Query: Evaluation of a Brute Forcing Tool that Extracts the RAT from a Malicious Document File

Relevant passages:
Malicious PDF detection using metadata and structural features <=SEP=> Owed to their versatile functionality and widespread adoption, PDF documents have become a popular avenue for user exploitation ranging from large-scale phishing attacks to targeted attacks. In this paper, we present a framework for robust detection of malicious documents through machine learning. Our approach is based on features extracted from document metadata and structure. Using real-world datasets, we demonstrate the the adequacy of these document properties for malware detection and the durability of these features across new malware variants. Our analysis shows that the Random Forests classification method, an ensemble classifier that randomly selects features for each individual classification tree, yields the best detection rates, even on previously unseen malware.
 Indeed, using multiple datasets containing an aggregate of over 5,000 unique malicious documents and over 100,000 benign ones, our classification rates remain well above 99% while maintaining low false positives of 0.2% or less for different classification parameters and experimental scenarios. Moreover, the classifier has the ability to detect documents crafted for targeted attacks and separate them from broadly distributed malicious PDF documents. Remarkably, we also discovered that by artificially reducing the influence of the top features in the classifier, we can still achieve a high rate of detection in an adversarial setting where the attacker is aware of both the top features utilized in the classifier and our normality model. Thus, the classifier is resilient against mimicry attacks even with knowledge of the document features, classification method, and training set.

Xen and the art of virtualization <=SEP=> Numerous systems have been designed which use virtualization to subdivide the ample resources of a modern computer. Some require specialized hardware, or cannot support commodity operating systems. Some target 100% binary compatibility at the expense of performance. Others sacrifice security or functionality for speed. Few offer resource isolation or performance guarantees; most provide only best-effort provisioning, risking denial of service.This paper presents Xen, an x86 virtual machine monitor which allows multiple commodity operating systems to share conventional hardware in a safe and resource managed fashion, but without sacrificing either performance or functionality. This is achieved by providing an idealized virtual machine abstraction to which operating systems such as Linux, BSD and Windows XP, can be ported with minimal effort.Our design is targeted at hosting up to 100 virtual machine instances simultaneously on a modern server. The virtualization approach taken by Xen is extremely efficient: we allow operating systems such as Linux and Windows XP to be hosted simultaneously for a negligible performance overhead --- at most a few percent compared with the unvirtualized case. We considerably outperform competing commercial and freely available solutions in a range of microbenchmarks and system-wide tests.

Static detection of malicious JavaScript-bearing PDF documents <=SEP=> Despite the recent security improvements in Adobe's PDF viewer, its underlying code base remains vulnerable to novel exploits. A steady flow of rapidly evolving PDF malware observed in the wild substantiates the need for novel protection instruments beyond the classical signature-based scanners. In this contribution we present a technique for detection of JavaScript-bearing malicious PDF documents based on static analysis of extracted JavaScript code. Compared to previous work, mostly based on dynamic analysis, our method incurs an order of magnitude lower run-time overhead and does not require special instrumentation. Due to its efficiency we were able to evaluate it on an extremely large real-life dataset obtained from the VirusTotal malware upload portal. Our method has proved to be effective against both known and unknown malware and suitable for large-scale batch processing.

Classification and Regression Trees <=SEP=> 

Stealthy malware detection through vmm-based "out-of-the-box" semantic view reconstruction <=SEP=> An alarming trend in malware attacks is that they are armed with stealthy techniques to detect, evade, and subvert malware detection facilities of the victim. On the defensive side, a fundamental limitation of traditional host-based anti-malware systems is that they run inside the very hosts they are protecting ("in the box"), making them vulnerable to counter-detection and subversion by malware. To address this limitation, recent solutions based on virtual machine (VM) technologies advocate placing the malware detection facilities outside of the protected VM ("out of the box"). However, they gain tamper resistance at the cost of losing the native, semantic view of the host which is enjoyed by the "in the box" approach, thus leading to a technical challenge known as the semantic gap.
 In this paper, we present the design, implementation, and evaluation of VMwatcher - an "out-of-the-box" approach that overcomes the semantic gap challenge. A new technique called guest view casting is developed to systematically reconstruct internal semantic views (e.g., files, processes, and kernel modules) of a VM from the outside in a non-intrusive manner. Specifically, the new technique casts semantic definitions of guest OS data structures and functions on virtual machine monitor (VMM)-level VM states, so that the semantic view can be reconstructed. With the semantic gap bridged, we identify two unique malware detection capabilities: (1) view comparison-based malware detection and its demonstration in rootkit detection and (2) "out-of-the-box" deployment of host-based anti-malware software with improved detection accuracy and tamper-resistance. We have implemented a proof-of-concept prototype on both Linux and Windows platforms and our experimental results with real-world malware, including elusive kernel-level rootkits, demonstrate its practicality and effectiveness.

Automated and Cooperative Vehicle Merging at Highway On-Ramps <=SEP=> Recognition of necessities of connected and automated vehicles (CAVs) is gaining momentum. CAVs can improve both transportation network efficiency and safety through control algorithms that can harmonically use all existing information to coordinate the vehicles. This paper addresses the problem of optimally coordinating CAVs at merging roadways to achieve smooth traffic flow without stop-and-go driving. We present an optimization framework and an analytical closed-form solution that allows online coordination of vehicles at merging zones. The effectiveness of the efficiency of the proposed solution is validated through a simulation, and it is shown that coordination of vehicles can significantly reduce both fuel consumption and travel time.

An ESPAR Antenna for Beamspace-MIMO Systems Using PSK Modulation Schemes <=SEP=> In this paper the use of electronically steerable passive array radiator (ESPAR) antennas is introduced for achieving increased spectral efficiency characteristics in multiple-input, multiple-output (MIMO) systems using a single active element, and compact antennas. The proposed ESPAR antenna is capable of mapping phase-shift-keying (PSK) modulated symbols to be transmitted onto orthogonal basis functions on the wavevector domain of the multi-element antenna (MEA), instead of the traditional approach of sending different symbol streams in different locations on the antenna domain. In this way, different symbols are transmitted simultaneously towards different angles of departure at the transmitter side. We show that the proposed system, called beamspace-MIMO (BS-MIMO) can achieve performance characteristics comparable to traditional MIMO systems while using a single radio-frequency (RF) front-end and ESPAR antenna arrays of total length equal to lambda/8, for popular PSK modulation schemes such as binary-PSK (BPSK), quaternary-PSK (QPSK), as well as for their offset-PSK and differential-PSK variations.

N-gram-based Machine Translation <=SEP=> This article describes in detail an n-gram approach to statistical machine translation. This approach consists of a log-linear combination of a translation model based on n-grams of bilingual units, which are referred to as tuples, along with four specific feature functions. Translation performance, which happens to be in the state of the art, is demonstrated with Spanish-to-English and English-to-Spanish translations of the European Parliament Plenary Sessions (EPPS).

To queue or not to queue : equilibrium behavior in queueing systems <=SEP=> To the memory of my parents, Sara and Avraham Haviv To my mother and late father, Fela and Shimon Hassin Contents Preface xi 1. INTRODUCTION 1 1.1 Basic concepts 2 1.1.1 Strategies, payoffs, and equilibrium 2 1.1.2 Steady-state 4 1.1.3 Subgame perfect equilibrium 5 1.1.4 Evolutionarily stable strategies 5 1.1.5 The Braess paradox 5 1.1.6 Avoid the crowd or follow it? 6 1.2 Threshold strategies 7 1.3 Costs and objectives 9 1.4 Queueing theory preliminaries 11 1.5 A shuttle example 14 1.5.1 The unobservable model 14 1.5.2 The observable model 17 1.5.3 Social optimality 18 1.6 Non-stochastic models 19

Merkle Tree Traversal in Log Space and Time <=SEP=> We present a technique for Merkle tree traversal which requires only logarithmic space and time. For a tree with N nodes, our algorithm computes sequential tree leaves and authentication path data in time Log2(N) and space less than 3Log2(N), where the units of computation are hash function evaluations or leaf value computations, and the units of space are the number of node values stored. Relative to this algorithm, we show our bounds to be necessary and sufficient. This result is an asymptotic improvement over all other previous results (for example, measuring cost = space ∗ time). We also prove that the complexity of our algorithm is optimal: There can exist no Merkle tree traversal algorithm which consumes both less than O(Log2(N)) space and less than O(Log2(N)) time. Our algorithm is especially of practical interest when space efficiency is required, and can also enhance other traversal algorithms which relax space constraints to gain speed.

Kinematics and Jacobian analysis of a 6UPS Stewart-Gough platform <=SEP=> In this paper a complete kinematics analysis of a 6UPS Stewart-Gough platform is performed. A new methodology to deal with the forward kinematics problem based on a multibody formulation and a numerical method is presented, resulting in a highly efficient formulation approach. The idea of a multibody formulation is basically to built for each joint that links the body of the robot, a set of equations that define the constraints on their movement so that the joint variables are included in these equations. Once the constraint function is defined, we may use a numerical method to find the kinematic solution. In order to avoid the problem reported with the orientation (Euler's Angles) of the moving platform, a generalized coordinates vector using quaternions is applied. Then, the Jacobian analysis using reciprocal screw systems is described and the workspace is determined. Finally, a design of a simulator using MATLAB as programming tool is presented.

Coping with compassion fatigue. <=SEP=> Helping others who have undergone a trauma from a natural disaster, accident, or sudden act of violence, can be highly satisfying work. But helping trauma victims can take a toll on even the most seasoned mental health professional. Ongoing exposure to the suffering of those you are helping can bring on a range of signs and symptoms -including anxiety, sleeplessness, irritability, and feelings of helplessness -that can interfere, sometimes significantly, with everyday life and work. In clinicians, including therapists, counselors, and social workers, this response is often referred to as “compassion fatigue” or “secondary post-traumatic stress.”

The flipped classroom: a course redesign to foster learning and engagement in a health professions school. <=SEP=> Recent calls for educational reform highlight ongoing concerns about the ability of current curricula to equip aspiring health care professionals with the skills for success. Whereas a wide range of proposed solutions attempt to address apparent deficiencies in current educational models, a growing body of literature consistently points to the need to rethink the traditional in-class, lecture-based course model. One such proposal is the flipped classroom, in which content is offloaded for students to learn on their own, and class time is dedicated to engaging students in student-centered learning activities, like problem-based learning and inquiry-oriented strategies. In 2012, the authors flipped a required first-year pharmaceutics course at the University of North Carolina Eshelman School of Pharmacy. They offloaded all lectures to self-paced online videos and used class time to engage students in active learning exercises. In this article, the authors describe the philosophy and methodology used to redesign the Basic Pharmaceutics II course and outline the research they conducted to investigate the resulting outcomes. This article is intended to serve as a guide to instructors and educational programs seeking to develop, implement, and evaluate innovative and practical strategies to transform students' learning experience. As class attendance, students' learning, and the perceived value of this model all increased following participation in the flipped classroom, the authors conclude that this approach warrants careful consideration as educators aim to enhance learning, improve outcomes, and fully equip students to address 21st-century health care needs.

An Empirical Investigation of the Impact of Individual and Work Characteristics on Telecommuting Success <=SEP=> Individual and work characteristics are used in telecommuting plans; however, their impact on telecommuting success is not well known. We studied how employee tenure, work experience, communication skills, task interdependence, work output measurability, and task variety impact telecommuter productivity, performance, and satisfaction after taking into account the impact of communication technologies. Data collected from 89 North American telecommuters suggest that in addition to the richness of the media, work experience, communication skills, and task interdependence impact telecommuting success. These characteristics are practically identifiable and measurable; therefore, we expect our findings to help managers convert increasing telecommuting adoption rates to well-defined and measurable gains.

An End-to-End Spatio-Temporal Attention Model for Human Action Recognition from Skeleton Data <=SEP=> Human action recognition is an important task in computer vision. Extracting discriminative spatial and temporal features to model the spatial and temporal evolutions of different actions plays a key role in accomplishing this task. In this work, we propose an end-to-end spatial and temporal attention model for human action recognition from skeleton data. We build our model on top of the Recurrent Neural Networks (RNNs) with Long Short-Term Memory (LSTM), which learns to selectively focus on discriminative joints of skeleton within each frame of the inputs and pays different levels of attention to the outputs of different frames. Furthermore, to ensure effective training of the network, we propose a regularized cross-entropy loss to drive the model learning process and develop a joint training strategy accordingly. Experimental results demonstrate the effectiveness of the proposed model, both on the small human action recognition dataset of SBU and the currently largest NTU dataset.

Fast Viterbi map matching with tunable weight functions <=SEP=> This paper describes a map matching program submitted to the ACM SIGSPATIAL Cup 2012. We first summarize existing map matching algorithms into three categories, and compare their performance thoroughly. In general, global max-weight methods using the Viterbi dynamic programming algorithm are the most accurate but the accuracy varies at different sampling intervals using different weight functions. Our submission selects a hybrid that improves upon the best two weight functions such that its accuracy is better than both and the performance is robust against varying sampling rates. In addition, we employ many optimization techniques to reduce the overall latency, as the scoring heavily emphasizes on speed. Using the training dataset with manually corrected ground truth, our Java-based program matched all 14,436 samples in 5 seconds on a dual-core 3.3 GHz iCore 3 processor, and achieved 98.9% accuracy.

Domain Adaptation with Adversarial Neural Networks and Auto-encoders <=SEP=> Background. Domain adaptation focuses on the situation where we have data generated from multiple domains, which are assumed to be different, but similar, in a certain sense. In this work we focus on the case where there are two domains, known as the source and the target domain. The source domain is assumed to have a large amount of labeled data while labeled data in the target domain is scarce. The goal of domain adaptation algorithms is to generalize better on the target domain by exploiting the large amount of labeled data in the related source domain.

A particle filter for monocular vision-aided odometry <=SEP=> We propose a particle filter-based algorithm for monocular vision-aided odometry for mobile robot localization. The algorithm fuses information from odometry with observations of naturally occurring static point features in the environment. A key contribution of this work is a novel approach for computing the particle weights, which does not require including the feature positions in the state vector. As a result, the computational and sample complexities of the algorithm remain low even in feature-dense environments. We validate the effectiveness of the approach extensively with both simulations as well as real-world data, and compare its performance against that of the extended Kalman filter (EKF) and FastSLAM. Results from the simulation tests show that the particle filter approach is better than these competing approaches in terms of the RMS error. Moreover, the experiments demonstrate that the approach is capable of achieving good localization accuracy in complex environments.

Attacking the Washington, D.C. Internet Voting System <=SEP=> In 2010, Washington, D.C. developed an Internet voting pilot project that was intended to allow overseas absentee voters to cast their ballots using a website. Prior to deploying the system in the general election, the District held a unique public trial: a mock election during which anyone was invited to test the system or attempt to compromise its security. This paper describes our experience participating in this trial. Within 48 hours of the system going live, we had gained nearcomplete control of the election server. We successfully changed every vote and revealed almost every secret ballot. Election officials did not detect our intrusion for nearly two business days—and might have remained unaware for far longer had we not deliberately left a prominent clue. This case study—the first (to our knowledge) to analyze the security of a government Internet voting system from the perspective of an attacker in a realistic pre-election deployment—attempts to illuminate the practical challenges of securing online voting as practiced today by a growing number of jurisdictions.

Applications of Educational Data Mining: A survey <=SEP=> Various educational oriented problems are resolved through Educational Data Mining, which is the most prevalent applications of data mining. One of the crucial goals of this paper is to study the most recent works carried out on EDM and analyze their merits and drawbacks. This paper also highlights the cumulative results of the various data mining practices and techniques applied in the surveyed articles, and thereby suggesting the researchers on the future directions on EDM. In addition, an experiment was also conducted to evaluate, certain classification and clustering algorithms to observe the most reliable algorithms for future researches.

Analysis of Deep Convolutional Neural Network Architectures <=SEP=> In computer vision many tasks are solved using machine learning. In the past few years, state of the art results in computer vision have been achieved using deep learning. Deeper machine learning architectures are better capable in handling complex recognition tasks, compared to previous more shallow models. Many architectures for computer vision make use of convolutional neural networks which were modeled after the visual cortex. Currently deep convolutional neural networks are the state of the art in computer vision. Through a literature survey an overview is given of the components in deep convolutional neural networks. The role and design decisions for each of the components is presented, and the difficulties involved in training deep neural networks are given. To improve deep learning architectures an analysis is given of the activation values in four different architectures using various activation functions. Current state of the art classifiers use dropout, max-pooling as well as the maxout activation function. New components may further improve the architecture by providing a better solution for the diminishing gradient problem.

Classification and tracking of dynamic objects with multiple sensors for autonomous driving in urban environments <=SEP=> Future driver assistance systems are likely to use a multisensor approach with heterogeneous sensors for tracking dynamic objects around the vehicle. The quality and type of data available for a data fusion algorithm depends heavily on the sensors detecting an object. This article presents a general framework which allows the use sensor specific advantages while abstracting the specific details of a sensor. Different tracking models are used depending on the current set of sensors detecting the object. A sensor independent algorithm for classifying objects regarding their current and past movement state is presented. The described architecture and algorithms have been successfully implemented in Tartan racingpsilas autonomous vehicle for the urban grand challenge. Results are presented and discussed.

NAViGaTOR: Network Analysis, Visualization and Graphing Toronto <=SEP=> SUMMARY
NAViGaTOR is a powerful graphing application for the 2D and 3D visualization of biological networks. NAViGaTOR includes a rich suite of visual mark-up tools for manual and automated annotation, fast and scalable layout algorithms and OpenGL hardware acceleration to facilitate the visualization of large graphs. Publication-quality images can be rendered through SVG graphics export. NAViGaTOR supports community-developed data formats (PSI-XML, BioPax and GML), is platform-independent and is extensible through a plug-in architecture.


AVAILABILITY
NAViGaTOR is freely available to the research community from http://ophid.utoronto.ca/navigator/. Installers and documentation are provided for 32- and 64-bit Windows, Mac, Linux and Unix.


CONTACT
juris@ai.utoronto.ca


SUPPLEMENTARY INFORMATION
Supplementary data are available at Bioinformatics online.

Speed or accuracy? a study in evaluation of simultaneous speech translation <=SEP=> Simultaneous speech translation is a technology that attempts to reduce the delay inherent in speech translation by beginning translation before the end of explicit sentence boundaries. Despite best efforts, there is still often a trade-off between speed and accuracy in these systems, with systems with less delay also achieving lower accuracy. However, somewhat surprisingly, there is no previous work examining the relative importance of speed and accuracy, and thus given two systems with various speeds and accuracies, it is difficult to say with certainty which is better. In this paper, we make the first steps towards evaluation of simultaneous speech translation systems in consideration of both speed and accuracy. We collect user evaluations of speech translation results with different levels of accuracy and delay, and using this data to learn the parameters of an evaluation measure that can judge the trade-off between these two factors. Based on these results, we find that considering both accuracy and delay in the evaluation of speech translation results helps improve correlations with human judgements, and that users placed higher relative importance on reducing delay when results were presented through text, rather than speech.

Cyber-Physical Systems: A New Frontier <=SEP=> The report of the President's Council of Advisors on Science and Technology (PCAST) has placed CPS on the top of the priority list for federal research investment [6]. This article first reviews some of the challenges and promises of CPS, followed by an articulation of some specific challenges and promises that are more closely related to the sensor networks, ubiquitous and trustworthy computing conference.

GP-GAN: Towards Realistic High-Resolution Image Blending <=SEP=> Recent advances in generative adversarial networks (GANs) have shown promising potentials in conditional image generation. However, how to generate high-resolution images remains an open problem. In this paper, we aim at generating high-resolution well-blended images given composited copy-and-paste ones, i.e. realistic highresolution image blending. To achieve this goal, we propose Gaussian-Poisson GAN (GP-GAN), a framework that combines the strengths of classical gradient-based approaches and GANs, which is the first work that explores the capability of GANs in high-resolution image blending task to the best of our knowledge. Particularly, we propose GaussianPoisson Equation to formulate the high-resolution image blending problem, which is a joint optimisation constrained by the gradient and colour information. Gradient filters can obtain gradient information. For generating the colour information, we propose Blending GAN to learn the mapping between the composited image and the well-blended one. Compared to the alternative methods, our approach can deliver high-resolution, realistic images with fewer bleedings and unpleasant artefacts. Experiments confirm that our approach achieves the state-of-the-art performance on Transient Attributes dataset. A user study on Amazon Mechanical Turk finds that majority of workers are in favour of the proposed approach.

Dependent Gaussian Processes <=SEP=> Gaussian processes are usually parameterised in terms of their covariance functions. However, this makes it difficult to deal with multiple outputs, because ensuring that the covariance matrix is positive definite is problematic. An alternative formulation is to treat Gaussian processes as white noise sources convolved with smoothing kernels, and to parameterise the kernel instead. Using this, we extend Gaussian processes to handle multiple, coupled outputs.

Realtime multi-aircraft tracking in aerial scene with deep orientation network <=SEP=> Tracking the aircrafts from an aerial view is very challenging due to large appearance, perspective angle, and orientation variations. The deep-patch orientation network (DON) method was proposed for the multi-ground target tracking system, which is general and can learn the target’s orientation based on the structure information in the training samples. Such approach leverages the performance of tracking-by-detection framework into two aspects: one is to improve the detectability of the targets by using the patch-based model for the target localization in the detection component and the other is to enhance motion characteristics of the individual tracks by incorporating the orientation information as an association metric in the tracking component. Based on the DON structure, you only look once (YOLO) and faster region convolutional neural network (FrRCNN) detection frameworks with simple online and realtime tracking (SORT) tracker are utilized as a case study. The Comparative experiments demonstrate that the overall detection accuracy is improved at the same processing speed of both detection frameworks. Furthermore, the number of Identity switches (IDsw) has reduced about 67% without affecting the computational complexity of the tracking component. Consequently, the presented method is efficient for realtime ground target-tracking scenarios.

Learning user tastes: a first step to generating healthy meal plans <=SEP=> Poor nutrition is fast becoming one of the major causes of ill-health and death in the western world. It is caused by a variety of factors including lack of nutritional understanding leading to poor choices being made when selecting which dishes to cook and eat. We wish to build systems which can recommend nutritious meal plans to users, however a crucial pre-requisite is to be able to recommend dishes that people will like. In this work we investigate key factors contributing to how recipes are rated by analysing the results of a longterm study (n=123 users) in order to understand how best to approach the recommendation problem. In doing so we identify a number of important contextual factors which can influence the choice of rating and suggest how these might be exploited to build more accurate recipe recommender systems. We see this as a crucial first step in a healthy meal recommender. We conclude by summarising our thoughts on how we will combine recommended recipes into meal plans based on nutritional guidelines.

Transliteration for Resource-Scarce Languages <=SEP=> Today, parallel corpus-based systems dominate the transliteration landscape. But the resource-scarce languages do not enjoy the luxury of large parallel transliteration corpus. For these languages, rule-based transliteration is the only viable option. In this article, we show that by properly harnessing the monolingual resources in conjunction with manually created rule base, one can achieve reasonable transliteration performance. We achieve this performance by exploiting the power of Character Sequence Modeling (CSM), which requires only monolingual resources. We present the results of our rule-based system for Hindi to English, English to Hindi, and Persian to English transliteration tasks. We also perform extrinsic evaluation of transliteration systems in the context of Cross Lingual Information Retrieval. Another important contribution of our work is to explain the widely varying accuracy numbers reported in transliteration literature, in terms of the entropy of the language pairs and the datasets involved.