Query: Root Exploit Detection and Features Optimization: Mobile Device and Blockchain Based Medical Data Management

Relevant passages:
Forensic carving of network packets and associated data structures <=SEP=> Using validated carving techniques, we show that popular operating systems (e.g. Windows, Linux, and OSX) frequently have residual IP packets, Ethernet frames, and associated data structures present in system memory from long-terminated network traffic. Such information is useful for many forensic purposes including establishment of prior connection activity and services used; identification of other systems present on the system’s LAN or WLAN; geolocation of the host computer system; and cross-drive analysis. We show that network structures can also be recovered from memory that is persisted onto a mass storage medium during the course of system swapping or hibernation. We present our network carving techniques, algorithms and tools, and validate these against both purpose-built memory images and a readily available forensic corpora. These techniques are valuable to both forensics tasks, particularly in analyzing mobile devices, and to cyber-security objectives such as malware analysis. Published by Elsevier Ltd.

Behavioral malware detection approaches for Android <=SEP=> Android, the fastest growing mobile operating system released in November 2007, boasts of a staggering 1.4 billion active users. Android users are susceptible to malicious applications that can hack into their personal data due to the lack of careful monitoring of their in-device security. There have been numerous works on devising malware detection methods. However, none of earlier works are conclusive enough for direct application and lack experimental validation. In this paper, we have investigated the natures and identities of malicious applications and devised two novel detection approaches for detection: network-based detection and system call based detection approaches. To evaluate our proposed approaches, we performed experiments on a subset of 1260 malwares, acquired from Android Malware Genome Project, a malware database created by Y. Zhou et al. [1] and 227 non-malware (benign) applications. Results show that our system call based approach is able to detect malwares with an accuracy of 87% which is quite significant in general malware detection context. Our proposed detection approaches along with the experimental results will provide security professionals with more precise and quantitative approaches in their investigations of mobile malwares on Android systems.

High Accuracy Android Malware Detection Using Ensemble Learning <=SEP=> With over 50 billion downloads and more than 1.3 million apps in Google’s official market, Android has continued to gain popularity amongst smartphone users worldwide. At the same time there has been a rise in malware targeting the platform, with more recent strains employing highly sophisticated detection avoidance techniques. As traditional signature based methods become less potent in detecting unknown malware, alternatives are needed for timely zero-day discovery. Thus this paper proposes an approach that utilizes ensemble learning for Android malware detection. It combines advantages of static analysis with the efficiency and performance of ensemble machine learning to improve Android malware detection accuracy. The machine learning models are built using a large repository of malware samples and benign apps from a leading antivirus vendor. Experimental results and analysis presented shows that the proposed method which uses a large feature space to leverage the power of ensemble learning is capable of 97.3 % to 99% detection accuracy with very low false positive rates. Keywordsmobile security; Android; malware detection; ensemble learning; static analysis; machine learning; data mining; random forest

Crowdroid: behavior-based malware detection system for Android <=SEP=> The sharp increase in the number of smartphones on the market, with the Android platform posed to becoming a market leader makes the need for malware analysis on this platform an urgent issue.
 In this paper we capitalize on earlier approaches for dynamic analysis of application behavior as a means for detecting malware in the Android platform. The detector is embedded in a overall framework for collection of traces from an unlimited number of real users based on crowdsourcing. Our framework has been demonstrated by analyzing the data collected in the central server using two types of data sets: those from artificial malware created for test purposes, and those from real malware found in the wild. The method is shown to be an effective means of isolating the malware and alerting the users of a downloaded malware. This shows the potential for avoiding the spreading of a detected malware to a larger community.

Dissecting Android Malware: Characterization and Evolution <=SEP=> The popularity and adoption of smart phones has greatly stimulated the spread of mobile malware, especially on the popular platforms such as Android. In light of their rapid growth, there is a pressing need to develop effective solutions. However, our defense capability is largely constrained by the limited understanding of these emerging mobile malware and the lack of timely access to related samples. In this paper, we focus on the Android platform and aim to systematize or characterize existing Android malware. Particularly, with more than one year effort, we have managed to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011. In addition, we systematically characterize them from various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. The characterization and a subsequent evolution-based study of representative families reveal that they are evolving rapidly to circumvent the detection from existing mobile anti-virus software. Based on the evaluation with four representative mobile security software, our experiments show that the best case detects 79.6% of them while the worst case detects only 20.2% in our dataset. These results clearly call for the need to better develop next-generation anti-mobile-malware solutions.

Brain-computer interfacing in disorders of consciousness. <=SEP=> BACKGROUND
Recent neuroimaging research has strikingly demonstrated the existence of covert awareness in some patients with disorders of consciousness (DoC). These findings have highlighted the potential for the development of simple brain-computer interfaces (BCI) as a diagnosis in behaviourally unresponsive patients.


OBJECTIVES
This study here reviews current EEG-based BCIs that hold potential for assessing and eventually assisting patients with DoC. It highlights key areas for further development that might eventually make their application feasible in this challenging patient group.


METHODS
The major types of BCIs proposed in the literature are considered, namely those based on the P3 potential, sensorimotor rhythms, steady state oscillations and slow cortical potentials. In each case, a brief overview of the relevant literature is provided and then their relative merits for BCI applications in DoC are considered.


RESULTS
A range of BCI designs have been proposed and tested for enabling communication in fully conscious, paralysed patients. Although many of these have potential applicability for patients with DoC, they share some key challenges that need to be overcome, including limitations of stimulation modality, feedback, user training and consistency.


CONCLUSION
Future work will need to address the technical and practical challenges facing reliable implementation at the patient's bedside.

Clinical spinal instability and low back pain. <=SEP=> Clinical instability is an important cause of low back pain. Although there is some controversy concerning its definition, it is most widely believed that the loss of normal pattern of spinal motion causes pain and/or neurologic dysfunction. The stabilizing system of the spine may be divided into three subsystems: (1) the spinal column; (2) the spinal muscles; and (3) the neural control unit. A large number of biomechanical studies of the spinal column have provided insight into the role of the various components of the spinal column in providing spinal stability. The neutral zone was found to be a more sensitive parameter than the range of motion in documenting the effects of mechanical destabilization of the spine caused by injury and restabilization of the spine by osteophyle formation, fusion or muscle stabilization. Clinical studies indicate that the application of an external fixator to the painful segment of the spine can significantly reduce the pain. Results of an in vitro simulation of the study found that it was most probably the decrease in the neutral zone, which was responsible for pain reduction. A hypothesis relating the neutral zone to pain has been presented. The spinal muscles provide significant stability to the spine as shown by both in vitro experiments and mathematical models. Concerning the role of neuromuscular control system, increased body sway has been found in patients with low back pain, indicating a less efficient muscle control system with decreased ability to provide the needed spinal stability.

Ontology-driven Information Extraction <=SEP=> Homogeneous unstructured data (HUD) are collections of unstructured documents that share common properties, such as similar layout, common file format, or common domain of values. Building on such properties, it would be desirable to automatically process HUD to access the main information through a semantic layer – typically an ontology – called semantic view. Hence, we propose an ontology-based approach for extracting semantically rich information from HUD, by integrating and extending recent technologies and results from the fields of classical information extraction, table recognition, ontologies, text annotation, and logic programming. Moreover, we design and implement a system, named KnowRex, that has been successfully applied to curriculum vitae in the Europass style to offer a semantic view of them, and be able, for example, to select those which exhibit required skills.

Adversarial Learning for Neural Dialogue Generation <=SEP=> In this paper, drawing intuition from the Turing test, we propose using adversarial training for open-domain dialogue generation: the system is trained to produce sequences that are indistinguishable from human-generated dialogue utterances. We cast the task as a reinforcement learning (RL) problem where we jointly train two systems, a generative model to produce response sequences, and a discriminator—analagous to the human evaluator in the Turing test— to distinguish between the human-generated dialogues and the machine-generated ones. The outputs from the discriminator are then used as rewards for the generative model, pushing the system to generate dialogues that mostly resemble human dialogues. In addition to adversarial training we describe a model for adversarial evaluation that uses success in fooling an adversary as a dialogue evaluation metric, while avoiding a number of potential pitfalls. Experimental results on several metrics, including adversarial evaluation, demonstrate that the adversarially-trained system generates higher-quality responses than previous baselines.

Fuzzy Hidden Markov Models for Indonesian Speech Classification <=SEP=> Indonesia has a lot of tribe, so that there are a lot of dialects. Speech classification is difficult if the database uses speech signals from various people who have different characteristics because of gender and dialect. The different characteristics will influence frequency, intonation, amplitude, and period of the speech. It makes the system must be trained for the various templates reference of speech signal. Therefore, this study has been developed for Indonesian speech classification. This study designs the solution of the different characteristics for Indonesian speech classification. The solution combines Fuzzy on Hidden Markov Models. The new design of fuzzy Hidden Markov Models will be proposed in this study. The models will consist of Fuzzy C-Means Clustering which will be designed to substitute the vector quantization process and a new forward and backward method to handle the membership degree of data. The result shows FHMM is better than HMM and the improvement was 3.33 %.

Image-based indoor positioning system: fast image matching using omnidirectional panoramic images <=SEP=> In this paper, we developed an image-based indoor localization system using omnidirectional panoramic images to which location information is added. By the combination of the robust image matching by PCA-SIFT and fast nearest neighbor search algorithm based on Locality Sensitive Hashing (LSH), our system can estimate users' positions with high accuracy and in a short time. To improve the precision, we introduced the "confidence" of the image matching results. We conducted experiments at the Railway Museum and we obtained 426 omnidirectional panoramic reference images and 1067 supplemental images for image matching. Experimental results using 126 test images demonstrated that the location detection accuracy is above 90% with about 2.2s of processing time.

Feature-based brain MRI retrieval for Alzheimer disease diagnosis <=SEP=> In this paper we consider the application of the feature-based approach to medical image retrieval, particularly brain MRI scans for early Alzheimer's disease diagnosis. The key idea is to provide the doctor with the images which have similar visual properties and have full case record, giving the ability to make more informed decision in the prodromal phase of the disease. With regard to the state-of-the art SIFT features in a Bag-of-Visual-Words approach we propose to use the Laguerre Circular Harmonic Functions coefficients as feature vectors. An additional pre-classification step based on estimation of Alzheimer's disease early image abnormalities is proposed to improve overall precision.

Don't Be Lazy, Be Consistent: Postgres-R, A New Way to Implement Database Replication <=SEP=>  \ N\| N\wOEN^|< e\ eNNN¡  ^  N¢X\£<¤ N¥N ¦||§N| ̈\<©RN\dV\a | aN ¦|<§ « \\NX¡;aUN\ O¢X\ N¬  ^  \NW \0\|aUNN­@®u7 | a^NN¡e¤o  O¤ \ a \ aN\`¦||a |\ ̄ 0§N WJ§N|\§X a ¢N<N <£  | 7 §Xa  | \| O « aO¤ I J O¢X¦ \X§° a |± aNN­ 20\NO¢NN¡¤@\ O¤3 O¤¬ a\O3 ^\X \¦| \| §X ^9| §N\^\\NU| &&N¦  \a\w\£<\Na4­e ́ * WXjaμ§N \N*  N¤  \<§N¦|  ` N| |a  ¦|NaUN<\\| |·¶[\u3 _ ̧ 1 oe­R®u¦|\  O¢<μaN9N»<^N\|aUN<\¦[\N ¦|\  O¢ | @\ a a <£1⁄4j\ a& aN  0¦||a |\1⁄43 \|  O \N ¦||§N\| §NJ^4O¢μaN <£  μa \ a    μ\ \X§° a |± aNN­

Knowledge Sharing in the Workplace: A Social Networking Site Assessment <=SEP=> Enterprise executives are taking note that great potential exists for enhancing knowledge sharing and linking experts within the organization when incorporating social software technologies into their operations. But there are warnings of potential negative effects if ineffective use or even misuse of these technologies occurs. There is relatively little empirical research examining the business impact of social software implementations evolving from Web 2.0 applications when considering the effects of trust on knowledge sharing. This paper attempts to fill this gap in the research by proposing a theoretical framework to study the effects of trust, risk and benefits, critical mass, and social influence on knowledge sharing intentions of employees using social media technology in the organization.

Rectangular patch antenna with inset feed and modified ground-plane for wideband antenna <=SEP=> This paper presents the technique for increasing bandwidth of rectangular patch antenna from 0.88 GHz (7.76 - 8.64 GHz) to 6.75 GHz (3.49 - 10.24 GHz). This technique use inset feed patch antenna with modified ground plane for achieved widest bandwidth. We will propose three types of rectangular patch antenna: the simple rectangular patch fed by microstrip line, inset feed rectangular patch and inset feed rectangular patch with modifies ground plane. The final simulation result show that the lower edge of frequency is moved down from 7.76 GHz to 3.49 GHz and the higher edge of frequency is shifted up from 8.64 GHz to 10.24 GHz, which is the one selection for increasing bandwidth of rectangular patch antenna for wideband. Details of the increasing bandwidth of microstrip patch antenna are described, and simulation results for obtained wideband performance are presented by using IE3D Zeland software.

Learning to Ask: Neural Question Generation for Reading Comprehension <=SEP=> We study automatic question generation for sentences from text passages in reading comprehension. We introduce an attention-based sequence learning model for the task and investigate the effect of encoding sentencevs. paragraph-level information. In contrast to all previous work, our model does not rely on hand-crafted rules or a sophisticated NLP pipeline; it is instead trainable end-to-end via sequenceto-sequence learning. Automatic evaluation results show that our system significantly outperforms the state-of-the-art rule-based system. In human evaluations, questions generated by our system are also rated as being more natural (i.e., grammaticality, fluency) and as more difficult to answer (in terms of syntactic and lexical divergence from the original text and reasoning needed to answer).

Petri Net Modeling of Cyber-Physical Attacks on Smart Grid <=SEP=> This paper investigates the use of Petri nets for modeling coordinated cyber-physical attacks on the smart grid. Petri nets offer more flexibility and expressiveness than traditional attack trees to represent the actions of simultaneous attackers. However, Petri net models for attacks on very large critical infrastructures such as the smart grid require a great amount of manual effort and detailed expertise in cyber-physical threats. To overcome these obstacles, we propose a novel hierarchical method to construct large Petri nets from a number of smaller Petri nets that can be created separately by different domain experts. The construction method is facilitated by a model description language that enables identical places in different Petri nets to be matched. The new modeling approach is described for an example attack on smart meters, and its efficacy is demonstrated by a proof-of-concept Python program.

Pattern frequency representation for time series classification <=SEP=> The paper presents a new method for data transformation. The obtained data format enhances the efficiency of the time series classification. The transformation is realized in four steps, namely: time series segmentation, segment's feature representation, segments' binning and pattern frequency representation. The method is independent of the nature of the data, and it works well with temporal data from diverse areas. Its ability is proved by classification of different real datasets and is also compared with the results of other classification methods.

A trust-semantic fusion-based recommendation approach for e-business applications <=SEP=> a r t i c l e i n f o Collaborative Filtering (CF) is the most popular recommendation technique but still suffers from data sparsi-ty, user and item cold-start problems, resulting in poor recommendation accuracy and reduced coverage. This study incorporates additional information from the users' social trust network and the items' semantic domain knowledge to alleviate these problems. It proposes an innovative Trust–Semantic Fusion (TSF)-based recommendation approach within the CF framework. Experiments demonstrate that the TSF approach significantly outperforms existing recommendation algorithms in terms of recommendation accuracy and coverage when dealing with the above problems. A business-to-business recommender system case study validates the applicability of the TSF approach. Recommender systems are considered the most popular forms of web personalization and have become a promising and important research topic in information sciences and decision support systems Recommender systems are used to either predict whether a particular user will like a particular item or to identify a set of k items that will be of interest to a certain user, and have been used in different web-based applications including e-business, e-learning and e-tourism [8,22,31]. Currently, Collaborative Filtering (CF) is probably the most known and commonly used recommendation approach in recommender systems. CF works by collecting user ratings for items in a given domain and computing similarities between users or between items in order to produce recommendations [1,31]. CF can be further divided into user-based and item-based CF approaches. In user-based CF approach, a user will receive recommendations of items that similar users liked. In item-based CF approach, a user will receive recommendations of items that are similar to the ones that the user liked in the past [1]. Despite their popularity and success, the CF-based approaches still suffer from some major limitations ; these include data sparsity, cold-start user and cold-start item problems [1,3,36,37]. The data sparsity problem occurs when the number of available items increases and the number of ratings in the rating matrix is insufficient for generating accurate predictions. When the ratings obtained are very small compared to the number of ratings that are needed to be predicted, a recommender system becomes unable to locate similar neighbors and produces poor recommendations. The cold-start (CS) user problem, which is also known as the new user problem, affects users who have none, or a small number of ratings. When the number of rated items is small for the CS user, …

Development of Network Gateway Between CAN and FlexRay Protocols For ECU Embedded Systems <=SEP=> This paper presents a network gateway between the CAN and FlexRay protocols for ECU embedded systems. Flexible gateways are necessary for implementing several functions to avoiding the need for increased clock speed. This gateway system is based on a second internal control unit, which can be implemented as a RISC or a specialized finite state machine and use combined message buffer RAM. The control unit is used to lessen the interrupt burden of the main CPU and to reduce the required CPU performance, while message buffer RAM is used to store all messages transmitted and received. It requires a high system frequency to guarantee the transfer of data between two or more networks in real-time and to assure data integrity. To compensate for the limited functionality of the modules, the control unit requires greater program memory capacity, for storing the complex routing information. This gateway system is based on proven communication controllers, expanded with a gateway interface. These communication controllers are linked by an independent CPU data bus structure that enables the transfer of messages. The data flow between the modules is controlled by an application specific gateway unit that provides all control signals. This unit consists of special function registers or of an independent CPU finite state machine. Due to the special gateway interfaces, which allows concurrent CPU and gateway unit request to the same cell, semaphores and flags are not necessary. This maximizes the flexibility of the module. These Gateways play and will continue to play a major role in automotive networks such as CAN, and FlexRay

Exemplar-Based 3D Shape Segmentation in Point Clouds <=SEP=> This paper addresses the problem of automatic 3D shape segmentation in point cloud representation. Of particular interest are segmentations of noisy real scans, which is a difficult problem in previous works. To guide segmentation of target shape, a small set of pre-segmented exemplar shapes in the same category is adopted. The main idea is to register the target shape with exemplar shapes in a piece-wise rigid manner, so that pieces under the same rigid transformation are more likely to be in the same segment. To achieve this goal, an over-complete set of candidate transformations is generated in the first stage. Then, each transformation is treated as a label and an assignment is optimized over all points. The transformation labels, together with nearest-neighbor transferred segment labels, constitute final labels of target shapes. The method is not dependent on high-order features, and thus robust to noise as can be shown in the experiments on challenging datasets.

Applying Vector Space Model (VSM) Techniques in Information Retrieval for Arabic Language <=SEP=> i Acknowledgments vi

Unpacking Spear Phishing Susceptibility <=SEP=> We report the results of a field experiment where we sent to over 1200 university students an email or a Facebook message with a link to (non-existing) party pictures from a non-existing person, and later asked them about the reasons for their link clicking behavior. We registered a significant difference in clicking rates: 20% of email versus 42.5% of Facebook recipients clicked. The most frequently reported reason for clicking was curiosity (34%), followed by the explanations that the message fit recipient’s expectations (27%). Moreover, 16% thought that they might know the sender. These results show that people’s decisional heuristics are relatively easy to misuse in a targeted attack, making defense especially challenging.

A Model for Competence and Integrity in Variable Payoff Games <=SEP=> Agents often have to trust one another when engaging in joint actions. In many cases, no single design team has the authority to assure that agents cooperate. Trust is required when agents hold potentially different values or conflicting goals. This paper presents a framework and some initial experiments for decomposing agent reputation within a multi-agent society into two characteristics: competence and integrity. The framework models competence as the probability of successfully carrying out an intended action. Integrity is modeled as a rational commitment to maintaining a reputation, based on the agent’s assessment of the game’s discount rate. We show that a simple, one-level-deep recursive model—given accurate knowledge of self and the other agent’s competence and integrity (commitment to reputation)—outperforms titfor-tat and other standard strategies in evolutionary round-robin iterated prisoner’s dilemma tournaments. This indicates that the approach taken here warrants further investigation using more realistic and complex strategies.

Automatic construction of multifaceted browsing interfaces <=SEP=> Databases of text and text-annotated data constitute a significant fraction of the information available in electronic form. Searching and browsing are the typical ways that users locate items of interest in such databases. Interfaces that use multifaceted hierarchies represent a new powerful browsing paradigm which has been proven to be a successful complement to keyword searching. Thus far, multifaceted hierarchies have been created manually or semi-automatically, making it difficult to deploy multifaceted interfaces over a large number of databases. We present automatic and scalable methods for creation of multifaceted interfaces. Our methods are integrated with traditional relational databases and can scale well for large databases. Furthermore, we present methods for selecting the best portions of the generated hierarchies when the screen space is not sufficient for displaying all the hierarchy at once. We apply our technique to a range of large data sets, including annotated images, television programming schedules, and web pages. The results are promising and suggest directions for future research.

Fuzzy controlled fast charging system for lithium-ion batteries <=SEP=> A DSP is adopted to construct a fuzzy controlled lithium-ion battery charging system. By using this intelligent charging system, the data collection, calculation and peripheral circuit control are performed for the battery charging status. According to the lithium-ion battery charging specifications, two hours are required for battery charging. A fuzzy logic controller (FLC) is constructed by using the battery protection cell voltage and voltage difference among the batteries. They are used as the input variable to shorten the charging and equalizing time and assure that the battery will be operated within the safety voltage range.

Design and Describe REST API without Violating REST: A Petri Net Based Approach <=SEP=> As REST architectural style gains popularity in the web service community, there is a growing concern and debate on how to design Restful web services (REST API) in a proper way. We attribute this problem to lack of a standard model and language to describe a REST API that respects all the REST constraints. As a result, many web services that claim to be REST API are not hypermedia driven as prescribed by REST. This situation may lead to REST APIs that are not as scalable, extensible, and interoperable as promised by REST. To address this issue, this paper proposes REST Chart as a model and language to design and describe REST API without violating the REST constraints. REST Chart models a REST API as a special type of Colored Petri Net whose topology defines the REST API and whose token markings define the representational state space of user agents using that API. We demonstrate REST Chart with an example REST API. We also show how REST Chart can support efficient content negotiation and reuse hybrid representations to broaden design choices. Furthermore, we argue that the REST constraints, such as hypermedia driven and statelessness, can either be enforced naturally or checked automatically in REST Chart.

Smart Cameras as Embedded Systems <=SEP=> I ncreasingly powerful integrated circuits are making an entire range of new applications possible. Complementary metal-oxide semiconductor (CMOS) sensors, for example, have made the digital camera a commonplace consumer item. These light-sensitive chips, positioned where film would normally be, capture images as reusable digital files that users can upload to their computer, manipulate with software, and distribute electronically. Recent technological advances are enabling a new generation of smart cameras that represent a quantum leap in sophistication. While today's digital cameras capture images, smart cameras capture high-level descriptions of the scene and analyze what they see. These devices could support a wide variety of applications including human and animal detection, surveillance, motion analysis, and facial identification. Video processing has an insatiable demand for real-time performance. Fortunately, Moore's law provides an increasing pool of available computing power to apply to real-time analysis. Smart cameras leverage very large-scale integration (VLSI) to provide such analysis in a low-cost, low-power system with substantial memory. Moving well beyond pixel processing and compression, these systems run a wide range of algorithms to extract meaning from streaming video. Because they push the design space in so many dimensions, smart cameras are a leading-edge application for embedded system research. has developed a first-generation smart camera system that can detect people and analyze their movement in real time. Although there are many approaches to real-time video analysis, we chose to focus initially on human gesture recognition—identifying whether a subject is walking, standing, waving his arms, and so on. Because much work remains to be done on this problem, we sought to design an embedded system that can incorporate future algorithms as well as use those we created exclusively for this application. As Figure 1 shows, our algorithms use both low-level and high-level processing. The low-level component identifies different body parts and categorizes their movement in simple terms. The high-level component, which is application-dependent, uses this information to recognize each body part's action and the person's overall activity based on scenario parameters. The system captures images from the video input, which can be either uncompressed or compressed (MPEG and motion JPEG), and applies four different algorithms to detect and identify human body parts. Region extraction. The first algorithm transforms the pixels of an image, like that shown in Figure 2a, into an M × N bitmap and eliminates the background. It then detects the body part's skin area using a YUV …

CipherXRay: Exposing Cryptographic Operations and Transient Secrets from Monitored Binary Execution <=SEP=> Malwares are becoming increasingly stealthy, more and more malwares are using cryptographic algorithms (e.g., packing, encrypting C&C communication) to protect themselves from being analyzed. The use of cryptographic algorithms and truly transient cryptographic secrets inside the malware binary imposes a key obstacle to effective malware analysis and defense. To enable more effective malware analysis, forensics, and reverse engineering, we have developed CipherXRay - a novel binary analysis framework that can automatically identify and recover the cryptographic operations and transient secrets from the execution of potentially obfuscated binary executables. Based on the avalanche effect of cryptographic functions, CipherXRay is able to accurately pinpoint the boundary of cryptographic operation and recover truly transient cryptographic secrets that only exist in memory for one instant in between multiple nested cryptographic operations. CipherXRay can further identify certain operation modes (e.g., ECB, CBC, CFB) of the identified block cipher and tell whether the identified block cipher operation is encryption or decryption in certain cases. We have empirically validated CipherXRay with OpenSSL, popular password safe KeePassX, the ciphers used by malware Stuxnet, Kraken and Agobot, and a number of third party softwares with built-in compression and checksum. CipherXRay is able to identify various cryptographic operations and recover cryptographic secrets that exist in memory for only a few microseconds. Our results demonstrate that current software implementations of cryptographic algorithms hardly achieve any secrecy if their execution can be monitored.

3D-Parallel Coordinates: Visualization for time varying multidimensional data <=SEP=> Parallel coordinates can visualize multidimensional data efficiently, during to its shortage in displaying time-varying data, we present a new method to add time dimension, which can extend parallel coordinates into 3D space(3D-Parallel Coordinates) consisted of attribute, range and time dimension. So that time-varying multidimensional data can be displayed as polygonal line cluster for recording and analyzing. A technique called clipping shade is taken to highlight datasets around the current time, and results reveal that 3D-Parallel Coordinates can effectively analyze attribute's time-varying character.