆ W where, X = ∅, one could choose γ = |X| i=1 γ i where, for w i ∈ X, γ i is a conjunction of the literals true in w i . For X = ∅ one could choose ⊥ or the negation of any propositional tautology. In particular, this means that for w ∈ W in the canonical model, there is a formula ψ such that |ψ| w = N(w).

O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Graphs of Plural Cuts Plural (or multiple-conclusion) cuts are inferences made by applying a structural rule introduced by Gentzen for his sequent formulation of classical logic. As singular (single-conclusion) cuts yield trees, which underlie ordinary natural deduction derivations, so plural cuts yield graphs of a more complicated kind, related to trees, which this paper defines. Besides the inductive definition of these oriented graphs, which is based on sequent systems, a non-inductive, graph-theoretical, combinatorial, definition is given, and to reach that other definition is the main goal of the paper. As trees underlie multicategories, so the graphs of plural cuts underlie polycategories. The graphs of plural cuts are interesting in particular when the plural cuts are appropriate for sequent systems without the structural rule of permutation, and the main body of the paper deals with that matter. It gives a combinatorial characterization of the planarity of the graphs involved.Mathematics Subject Classification (2010): 03F03, 03F07, 05C10, 05C20, 18A15 Plural cut is a structural inference rule introduced by Gentzen in [6] for his plural sequent system of classical logic. A plural sequent (more often called multiple-conclusion sequent, or something like that) is a sequent Γ ⊢ ∆ where ∆, as Γ, may be a collection (sequence, multiset or set) of formulae with more than one member (see [12] , Theorem 1.2, [13] , Chapters 1, 2, 5, [5] , Chapter 1.1, Theorem 13, and [4] for results about the relationship between singular and plural consequence relations). Plural cut as formulated by Gentzen with These crossings require that we have the structural rule of permutation on the left and on the right in order to state the equations implicit in the definition of polycategory of [14] (see P3 in Section 2; in the first of these equations, which are analogous to the equations that stand behind our Propositions 2.2 and 2.3, we must permute Γ 2 with ∆ 2 and Γ 3 with ∆ 3 , and in the second we must permute ∆ 1 with Φ 1 and ∆ 2 with Φ 2 ). Planar plural cuts are obtained from (PC) by requiring that either Θ 1 or ∆ 1 be empty and that either Θ 2 or ∆ 2 be empty, so that the crossings do not arise.. In this paper our main goal is to characterize in a graph-theoretical, combinatorial, manner the planarity involved in planar plural cuts. To achieve that, we define in three different manners a kind of oriented graph, which we call K-graph. (The notion of oriented graph, and other notions we need concerning these graphs, and directed graphs in general, are defined in Section 2.) The name of K-graphs is derived from the form of these graphs, that may resemble up to a point a rotated K:. (see the picture below; this form resembles equally a rotated X).. Our first definition, given in Section 2, is inductive. With it, K-graphs are obtained from some basic K-graphs by applying operations that correspond to planar plural cuts. This definition yields our notion of global K-graph, which is closest to planar polycategories.. It corresponds actually to a notion somewhat more general than the notion of planar polycategory, which we could call compass polycategory. Compass polycategories would be defined like planar polycategories, but instead of having polyarrows with sources and targets made of sequences of objects, in compass polycategories we would have these sources and targets made of multisets of objects with two distinguished objects, if the multiset is not a singleton. We refer to these distinguished objects by N and S (which stand for north and south respectively; we take inspiration from the compass because in Γ ⊢ ∆ we have Γ on the west and ∆ on the east.) In sequences of objects, the N and S object are the first and last object. The collections of objects in the polyarrows of compass polycategories need not however be sequences. We need N and S to characterize the operations on global K-graphs that correspond to planar plural cuts, and we do not need anything else. The assumption that we have sequences is not necessary to characterize these operations.. The polyarrows of a freely generated compass polycategory may be identified with global K-graphs where the inner vertices (a vertex of a directed graph is inner when an edge ends in it and another one begins in it; see Section 2) are labelled by the free generators of the polycategory, and the remaining vertices are labelled by objects of the polycategory. Our Propositions 2.4 and 2.5 (see Section 2) contain the essence of a completeness proof of our notion of global K-graph with respect to compass polycategories, which as planar polycategories are characterized by three equations that stand behind our Propositions 2.1-2.3, and by additional equations involving the identity polyarrow. To simplify the exposition, we deal separately in Section 6 with matters involving this identity. This section brings a mathematically not very essential addition to the preceding exposition in the main body of the paper.. It is not our intention in this paper to deal with compass polycategories. We leave this topic for another place.. Our third definition of K-graph, given in Section 5, is non-inductive and it does not mention N and S any more. It is purely graph-theoretical, and by showing the equivalence of the notion the third definition gives with the notion of global K-graph we have achieved the main goal of the paper.. Our second definition, in Section 3, gives the notion of local K-graph, which is intermediary between the notion of global K-graph given by the first definition and the notion of K-graph given by the third definition. Our main definition of local K-graph is non-inductive as the third definition, but it still involves N and S, as the first definition. We give however also an inductive definition of local K-graph. The notion of local K-graph given by the second definition, which is equivalent to the notion of global K-graph, as proved in Section 4, helps us to prove in Section 5 the equivalence mentioned in the preceding paragraph.. With the third definition of K-graph, the planarity of planar plural cuts, or rather their compass character, is characterized in a way that can be compared to Kuratowski's way of characterizing the planarity of graphs (see [7] , Chapter 11, and the first part of the proof of Proposition 5.5). The two approaches may be compared, but the results involved are different. In our case, we do not deal in fact with planarity, but with a related notion involving N and S. We deal also with a special kind of oriented graph, whereas Kuratowski was concerned with the planarity of ordinary, non-directed, graphs.. The third definition yields the following picture. An arbitrary K-graph may very roughly be described as having in the middle a non-circular line of edges with changing directions, which we call the transversal. Together with the transversal we have two sets of trees, each set of a different kind: the first set consists of trees oriented towards the root, and the second of trees ori In the middle, drawn with dotted lines, is the transversal, on the left of which, growing westward, we have trees oriented towards the root, and on the right of which, growing eastward, we have trees oriented towards the leafs (for details see Section 5). The combinatorial essence of the planarity of K-graphs is that the transversal is non-circular (more precisely, asemicyclic; see Section 2) and linear (more precisely, non-bifurcating; see Section 5).. With singular cuts we would obtain just trees, oriented towards the root. One bases on such trees derivations in ordinary natural deduction, and also the notion of multicategory. A limit case of singular cut is ordinary composition in categories, which yields as graphs just chains. With K-graphs we do not have trees, but we have not gone very far away from the notion of tree.. With plural cuts in general, which are based on the cut rule (PC), we are further removed from trees, and we obtain a notion of oriented graph, which we call Q-graph, simpler to define than our notion of K-graph, both inductively and non-inductively. We investigate this notion, which when defined non-inductively reduces essentially to a weak form of connectedness and a weak form of noncircularity, in Section 7, the last section of the paper. An arbitrary Q-graph may be pictured as an arbitrary K-graph, with the transversal and two sets of trees, but the transversal is not linear any more.. The notion of global K-graph is the notion that should be used to prove by induction that every K-graph can be geometrically realized in the plane in the following special manner. A point that realizes a vertex a that is not inner has the first coordinate 0 if an edge begins in a, and it has the first coordinate 1 if an edge ends in a. We require moreover in this realization that for every edge (a, b) of our K-graph the first coordinate of the point that realizes the vertex a is strictly smaller than the first coordinate of the point that realizes the vertex b.. Conversely, for an oriented graph of a special kind, which is connected and non-circular in a weak sense, and satisfies moreover a condition concerning its vertices that are not inner (see conditions (1)-(3) in Section 3), we should be able to prove that if it is realized in the plane in the special manner above, then it is a K-graph. The proof of that would be inductive too, and would rely on the notion of global K-graph. We will not go here into this rather geometrical matter, which however would not improve significantly our mathematical perception of the geometrical planarity of K-graphs. We suppose that the notion of global K-graph suffices for that. The accent in this paper is put on other matters, like our third definition of K-graph, which characterizes the planarity of these graphs in a combinatorial way.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O B I O O O O O O O O O O O O B I O O O O O B I O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B I O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O


Classification

of

Packed

Executables

for

Accurate

Computer

Virus

Detection

Executable

packing

is

the

most

common

technique

used

by

computer

virus

writers

to

obfuscate

malicious

code

and

evade

detection

by

anti-virus

software.

Universal

unpackers

have

been

proposed

that

can

detect

and

extract

encrypted

code

from

packed

executables,

therefore

potentially

revealing

hidden

viruses

that

can

then

be

detected

by

traditional

signature-based

anti-virus

software.

However,

universal

unpackers

are

computationally

expensive

and

scanning

large

collections

of

executables

looking

for

virus

infections

may

take

several

hours

or

even

days.In

this

paper

we

apply

pattern

recognition

techniques

for

fast

detection

of

packed

executables.

The

objective

is

to

efficiently

and

accurately

distinguish

between

packed

and

non-packed

executables,

so

that

only

executables

detected

as

packed

will

be

sent

to

an

universal

unpacker,

thus

saving

a

significant

amount

of

processing

time.

We

show

that

our

system

achieves

very

high

detection

accuracy

of

packed

executables

with

a

low

average

processing

time.

As

a

consequence

of

the

arms

race

between

virus

writers

and

anti-virus

vendors,

sophisticated

code

obfuscation

techniques

are

commonly

implemented

in

computer

viruses.

Executable

code

polymorphism,

metamorphism,

packing,

and

encryption,

have

been

proven

very

effective

in

evading

detection

by

traditional

signature-based

anti-virus

software.

Among

these

techniques,

executable

packing

is

the

most

common

due

to

the

availability

of

several

opensource

and

commercial

executable

packers

An

executable

packing

tool

(or

packer,

for

simplicity)

is

a

software

that

given

a

program

P

generates

a

new

program

P

which

embeds

an

encrypted

version

of

P

and

a

decryption

routine.

When

P

is

executed,

it

will

decrypt

P

on

the

fly

and

then

run

it.

Assuming

P

contains

known

malicious

code,

signature

based

anti-virus

would

(likely)

be

able

to

detect

it.

However,

if

P

has

been

packed

the

anti-virus

will

try

to

match

the

signature

of

P

on

P

As

the

malicious

code

of

P

is

encrypted

in

P

no

match

will

be

found.

Therefore,

P

will

evade

detection

and

infect

the

victim

machine,

if

P

is

executed..

According

to

over

of

computer

viruses

appear

to

be

using

packing

techniques.

Moreover,

there

is

evidence

that

more

than

of

new

viruses

are

simply

re-packed

versions

of

existing

ones

Although

executable

packing

is

very

popular

among

virus

writers,

it

is

also

applied

for

encrypting

benign

executables.

Programmers

of

benign

software

apply

packing

to

their

applications

mainly

to

make

the

resulting

executables

smaller

in

terms

of

bytes,

and

therefore

faster

to

distribute

through

the

network,

for

example.

Also,

packing

makes

reverse-engineering

more

difficult,

thus

making

it

harder

for

hackers

to

break

the

software

license

protections.

As

a

matter

of

fact,

there

exist

many

commercial

executable

packing

tools

that

have

been

developed

mainly

for

protecting

benign

applications

from

software

piracy.

However,

the

percentage

of

packed

benign

executables

is

low

(perhaps

as

low

as

although

we

were

not

able

to

find

any

study

that

can

confirm

this

estimate,

which

is

based

solely

on

our

experience)..

Universal

unpackers

are

able

to

detect

and

extract

(part

of)

P

from

P

without

specific

knowledge

about

the

encryption

algorithm

used

to

generate

P

The

code

of

P

is

dynamically

extracted

by

running

P

in

an

isolated

environment

and

monitoring

the

execution

of

instructions

written

in

memory

at

run-time.

After

P

has

been

extracted,

its

code

can

be

scanned

using

traditional

anti-virus

software.

It

has

been

shown

that

scanning

the

unpacked

code

using

signature-based

anti-virus

software

significantly

improves

virus

detection

accuracy

However,

universal

unpackers

introduce

a

high

computational

overhead,

and

the

processing

time

may

vary

from

tens

of

seconds

to

several

minutes

per

executable.

For

example,

the

average

time

it

takes

to

unpack

a

packed

virus

using

the

Renovo

unpacker

is

around

seconds.

This

greatly

hinders

virus

detection,

since

without

a

priori

knowledge

on

the

nature

of

the

executables

to

be

checked

for

malicious

code

all

of

them

would

need

to

be

run

through

the

unpacker.

As

a

consequence,

scanning

large

collections

of

executables

looking

for

virus

infections

may

take

several

hours

or

even

days..

Pattern

recognition

techniques

have

recently

been

proven

effective

in

solving

problems

of

interest

in

the

computer

security

field

(see

for

example).

For

this

reason,

researchers

in

both

the

pattern

recognition

and

the

computer

security

community

are

gaining

interest

in

such

kind

of

promising

applications.

In

this

paper

we

present

an

application

of

pattern

recognition

techniques

for

fast

detection

of

packed

executables.

The

objective

is

to

accurately

distinguish

between

packed

and

non-packed

executables,

so

that

only

the

executables

detected

as

packed

will

be

sent

to

a

computationally

expensive

universal

unpacker

for

hidden

code

extraction,

before

being

sent

to

the

antivirus

software.

Therefore,

our

classification

system

helps

in

improving

virus

detection

while

saving

a

significant

amount

of

processing

time.

In

this

paper

we

do

not

focus

on

the

improvements

in

virus

detection

accuracy

achieved

after

unpacking,

because

this

has

already

been

studied

in

for

example.

Instead,

we

focus

on

the

accuracy

and

computational

cost

related

to

the

classification

of

packed

executables

into

the

two

classes

packed

and

non-packed..

Signature-based

detectors

of

packed

executables

are

available

on

the

internet.

For

example,

PEiD

is

very

well

known

and

very

likely

the

most

used.

However,

although

signature-based

detectors

are

fast

and

have

relatively

low

false

positives,

they

suffer

from

a

high

number

of

false

negatives.

This

is

mainly

due

to

the

fact

that

executable

packing

tools

can

be

easily

modified

by

virus

writers

to

avoid

signature-based

detection

On

the

other

hand,

we

will

show

that

our

classification

approach

has

a

much

better

generalization

ability

than

signature-based

approaches

and

is

able

to

distinguish

between

packed

and

non-packed

executables

with

very

low

false

positive

and

false

negative

rates..

We

consider

programs

in

Portable

Executable

(PE)

format,

which

is

the

format

used

in

and

Microsoft

Windows

operating

systems.

In

order

to

classify

an

executable

program,

we

use

binary

static

analysis

to

extract

information

such

as,

for

example,

the

name

of

the

code

and

data

sections,

the

number

of

writable-executable

sections,

the

code

and

data

entropy,

etc.

(see

Section

This

information

allows

us

to

translate

each

executable

into

a

pattern

vector.

We

then

apply

pattern

recognition

techniques

to

distinguish

between

packed

and

non-packed

executables.

Figure

shows

how

our

classifier

may

be

used

to

improve

virus

detection

accuracy

with

low

overhead,

compared

to

a

system

where

all

the

executables

are

directly

sent

to

the

universal

unpacker.

Once

a

PE

executable

is

received,

our

classification

system

performs

a

static

analysis

of

the

PE

file

in

order

to

extract

a

number

of

features,

as

described

in

Section

This

feature

extraction

process

can

be

performed

efficiently.

After

feature

extraction,

the

obtained

pattern

vector

representation

of

the

PE

executable

is

sent

to

the

PE

file

classifier.

If

the

executable

is

classified

as

packed,

it

will

be

sent

to

the

universal

unpacker

for

hidden

code

extraction,

and

the

hidden

code

will

then

be

sent

to

the

anti-virus

scanner.

On

the

other

hand,

if

the

executable

is

classified

as

non-packed,

it

will

be

sent

directly

to

the

anti-virus

scanner.

It

is

worth

noting

that

the

PE

file

classifier

may

erroneously

label

a

non-packed

executable

as

packed.

In

this

case

the

universal

unpacker

will

not

be

able

to

extract

any

hidden

code

from

the

received

PE

file.

Nonetheless,

this

is

not

critical

because

if

no

hidden

code

is

extracted,

the

AV

scanner

will

simply

scan

the

original

non-packed

code.

The

only

cost

paid

in

this

case

is

the

time

spent

by

the

universal

unpacker

in

trying

to

unpack

a

non-packed

executable.

On

the

other

hand,

the

PE

classifier

may

in

some

cases

classify

a

packed

executable

as

non-packed.

In

this

case,

the

packed

executable

will

be

sent

directly

to

the

anti-virus

scanner,

which

may

fail

to

detect

the

presence

of

malicious

code

embedded

in

the

packed

executable,

thus

causing

a

false

negative.

However,

we

will

show

in

Section

that

our

PE

file

classifier

has

a

very

high

accuracy

and

is

therefore

able

to

limit

the

false

negatives

due

to

these

cases..

Our

classification

system

is

particularly

useful

in

a

number

of

applications.

For

example,

web-sites

hosting

free

software

downloads

usually

receive

many

new

executable

files

per

day

from

software

developers

who

want

to

make

their

applications

available

(often

as

either

a

free-ware

or

demo

version

of

commercial

software).

Of

course,

these

web-sites

need

to

guarantee

that

the

software

they

distribute

do

not

contain

computer

viruses.

To

achieve

this

goal,

before

distribution

every

application

is

typically

scanned

using

a

number

of

different

signature-based

anti-virus

software.

However,

if

the

virus

is

hiding

in

a

packed

executable,

there

is

a

good

chance

that

it

will

not

be

detected

and

the

web-site

may

become

a

source

of

infection.

On

the

other

hand,

using

the

system

proposed

in

Figure

helps

in

improving

virus

detection

with

low

computational

overhead..

We

performed

experiments

on

executables.

are

packed

computer

viruses

collected

from

the

Malfease

Project

dataset

net),

are

benign

executables

extracted

from

a

clean

installation

of

Windows

XP

Home

plus

several

common

user

applications,

and

are

packed

benign

executables

obtained

by

manually

packing

applications

selected

from

the

start

menu

of

Windows

XP

using

different

executable

packing

tools.

We

show

that

our

system

achieves

very

high

detection

accuracy

of

packed

executables

with

an

average

processing

time

per

executable

as

low

as

seconds..

The

remainder

of

the

paper

is

organized

as

follows.

In

Section

we

present

an

overview

of

the

related

work.

In

Section

we

briefly

discuss

the

Portable

Executable

(PE)

file

format,

and

describe

the

features

used

for

classifying

PE

executables.

We

then

present

and

discuss

the

experimental

results

in

Section

and

summarize

our

work

in

Section

Executable

packing

tools

are

extensively

used

by

computer

virus

writers

to

hide

malicious

code

into

packed

executables

that

may

not

be

detected

using

traditional

signature-based

anti-virus

software.

Universal

unpackers

may

be

used

to

extract

the

hidden

code

from

packed

executables.

After

unpacking,

the

hidden

code

can

be

checked

against

signatures

of

known

viruses,

thus

improving

the

capability

of

detecting

hidden

malicious

code.

However,

universal

unpackers

introduce

a

very

high

computational

overhad,

because

the

analysis

of

any

executable

(packed

or

not)

may

take

from

tens

of

seconds

to

several

minutes.

This

means

that

scanning

large

collections

of

executables

looking

for

virus

infections

may

take

several

hours

or

even

days..

In

this

paper

we

proposed

a

technique

for

fast

detection

of

packed

executables.

Only

the

executables

that

are

classified

as

packed

by

our

classifier

will

be

analyzed

using

a

universal

unpacker

for

extracting

the

hidden

code,

and

afterwards

scanned

by

an

anti-virus

software,

therefore

improving

virus

detection

accuracy

while

saving

a

significant

amount

of

processing

time.

We

described

how

to

extract

discriminant

features

from

executable

files

in

Portable

Executable

format,

and

we

showed

that

our

classification

system

achieves

very

high

accuracy

while

keeping

the

processing

time

per

executable

low.

In

detection

of

computer

viruses

is

shown

to

be

undecidable

both

by

apriori

and

runtime

analysis,

and

it

can

be

shown

that

distinguishing

between

packed

and

non-packed

executables

is

also

undecidable

Although

these

results

prove

that

no

algorithm

can

detect

packed

executables

and

computer

viruses

with

absolute

precision,

detection

may

still

be

performed

with

high

accuracy,

as

we

discuss

in

this

paper..

In

Martignoni

et

al.

propose

OmniUnpack,

an

unpacking

tool

that

monitors

the

execution

of

applications

in

memory

and

detects

attempts

of

executing

dynamically

decrypted

code.

If

such

code

is

detected,

OmniUnpack

will

scan

it

using

signature-based

anti-virus

software.

If

any

malicious

code

is

found

the

execution

of

the

application

will

be

stopped,

otherwise

it

will

continue

until

another

attempt

to

execute

decrypted

code

is

detected.

OmniUnpack

is

supposed

to

be

integrated

with

the

operating

system

kernel,

and

monitors

every

application

executed

on

the

machine.

Similarly

present

executable

unpackers

based

on

dynamic

analysis

of

executables

performed

in

an

isolated

environment

(e.g.

a

virtual

machine

or

an

emulator).

Our

approach

is

different

in

that

we

do

not

need

to

execute

an

application

to

detect

if

it

contains

packed

executable

code.

Our

classification

system

extracts

a

number

of

features

from

executable

files

in

PE

format

through

static

analysis,

and

can

be

used

to

classify

packed

executables

without

need

to

actually

execute

them..

To

the

best

of

our

knowledge,

the

closest

work

to

ours

is

Bintropy

a

tool

for

the

detection

of

packed

executables

based

on

byte

entropy

analysis.

Bintropy

divides

the

PE

file

into

blocks

of

bytes.

It

then

computes

the

entropy

of

each

block,

the

average,

and

the

maximum

block

entropy.

Given

a

dataset

of

packed

binaries,

the

authors

use

simple

statistical

inference

to

compute

a

confidence

interval

on

the

value

of

the

average

block

entropy

and

maximum

block

entropy

Based

on

the

lower

bound

of

these

two

confidence

intervals,

they

set

two

thresholds,

one

for

the

value

of

the

average

block

entropy,

and

one

for

the

maximum

block

entropy.

During

test,

if

a

PE

file

is

found

to

have

average

and

maximum

entropy

above

the

respective

thresholds,

it

will

be

classified

as

packed.

In

our

work

we

do

not

limit

the

analysis

to

the

PE

file

entropy.

We

introduce

and

motivate

the

use

of

additional

features

that

help

in

distinguishing

between

packed

and

non-packed

executables.

Furthermore,

instead

of

using

simple

statistical

inference

for

computing

confidence

intervals

on

the

entropy

values,

we

apply

statistical

learning

techniques

to

derive

more

accurate

classification

rules

from

a

labeled

dataset

of

packed

and

non-packed

executables..

In

Kolter

et

al.

use

n-gram

analysis

to

distinguish

between

viruses

and

benign

exectables.

However,

they

do

not

distinguish

between

packed

and

nonpacked

executables.

Also

the

output

of

their

n-gram

analysis

classifier

is

not

able

to

detect

to

what

family

of

viruses

a

malicious

executable

belongs

to

(e.g.

it

cannot

distinguish

between

different

kinds

of

bots,

like

AgoBot

and

SpyBot

Our

work

is

different

because

we

focus

on

distinguishing

between

packed

and

non-packed

executables,

and

then

rely

on

the

unpacker

and

signature

based

anti-virus

software

for

distinguishing

between

specific

kinds

of

viruses

and

benign

executables.

We

performed

experiments

on

executables

in

PE

format.

We

collected

packed

viruses

from

the

Malfease

Project

dataset

oarci.net),

and

non-packed

benign

executables

collected

from

a

clean

installation

of

Windows

XP

Home

plus

several

common

user

applications.

Also,

we

generated

packed

benign

executables

by

applying

different

executable

packing

tools

freely

available

on

the

Internet

to

the

executables

in

the

Windows

XP

start

menu.

Of

the

packed

executables

in

our

collection,

PEiD

(very

likely)

the

most

used

signature-based

detector

for

packed

executables,

was

able

to

detect

only

of

them,

whereas

remained

undetected.

This

means

that

PEiD

had

a

false

negative

rate

of

Among

the

undetected

packed

executables,

there

were

packed

viruses

and

of

our

"manually"

packed

benigns..

We

developed

a

PE

format

analysis

tool

written

in

Python,

which

extracts

the

features

described

in

Section

and

summarized

in

Table

Table

Summary

of

the

features

extracted

from

PE

files..

We

applied

our

tool

to

each

of

the

executables

in

our

collection,

therefore

obtaining

a

labeled

dataset

with

entries.

We

divided

our

dataset

in

two

parts:

a

training

dataset

containing

patterns

related

to

the

nonpacked

benign

executable

and

patterns

related

to

the

packed

executables

detected

using

PEiD;

a

test

dataset

containing

patterns

related

to

the

packed

executables

that

PEiD

was

not

able

to

detect.

These

datasets

and

the

feature

extraction

tool

we

used

to

generate

them

are

available

at

In

order

to

perform

experiments

with

different

learning

algorithms

we

used

Weka

Table

reports

the

results

obtained

with

different

classifiers,

namely

a)

Naive

Bayes

classifier.

b)

decision

tree

(Weka's

implementation

of

of

the

well

known

c)

ensemble

of

unpruned

decision

trees

constructed

using

Bagging

and

the

Laplace

correction

for

probability

estimates.

d)

k-nearest-neighbors

classifier

(IBk

is

Weka's

implementation

of

the

kNN

algorithm)

with

and

instance

weights

equal

to

the

inverse

of

the

distance

from

the

neighbors.

e)

Multi

Layer

Perceptron

(MLP)

classifier

constructed

using

input

layer

with

nodes

(one

for

each

feature),

hidden

layer

with

nodes,

and

output

layer

with

nodes

(one

for

each

class).

All

the

hidden

and

output

nodes

use

a

sigmoidal

activation

function,

whereas

the

input

nodes

use

a

linear

activation

function.

The

backpropagation

algorithm

was

used

for

training,

with

of

training

patterns

reserved

for

validation.

f)

Entropy

Threshold

classifier,

which

classifies

an

executable

according

to

a

simple

threshold

on

the

value

of

the

PE

file

entropy.

That

is,

given

a

PE

file

F

if

its

file

entropy

is

greater

than

a

predetermined

threshold

F

will

be

classified

as

packed,

otherwise

it

will

be

classified

as

non-packed..

The

first

two

columns

of

Table

were

computed

by

repeating

crossvalidation

times

on

the

training

dataset

and

then

averaging

over

the

obtained

results

(the

standard

deviation

is

reported

between

parentheses).

For

the

Entropy

Threshold

classifier

we

did

not

apply

cross-validation.

We

computed

the

AUC

by

simply

considering

the

value

of

the

file

entropy

as

a

score

and

by

computing

the

Wilcoxon-Mann-Whitney

statistic

The

accuracy

(second

column)

was

computed

by

finding

the

threshold

t

h

that

gives

maximum

separation

between

the

packed

and

non-packed

classes

in

the

training

dataset.

We

found

that

t

h

gives

maximum

separation,

and

the

related

accuracy

reported

in

the

table

is

therefore

the

maximum

value

of

the

percentage

of

correctly

classified

patterns

in

the

training

dataset..

The

Test

Accuracy

(the

last

column)

reports

the

results

on

the

test

dataset,

i.e.,

on

the

packed

executables

that

were

not

detected

by

PEiD.

We

first

trained

each

classifier

on

the

training

dataset,

and

then

computed

the

accuracy

on

the

test

dataset.

For

the

Entropy

Threshold

classifier,

we

used

the

threshold

t

h

Figure

shows

the

ROC

curves

computed

by

cross-validation.

The

Table

The

first

two

columns

report

the

average

and

standard

deviation

of

the

AUC

and

accuracy

computed

over

rounds

of

cross-validation.

The

test

accuracy

(last

column)

refers

to

the

percentage

of

packed

executables

not

detected

by

PEiD

that

were

correctly

detected

by

each

classifier..

range

of

false

positives

and

false

negatives

has

been

cropped

in

order

to

highlight

differences

among

the

classifiers..

As

we

can

see,

IBk

and

MLP

give

nearly

perfect

classification

results,

according

to

the

cross-validation

experiments

on

the

training

dataset.

A

comparison

of

these

three

algorithms

using

paired

t-test

on

the

values

of

the

AUC

showed

no

statistically

significant

difference

among

them.

On

the

other

hand,

according

to

the

paired

t-test

the

Naive

Bays

and

the

classifiers

performed

significantly

worse

(although

still

very

well

in

absolute

terms),

compared

to

IBk,

and

MLP.

It

easy

to

see

that

the

Entropy

Threshold

classifier

has

much

poorer

performance,

compared

to

all

of

the

other

classifiers.

We

conclude

that

although

the

file

entropy

is

a

discriminant

feature,

using

all

the

nine

features

described

in

Section

significantly

improves

the

classification

of

packed

executables..

We

can

consider

the

Test

Accuracy

(last

column

in

Table

as

an

estimate

of

the

generalization

ability

of

our

classifiers,

compared

to

the

signature-based

approach

implemented

by

PEiD.

As

we

can

see,

all

the

classifiers

(excluding

the

Entropy

Threshold

classifier)

correctly

detected

more

than

of

the

packed

executables

that

were

not

detected

by

PEiD.

Even

though

the

Naive

Bayes

and

algorithms

performed

slightly

worse

than

and

IBk

in

terms

of

AUC,

they

perform

better

on

the

test

dataset.

The

best

results

were

obtained

by

using

the

MLP

classifier,

which

performs

as

well

as

and

IBk

in

terms

of

AUC,

and

gives

the

best

accuracy

(reported

in

bold

in

Table

on

the

test

dataset..

The

average

time

to

extract

the

features

used

for

classification

on

a

Dual

Core

AMD

Opteron

processor

was

about

t

seconds

per

executable.

We

believe

t

can

be

made

even

much

smaller

by

developing

an

optimized

feature

extraction

tool

written

in

C,

instead

of

using

Python.

The

time

needed

for

the

classification

of

a

pattern

vector

is

in

the

order

of

−3

seconds,

and

therefore

negligible

compared

to

t.

O O B I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O B I O O B I O O O O O O O O O O O O O O O O O O B I O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O