Question: A methodology for detecting Android malware utilizing deep learning with weight adjustment.

This paper explores a novel methodology for assessing the risks and benefits associated with Android application permissions, aiming to enhance user awareness and decision-making regarding app installations. Given the surge in Android's popularity and its subsequent attraction to malicious app developers, there is a pressing need for more sophisticated approaches to evaluate app safety. Current methods often focus solely on the potential risks posed by an app's requested permissions, neglecting the app's benefits and the permission requests of similar apps in the same category. To address these limitations, we introduce a comprehensive evaluation framework that incorporates the app's category, its requested permissions, and the permissions sought by other apps within the same category. This holistic approach aims to provide users with a balanced view, comparing the potential risks against the app's expected benefits. We propose a series of risk indicators and validate their effectiveness using two datasets: one comprising 158,062 legitimate apps from the Android Market, and another consisting of 121 malicious apps. Through extensive data analysis, we showcase the superior performance of our proposed framework in accurately assessing the risks associated with Android app permissions, thereby empowering users to make more informed decisions.

Android remains the dominant OS in the smartphone market even though the iOS share of the market increased during the iPhone 6 release period. As various types of Android smartphones are being launched in the market, forensic studies are being conducted to test data acquisition and analysis. However, since the application of new Android security technologies, it has become more difficult to acquire data using existing forensic methods. In order to address this problem, we propose a new acquisition method based on analyzing the firmware update protocols of Android smartphones. A physical acquisition of Android smartphones can be achieved using the flash memory read command by reverse engineering the firmware update protocol in the bootloader. Our experimental results demonstrate that the proposed method is superior to existing forensic methods in terms of the integrity guarantee, acquisition speed, and physical dump with screen-locked smartphones (USB debugging disabled). © 2015 The Authors. Published by Elsevier Ltd on behalf of DFRWS. This is an open access articleunder theCCBY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

A novel framework for SMS spam filtering is introduced in this paper to prevent mobile phone users from unsolicited SMS messages. The framework makes use of two distinct feature selection approaches based on information gain and chi-square metrics to find out discriminative features representing SMS messages. The discriminative feature subsets are then employed in two different Bayesian-based classifiers, so that SMS messages are categorized as either spam or legitimate. Moreover, the paper introduces a real-time mobile application for Android™ based mobile phones utilizing the proposed spam filtering scheme, as well. Hence, SMS spam messages are silently filtered out without disturbing phone users. Effectiveness of the filtering framework is evaluated on a large SMS message collection including legitimate and spam messages. Following the evaluation, remarkably accurate classification results are obtained for both spam and legitimate messages.

Applications for mobile platforms are being developed at a tremendous rate, but often without proper security implementation. Insecure mobile applications can cause serious information security and data privacy issues and can have severe repercussions on users and organizations alike.

The advance of deep learning has made huge changes in computer vision and produced various off-the-shelf trained models. Particularly, Convolutional Neural Network (CNN) has been widely used to build image classification model which allow researchers transfer the pre-trained learning model for other classifications. We propose a transfer learning method to detect breast cancer using histopathology images based on Google's Inception v3 model which were initially trained for the classification of non-medical images. The pilot study shows the feasibility of transfer learning in the detection of breast cancer with AUC of 0.93.

With the rapidly growing development of cellular networks and powerful smartphones, botnets have invaded the mobile domain. Social media, like Twitter, Facebook, and YouTube have created a new communication channel for attackers. Recently, bot masters started to exploit social media for different malicious activity, such as sending spam, recruitment of new bots, and botnet command and control. In this paper we propose a detection technique for social mediabased mobile botnets using Twitter. The proposed method combines the correlation between tweeting and user activity, such as clicks or taps, and an Artificial Immune System detector, to detect tweets caused by bots and differentiate them from tweets generated by user or by user-approved applications. This detector creates a signature of the tweet and compares it with a dynamically updated signature library of bot behavior signatures. The proposed system has been fully implemented on Android platform and tested under several sets of generated tweets. The test results show that the proposed method has a very high accuracy in detecting bot tweets with about 95% detection ratio.

The prevalence of mobile platforms, the large market share of Android, plus the openness of the Android Market makes it a hot target for malware attacks. Once a malware sample has been identified, it is critical to quickly reveal its malicious intent and inner workings. In this paper we present DroidScope, an Android analysis platform that continues the tradition of virtualization-based malware analysis. Unlike current desktop malware analysis platforms, DroidScope reconstructs both the OSlevel and Java-level semantics simultaneously and seamlessly. To facilitate custom analysis, DroidScope exports three tiered APIs that mirror the three levels of an Android device: hardware, OS and Dalvik Virtual Machine. On top of DroidScope, we further developed several analysis tools to collect detailed native and Dalvik instruction traces, profile API-level activity, and track information leakage through both the Java and native components using taint analysis. These tools have proven to be effective in analyzing real world malware samples and incur reasonably low performance overheads.

The popularity of using Internet contains some risks of network attacks. Intrusion detection is one major research problem in network security, whose aim is to identify unusual access or attacks to secure internal networks. In literature, intrusion detection systems have been approached by various machine learning techniques. However, there is no a review paper to examine and understand the current status of using machine learning techniques to solve the intrusion detection problems. This chapter reviews 55 related studies in the period between 2000 and 2007 focusing on developing single, hybrid, and ensemble classifiers. Related studies are compared by their classifier design, datasets used, and other experimental setups. Current achievements and limitations in developing intrusion detection systems by machine learning are present and discussed. A number of future research directions are also provided. 2009 Elsevier Ltd. All rights reserved.

The use of machine learning models has become ubiquitous. Their predictions are used to make decisions about healthcare, security, investments and many other critical applications. Given this pervasiveness, it is not surprising that adversaries have an incentive to manipulate machine learning models to their advantage. One way of manipulating a model is through a poisoning or causative attack in which the adversary feeds carefully crafted poisonous data points into the training set. Taking advantage of recently developed tamper-free provenance frameworks, we present a methodology that uses contextual information about the origin and transformation of data points in the training set to identify poisonous data, thereby enabling online and regularly re-trained machine learning applications to consume data sources in potentially adversarial environments. To the best of our knowledge, this is the first approach to incorporate provenance information as part of a filtering algorithm to detect causative attacks. We present two variations of the methodology - one tailored to partially trusted data sets and the other to fully untrusted data sets. Finally, we evaluate our methodology against existing methods to detect poison data and show an improvement in the detection rate.

Because it is not hard to reverse engineer the Dalvik bytecode used in the Dalvik virtual machine, Android application repackaging has become a serious problem. With repackaging, a plagiarist can simply steal others’ code violating the intellectual property of the developers. More seriously, after repackaging, popular apps can become the carriers of malware, adware or spy-ware for wide spreading. To maintain a healthy app market, several detection algorithms have been proposed recently, which can catch some types of repackaged apps in various markets efficiently. However, they are generally lack of valid analysis on their effectiveness. After analyzing these approaches, we find simple obfuscation techniques can potentially cause false negatives, because they change the main characteristics or features of the apps that are used for similarity detections. In practice, more sophisticated obfuscation techniques can be adopted (or have already been performed) in the context of mobile apps. We envision this obfuscation based repackaging will become a phenomenon due to the arms race between repackaging and its detection. To this end, we propose a framework to evaluate the obfuscation resilience of repackaging detection algorithms comprehensively. Our evaluation framework is able to perform a set of obfuscation algorithms in various forms on the Dalvik bytecode. Our results provide insights to help gauge both broadness and depth of algorithms’ obfuscation resilience. We applied our framework to conduct a comprehensive case study on AndroGuard, an Android repackaging detector proposed in Black-hat 2011. Our experimental results have demonstrated the effectiveness and stability of our framework.

Detection of malicious software (malware) using ma chine learning methods has been explored extensively to enable fas t detection of new released malware. The performance of these classifiers depen ds on the induction algorithms being used. In order to benefit from mul tiple different classifiers, and exploit their strengths we suggest using an ens emble method that will combine the results of the individual classifiers i nto one final result to achieve overall higher detection accuracy. In this paper we evaluate several combining methods using five different base inducers (C4.5 Dec ision Tree, Naïve Bayes, KNN, VFI and OneR) on five malware datasets. The mai n goal is to find the best combining method for the task of detecting mal icious files in terms of accuracy, AUC and execution time.


Question: A weight-adjusted deep learning method for detecting Android malware.

Introducing DroidScope: A Holistic Approach for Dynamic Analysis of Android Malware through Integrated OS and Dalvik Semantic Views

With the increasing popularity of mobile platforms, particularly Android, and its expansive market presence, the operating system has become a prime target for malware attacks. Upon identifying a malware sample, it becomes imperative to swiftly uncover its malicious objectives and intricate mechanisms. In this paper, we unveil DroidScope, an advanced analysis framework for Android that builds upon the principles of virtualization-based malware analysis, a technique traditionally employed in desktop environments. Unlike existing desktop malware analysis platforms, DroidScope uniquely integrates and harmonizes both the operating system (OS) and Java-level semantics, offering a comprehensive and seamless analysis experience.

To empower custom analysis capabilities, DroidScope offers a tiered API structure that mirrors the hierarchical architecture of an Android device, encompassing hardware, operating system, and Dalvik Virtual Machine levels. This framework facilitates the development of analysis tools that can capture detailed instruction traces at both the native and Dalvik levels, profile activity at the API layer, and trace information leakage through both Java and native components via taint analysis. These sophisticated tools have been successfully employed in the analysis of real-world malware samples, demonstrating their efficacy while maintaining manageable performance overheads. DroidScope represents a significant step forward in the dynamic analysis of Android malware, offering researchers and security professionals a powerful tool to combat the growing threat landscape.

Anomaly detection in supercomputers is a very difficult problem due to the big scale of the systems and the high number of components. The current state of the art for automated anomaly detection employs Machine Learning methods or statistical regression models in a supervised fashion, meaning that the detection tool is trained to distinguish among a fixed set of behaviour classes (healthy and unhealthy states). We propose a novel approach for anomaly detection in High Performance Computing systems based on a Machine (Deep) Learning technique, namely a type of neural network called autoencoder. The key idea is to train a set of autoencoders to learn the normal (healthy) behaviour of the supercomputer nodes and, after training, use them to identify abnormal conditions. This is different from previous approaches which where based on learning the abnormal condition, for which there are much smaller datasets (since it is very hard to identify them to begin with). We test our approach on a real supercomputer equipped with a fine-grained, scalable monitoring infrastructure that can provide large amount of data to characterize the system behaviour. The results are extremely promising: after the training phase to learn the normal system behaviour, our method is capable of detecting anomalies that have never been seen before with a very good accuracy (values ranging between 88% and 96%).

The packaging model of Android apps requires the entire code necessary for the execution of an app to be shipped into one single apk file. Thus, an analysis of Android apps often visits code which is not part of the functionality delivered by the app. Such code is often contributed by the common libraries which are used pervasively by all apps. Unfortunately, Android analyses, e.g., for piggybacking detection and malware detection, can produce inaccurate results if they do not take into account the case of library code, which constitute noise in app features. Despite some efforts on investigating Android libraries, the momentum of Android research has not yet produced a complete set of common libraries to further support in-depth analysis of Android apps. In this paper, we leverage a dataset of about 1.5 million apps from Google Play to harvest potential common libraries, including advertisement libraries. With several steps of refinements, we finally collect by far the largest set of 1,113 libraries supporting common functionality and 240 libraries for advertisement. We use the dataset to investigates several aspects of Android libraries, including their popularity and their proportion in Android app code. Based on these datasets, we have further performed several empirical investigations to confirm the motivations behind our work.

Recently, malware has increasingly become a critical threat to embedded systems, while the conventional software solutions, such as antivirus and patches, have not been so successful in defending the ever-evolving and advanced malicious programs. In this paper, we propose a hardware-enhanced architecture, GuardOL, to perform online malware detection. GuardOL is a combined approach using processor and field-programmable gate array (FPGA). Our approach aims to capture the malicious behavior (i.e., high-level semantics) of malware. To this end, we first propose the frequency-centric model for feature construction using system call patterns of known malware and benign samples. We then develop a machine learning approach (using multilayer perceptron) in FPGA to train classifier using these features. At runtime, the trained classifier is used to classify the unknown samples as malware or benign, with early prediction. The experimental results show that our solution can achieve high classification accuracy, fast detection, low power consumption, and flexibility for easy functionality upgrade to adapt to new malware samples. One of the main advantages of our design is the support of early prediction-detecting 46% of malware within first 30% of their execution, while 97% of the samples at 100% of their execution, with <;3% false positives.

Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.

Intertwined developments between program attacks and defenses witness the evolution of program anomaly detection methods. Emerging categories of program attacks, e.g., non-control data attacks and data-oriented programming, are able to comply with normal trace patterns at local views. This article points out the deficiency of existing program anomaly detection models against new attacks and presents long-span behavior anomaly detection (LAD), a model based on mildly context-sensitive grammar verification. The key feature of LAD is its reasoning of correlations among arbitrary events that occurred in long program traces. It extends existing correlation analysis between events at a stack snapshot, e.g., paired call and ret, to correlation analysis among events that historically occurred during the execution. The proposed method leverages specialized machine learning techniques to probe normal program behavior boundaries in vast high-dimensional detection space. Its two-stage modeling/detection design analyzes event correlation at both binary and quantitative levels. Our prototype successfully detects all reproduced real-world attacks against sshd, libpcre, and sendmail. The detection procedure incurs 0.1 ms to 1.3 ms overhead to profile and analyze a single behavior instance that consists of tens of thousands of function call or system call events.

Machine learning based network anomaly detection methods, which are already effective defense mechanisms against known network intrusion attacks, have also proven themselves to be more successful on the detection of zero-day attacks compared to other types of detection methods. Therefore, research on network anomaly detection using deep learning is getting more attention constantly. In this study we created an anomaly detection model based on a deterministic autoencoder, which discriminates normal and abnormal data by using our proposed stochastic threshold determination approach. We tested our proposed anomaly detection model on the NSL-KDD's test dataset KDDTest+ and obtained an accuracy of 88.28%. The experimental results show that our proposed anomaly detection model can perform almost the same as the most successful and up-to-date machine learning based anomaly detection models in the literature.

Network security is becoming an issue of paramount importance in the information technology era. Nowadays with the dramatic growth of communication and computer networks, security has become a critical subject for computer system. Intrusion detection is the art of detecting computer abuse and any attempt to break the networks. Intrusion detection system is an effective security tool that helps to prevent unauthorized access to network resources by analyzing the network traffic. Different algorithms, methods and applications are created and implemented to solve the problem of detecting the attacks in intrusion detection systems. Most methods detect attacks and categorize in two groups, normal or threat. One of the most promising areas of research in the area of Intrusion Detection deals with the applications of the Artificial Intelligence (AI) techniques. This proposed system presents a new approach of intrusion detection system based on artificial neural network. Multi Layer Percepron (MLP) architecture is used for Intrusion Detection System. The performance and evaluations are performed by using the set of benchmark data from a KDD (Knowledge discovery in Database) dataset. The proposed system detects the attacks and classifies them in six groups.

Organizations are facing an increasing number of criminal threats ranging from opportunistic malware to more advanced targeted attacks. While various security technologies are available to protect organizations’ perimeters, still many breaches lead to undesired consequences such as loss of proprietary information, financial burden, and reputation defacing. Recently, endpoint monitoring agents that inspect system-level activities on user machines started to gain traction and be deployed in the industry as an additional defense layer. Their application, though, in most cases is only for forensic investigation to determine the root cause of an incident. In this paper, we demonstrate how endpoint monitoring can be proactively used for detecting and prioritizing suspicious software modules overlooked by other defenses. Compared to other environments in which host-based detection proved successful, our setting of a large enterprise introduces unique challenges, including the heterogeneous environment (users installing software of their choice), limited ground truth (small number of malicious software available for training), and coarse-grained data collection (strict requirements are imposed on agents’ performance overhead). Through applications of clustering and outlier detection algorithms, we develop techniques to identify modules with known malicious behavior, as well as modules impersonating popular benign applications. We leverage a large number of static, behavioral and contextual features in our algorithms, and new feature weighting methods that are resilient against missing attributes. The large majority of our findings are confirmed as malicious by anti-virus tools and manual investigation by experienced security analysts.

With the thriving of the mobile app markets, third-party libraries are pervasively integrated in the Android applications. Third-party libraries provide functionality such as advertisements, location services, and social networking services, making multi-functional app development much more productive. However, the spread of vulnerable or harmful third-party libraries may also hurt the entire mobile ecosystem, leading to various security problems. The Android platform suffers severely from such problems due to the way its ecosystem is constructed and maintained. Therefore, third-party Android library identification has emerged as an important problem which is the basis of many security applications such as repackaging detection and malware analysis. According to our investigation, existing work on Android library detection still requires improvement in many aspects, including accuracy and obfuscation resilience. In response to these limitations, we propose a novel approach to identifying third-party Android libraries. Our method utilizes the internal code dependencies of an Android app to detect and classify library candidates. Different from most previous methods which classify detected library candidates based on similarity comparison, our method is based on feature hashing and can better handle code whose package and method names are obfuscated. Based on this approach, we have developed a prototypical tool called LibD and evaluated it with an update-to-date and large-scale dataset. Our experimental results on 1,427,395 apps show that compared to existing tools, LibD can better handle multi-package third-party libraries in the presence of name-based obfuscation, leading to significantly improved precision without the loss of scalability.

Correct identification of prescription pills based on their visual appearance is a key step required to assure patient safety and facilitate more effective patient care. With the availability of high-quality cameras and computational power on smartphones, it is possible and helpful to identify unknown prescription pills using smartphones. Towards this goal, in 2016, the U.S. National Library of Medicine (NLM) of the National Institutes of Health (NIH) announced a nationwide competition, calling for the creation of a mobile vision system that can recognize pills automatically from a mobile phone picture under unconstrained real-world settings. In this paper, we present the design and evaluation of such mobile pill image recognition system called MobileDeepPill. The development of MobileDeepPill involves three key innovations: a triplet loss function which attains invariances to real-world noisiness that deteriorates the quality of pill images taken by mobile phones; a multi-CNNs model that collectively captures the shape, color and imprints characteristics of the pills; and a Knowledge Distillation-based deep model compression framework that significantly reduces the size of the multi-CNNs model without deteriorating its recognition performance. Our deep learning-based pill image recognition algorithm wins the First Prize (champion) of the NIH NLM Pill Image Recognition Challenge. Given its promising performance, we believe MobileDeepPill helps NIH tackle a critical problem with significant societal impact and will benefit millions of healthcare personnel and the general public.


Question: A malware detection method for Android utilizing deep learning with weight adjustment.

This document presents DroidAPIMiner, a novel approach that mines API-level features to enhance the robustness of malware detection in Android applications. With the growing popularity of Android apps, they have become prime targets for malware creators, leading to a surge in Android malware. To combat this escalating threat and assist users in assessing app safety during installation, various detection strategies have been developed. Nevertheless, these methods often face challenges, such as high computational cost, lack of generalizability, or reduced robustness. Our goal is to address the issue of Android malware installation by offering classifiers that are both robust and lightweight. We have performed an extensive analysis to identify features closely tied to malware behavior at the API level and have assessed various classifiers using the resulting feature set. Our findings indicate that, by employing a KNN classifier, we can achieve an accuracy rate of up to 99% with a remarkably low false positive rate of just 2.2%. This demonstrates the effectiveness of DroidAPIMiner in distinguishing between benign and malicious Android apps with high precision.

For the efficient execution of deep convolutional neural networks (CNN) on edge devices, various approaches have been presented which reduce the bit width of the network parameters down to 1 bit. Binarization of the first layer was always excluded, as it leads to a significant error increase. Here, we present the novel concept of binary input layer (BIL), which allows the usage of binary input data by learning bit specific binary weights. The concept is evaluated on three datasets (PAMAP2, SVHN, CIFAR-10). Our results show that this approach is in particular beneficial for multimodal datasets (PAMAP2) where it outperforms networks using full precision weights in the first layer by 1.92 percentage points (pp) while consuming only 2% of the chip area.

Cryptovirological augmentations present an immediate, incomparable threat. Over the last decade, the substantial proliferation of crypto-ransomware has had widespread consequences for consumers and organisations alike. Established preventive measures perform well, however, the problem has not ceased. Reverse engineering potentially malicious software is a cumbersome task due to platform eccentricities and obfuscated transmutation mechanisms, hence requiring smarter, more efficient detection strategies. The following manuscript presents a novel approach for the classification of cryptographic primitives in compiled binary executables using deep learning. The model blueprint, a Dynamic Convolutional Neural Network (DCNN), is fittingly configured to learn from variable-length control flow diagnostics output from a dynamic trace. To rival the size and variability of equivalent datasets, and to adequately train our model without risking adverse exposure, a methodology for the procedural generation of synthetic cryptographic binaries is defined, using core primitives from OpenSSL with multivariate obfuscation, to draw a vastly scalable distribution. The library, CryptoKnight, rendered an algorithmic pool of AES, RC4, Blowfish, MD5 and RSA to synthesise combinable variants which automatically fed into its core model. Converging at 96% accuracy, CryptoKnight was successfully able to classify the sample pool with minimal loss and correctly identified the algorithm in a real-world crypto-ransomware application.

Android remains the dominant OS in the smartphone market even though the iOS share of the market increased during the iPhone 6 release period. As various types of Android smartphones are being launched in the market, forensic studies are being conducted to test data acquisition and analysis. However, since the application of new Android security technologies, it has become more difficult to acquire data using existing forensic methods. In order to address this problem, we propose a new acquisition method based on analyzing the firmware update protocols of Android smartphones. A physical acquisition of Android smartphones can be achieved using the flash memory read command by reverse engineering the firmware update protocol in the bootloader. Our experimental results demonstrate that the proposed method is superior to existing forensic methods in terms of the integrity guarantee, acquisition speed, and physical dump with screen-locked smartphones (USB debugging disabled). © 2015 The Authors. Published by Elsevier Ltd on behalf of DFRWS. This is an open access articleunder theCCBY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

To improve software reliability, software defect prediction is utilized to assist developers in finding potential bugs and allocating their testing efforts. Traditional defect prediction studies mainly focus on designing hand-crafted features, which are input into machine learning classifiers to identify defective code. However, these hand-crafted features often fail to capture the semantic and structural information of programs. Such information is important in modeling program functionality and can lead to more accurate defect prediction.In this paper, we propose a framework called Defect Prediction via Convolutional Neural Network (DP-CNN), which leverages deep learning for effective feature generation. Specifically, based on the programs' Abstract Syntax Trees (ASTs), we first extract token vectors, which are then encoded as numerical vectors via mapping and word embedding. We feed the numerical vectors into Convolutional Neural Network to automatically learn semantic and structural features of programs. After that, we combine the learned features with traditional hand-crafted features, for accurate software defect prediction. We evaluate our method on seven open source projects in terms of F-measure in defect prediction. The experimental results show that in average, DP-CNN improves the state-of-the-art method by 12%.

With the development of deep learning tools, the online handwritten Chinese character recognition (HCCR) performance has been greatly improved by using deep neural networks (DNNs) especially for long short-term memory (LSTM). However, DNNs suffer from large consumption of computation and storage resources, which may cause problems for service providers, such as server pressure, longer service latency and higher energy consumption. To solve these problems, we propose a framework that combines singular value decomposition (SVD) and adaptive drop weight (ADW) to accelerate and compress LSTM based models. We first build an LSTM based model that achieves an accuracy of 97.83% on the ICDAR2013 online HCCR competition dataset. After restructuring the model with SVD and ADW, it can reduce the FLOPs (floating point operations per second) of the forward process by approximately 10 times and compress the model with 1/30 of the original size with only a 0.5% decrease in accuracy. Finally, integrated with our efficient forward implementation, the recognition of an online character requires only 2.7 ms in average on a CPU with a single thread, while requiring only 0.45 MB for model storage.

Although millions of users download and use third-party Android applications from the Google Play store, little information is known on an aggregated level about these applications. We have built PlayDrone, the first scalable Google Play store crawler, and used it to index and analyze over 1,100,000 applications in the Google Play store on a daily basis, the largest such index of Android applications. PlayDrone leverages various hacking techniques to circumvent Google's roadblocks for indexing Google Play store content, and makes proprietary application sources available, including source code for over 880,000 free applications. We demonstrate the usefulness of PlayDrone in decompiling and analyzing application content by exploring four previously unaddressed issues: the characterization of Google Play application content at large scale and its evolution over time, library usage in applications and its impact on application portability, duplicative application content in Google Play, and the ineffectiveness of OAuth and related service authentication mechanisms resulting in malicious users being able to easily gain unauthorized access to user data and resources on Amazon Web Services and Facebook.

The advance of deep learning has made huge changes in computer vision and produced various off-the-shelf trained models. Particularly, Convolutional Neural Network (CNN) has been widely used to build image classification model which allow researchers transfer the pre-trained learning model for other classifications. We propose a transfer learning method to detect breast cancer using histopathology images based on Google's Inception v3 model which were initially trained for the classification of non-medical images. The pilot study shows the feasibility of transfer learning in the detection of breast cancer with AUC of 0.93.

Phishing e-mails are considered as spam e-mails, which aim to collect sensitive personal information about the users via network. Since the main purpose of this behavior is mostly to harm users financially, it is vital to detect these phishing or spam e-mails immediately to prevent unauthorized access to users' vital information. To detect phishing e-mails, using a quicker and robust classification method is important. Considering the billions of e-mails on the Internet, this classification process is supposed to be done in a limited time to analyze the results. In this work, we present some of the early results on the classification of spam email using deep learning and machine methods. We utilize word2vec to represent emails instead of using the popular keyword or other rule-based methods. Vector representations are then fed into a neural network to create a learning model. We have tested our method on an open dataset and found over 96% accuracy levels with the deep learning classification methods in comparison to the standard machine learning algorithms.

Cyber frauds are a major security threat to the banking industry worldwide. Malware is one of the manifestations of cyber frauds. Malware authors use Application Programming Interface (API) calls to perpetrate these crimes. In this paper, we propose a static analysis method to detect Malware based on API call sequences using text and data mining in tandem. We analyzed the dataset available at CSMINING group. First, we employed text mining to extract features from the dataset consisting a series of API calls. Further, mutual information is invoked for feature selection. Then, we resorted to over-sampling to balance the data set. Finally, we employed various data mining techniques such as Decision Tree (DT), Multi Layer Perceptron (MLP), Support Vector Machine (SVM), Probabilistic Neural Network (PNN) and Group Method for Data Handling (GMDH). We also applied One Class SVM (OCSVM). Throughout the paper, we used 10-fold cross validation technique for testing the techniques. We observed that SVM and OCSVM achieved 100% sensitivity after balancing the dataset.

We present a practical approach for processing mobile sensor time series data for continual deep learning predictions. The approach comprises data cleaning, normalization, capping, time-based compression, and finally classification with a recurrent neural network. We demonstrate the effectiveness of the approach in a case study with 279 participants. On the basis of sparse sensor events, the network continually predicts whether the participants would attend to a notification within 10 minutes. Compared to a random baseline, the classifier achieves a 40% performance increase (AUC of 0.702) on a withheld test set. This approach allows to forgo resource-intensive, domain-specific, error-prone feature engineering, which may drastically increase the applicability of machine learning to mobile phone sensor data.


Question: A weight-adjusted deep learning method for detecting malware on the Android platform.

This document outlines an innovative malware detection methodology for the Android platform, employing a Support Vector Machine (SVM) approach. Given the widespread adoption of Android, particularly due to its extensive app ecosystem, the prevalence of malicious applications (malware) from third-party markets has posed significant threats to user security and privacy. Unfortunately, traditional detection methods often fall short in accurately identifying these threats. Our proposed solution integrates two critical features: risky permission combinations and vulnerable API calls, which are incorporated into the SVM algorithm to enhance detection capabilities. Rigorous experimentation has been undertaken to substantiate the efficacy of our approach, demonstrating its proficiency in accurately and promptly identifying malicious Android applications. This SVM-based technique showcases promising outcomes in the ongoing battle against Android malware.

Detecting and reacting to user behavior and ambient context are core elements of many emerging mobile sensing and Internet-of-Things (IoT) applications. However, extracting accurate inferences from raw sensor data is challenging within the noisy and complex environments where these systems are deployed. Deep Learning -- is one of the most promising approaches for overcoming this challenge, and achieving more robust and reliable inference. Techniques developed within this rapidly evolving area of machine learning are now state-of-the-art for many inference tasks (such as, audio sensing and computer vision) commonly needed by IoT and wearable applications. But currently deep learning algorithms are seldom used in mobile/IoT class hardware because they often impose debilitating levels of system overhead (e.g., memory, computation and energy). Efforts to address this barrier to deep learning adoption are slowed by our lack of a systematic understanding of how these algorithms behave at inference time on resource constrained hardware. In this paper, we present the first -- albeit preliminary -- measurement study of common deep learning models (such as Convolutional Neural Networks and Deep Neural Networks) on representative mobile and embedded platforms. The aim of this investigation is to begin to build knowledge of the performance characteristics, resource requirements and the execution bottlenecks for deep learning models when being used to recognize categories of behavior and context. The results and insights of this study, lay an empirical foundation for the development of optimization methods and execution environments that enable deep learning to be more readily integrated into next-generation IoT, smartphones and wearable systems.

Modern malware represents an emerging threat not only to individual privacy, but also to organizational security. Over the last few decades, a number of malware families have been codified, differentiated by their behaviour and functionality. The majority of machine learning methods work well with the general benign-malicious classification yet fail to distinguish among many classes. Deep learning is known to be successful for such applications, Deep Neural Networks in particular. There is no way however to extract an understandable model in order to characterize each malware family separately. Thus, the goal of this paper is many-fold: we investigated multinomial malware categorization using static and dynamic behavioural features extracted from Windows Portable Executables (PE32) malware collection as of the end of 2015. Furthermore, we proposed a novel Deep Neuro-Fuzzy architecture, a Hybrid Intelligence approach capable of boosting the performance of conventional Neuro-Fuzzy method targeting rules extraction. It proved capable of achieving a 49.335% better result than classical Neuro-Fuzzy and 7.347% improvement over the same complexity Deep Neural Network (DNN). Moreover, we studied the Deep Neural Network behaviour when handling such non-trivial problems as multinomial malware categorization. We believe that this model contributes to Windows PE32 malware categorization by improving the similarity-based detection of zero-days malware. It can serve as a stepping stone for malware analysts to speed up the detection and dissemination.

Mobile devices are among the most disruptive technologies of the last years, gaining even more diffusion and success in the daily life of a wide range of people categories. Unfortunately, while the number of mobile devices implicated in crime activities is relevant and growing, the capability to perform the forensic analysis of such devices is limited both by technological and methodological problems. In this paper, we focus on Anti-Forensic techniques applied to mobile devices, presenting some fully automated instances of such techniques to Android devices. Furthermore, we tested the effectiveness of such techniques versus both the cursory examination of the device and some acquisition tools. a 2010 Digital Forensic Research Workshop. Published by Elsevier Ltd. All rights reserved.

Malware is a widespread problem and despite the common use of anti-virus software, the diversity of malware is still increasing. A major challenge facing the anti-virus industry is how to effectively detect thousands of malware samples that are received every day. In this paper, a novel approach based Run Length Encoding (RLE) algorithm and n-gram are proposed to improve malware detect on dynamic analysis of based on API sequences.

Recently more and more Android apps integrate the embedded browser, known as “WebView”, to render web pages and run JavaScript code without leaving these apps. WebView provides a powerful feature that allows event handlers defined in the native context (i.e., Java in Android) to handle web events that occur in WebView. However, as shown in prior work, this feature suffers from remote attacks, which we generalize as EventOriented Exploit (EOE) in this paper, such that adversaries may remotely access local critical functionalities through event handlers in WebView without any permission or authentication. In this paper, we propose a novel approach, EOEDroid, which can automatically vet event handlers in a given hybrid app using selective symbolic execution and static analysis. If a vulnerability is found, EOEDroid also automatically generates exploit code to help developers and analysts verify the vulnerability. To support exploit code generation, we also systematically study web events, event handlers and their trigger constraints. We evaluated our approach on 3,652 most popular apps. The result showed that our approach found 97 total vulnerabilities in 58 apps, including 2 cross-frame DOM manipulation, 53 phishing, 30 sensitive information leakage, 1 local resources access, and 11 Intent abuse vulnerabilities. We also found a potential backdoor in a high profile app that could be used to steal users’ sensitive information, such as IMEI. Even though developers attempted to close it, EOEDroid found that adversaries were still able to exploit it by triggering two events together and feeding event handlers with well designed input.

The mobile application (app) has become the main entrance to access the Internet on handheld devices. Unlike the Web where each webpage has a global URL to reach directly, a specific “content page” of an app can be opened only by exploring the app with several operations from the landing page. The interoperability between apps is quite fixed and thus limits the value-added “linked data” between apps. Recently, deep link has been proposed to enable targeting and opening a specific page of an app externally with an accessible uniform resource identifier (URI). However, implementing deep link for mobile apps requires a lot of manual efforts by app developers, which can be very error-prone and time-consuming. In this paper, we propose DroidLink to automatically generating deep links for existing Android apps. We design a deep link model suitable for automatic generation. Then we explore the transition of pages and build a navigation graph based on static and dynamic analysis of Android apps. Next, we realize an updating mechanism that keeps on revisiting the target app and discover new pages, and thus generates deep links for every single page of the app. Finally, we repackage the app with deep link supports, but requires no additional deployment requirements. We generate deep links for some popular apps and demonstrate the feasibility of DroidLink.

Phishing e-mails are considered as spam e-mails, which aim to collect sensitive personal information about the users via network. Since the main purpose of this behavior is mostly to harm users financially, it is vital to detect these phishing or spam e-mails immediately to prevent unauthorized access to users' vital information. To detect phishing e-mails, using a quicker and robust classification method is important. Considering the billions of e-mails on the Internet, this classification process is supposed to be done in a limited time to analyze the results. In this work, we present some of the early results on the classification of spam email using deep learning and machine methods. We utilize word2vec to represent emails instead of using the popular keyword or other rule-based methods. Vector representations are then fed into a neural network to create a learning model. We have tested our method on an open dataset and found over 96% accuracy levels with the deep learning classification methods in comparison to the standard machine learning algorithms.

Malicious code (or Malware) is defined as software that fulfills the deliberately harmful intent of an attacker. Malware analysis is the process of determining the behavior and purpose of a given Malware sample (such as a virus, worm, or Trojan horse). This process is a necessary step to be able to develop effective detection techniques and removal tools. Currently, Malware analysis is mostly a manual process that is tedious and time-intensive. To mitigate this problem, a number of analysis tools have been proposed that automatically extract the behavior of an unknown program by executing it in a restricted environment and recording the operating system calls that are invoked. The problem of dynamic analysis tools is that only a single program execution is observed. Unfortunately, however, it is possible that certain malicious actions are only triggered under specific circumstances (e.g., on a particular day, when a certain file is present, or when a certain command is received). In this paper, we propose a system that allows us to explore multiple execution paths and identify malicious actions that are executed only when certain conditions are met. This enables us to automatically extract a more complete view of the program under analysis and identify under which circumstances suspicious actions are carried out. Our experimental results demonstrate that many Malware samples show different behavior depending on input read from the environment. Thus, by exploring multiple execution paths, we can obtain a more complete picture of their actions.

The Normalized Compression Distance (NCD) has been used in a number of domains to compare objects with varying feature types. This flexibility comes from the use of general purpose compression algorithms as the means of computing distances between byte sequences. Such flexibility makes NCD particularly attractive for cases where the right features to use are not obvious, such as malware classification. However, NCD can be computationally demanding, thereby restricting the scale at which it can be applied. We introduce an alternative metric also inspired by compression, the Lempel-Ziv Jaccard Distance (LZJD). We show that this new distance has desirable theoretical properties, as well as comparable or superior performance for malware classification, while being easy to implement and orders of magnitude faster in practice.

Deep learning has shown impressive performance on hard perceptual problems. However, researchers found deep learning systems to be vulnerable to small, specially crafted perturbations that are imperceptible to humans. Such perturbations cause deep learning systems to mis-classify adversarial examples, with potentially disastrous consequences where safety or security is crucial. Prior defenses against adversarial examples either targeted specific attacks or were shown to be ineffective.
 We propose MagNet, a framework for defending neural network classifiers against adversarial examples. MagNet neither modifies the protected classifier nor requires knowledge of the process for generating adversarial examples. MagNet includes one or more separate detector networks and a reformer network. The detector networks learn to differentiate between normal and adversarial examples by approximating the manifold of normal examples. Since they assume no specific process for generating adversarial examples, they generalize well. The reformer network moves adversarial examples towards the manifold of normal examples, which is effective for correctly classifying adversarial examples with small perturbation. We discuss the intrinsic difficulties in defending against whitebox attack and propose a mechanism to defend against graybox attack. Inspired by the use of randomness in cryptography, we use diversity to strengthen MagNet. We show empirically that MagNet is effective against the most advanced state-of-the-art attacks in blackbox and graybox scenarios without sacrificing false positive rate on normal examples.


Question: The Theory of Planned Behavior and Parental Engagement: A Conceptual Model for Reducing Academic Disparities.

This paper contrasts the multi-attribute and subjective expected utility (SEU) models, commonly employed in consumer behavior studies, with the framework provided by the Theory of Planned Behavior (TPB). Unlike the traditional models that infer decision-making processes from revealed preferences, TPB directly evaluates its theoretical constructs. According to TPB, consumer actions are determined by the intention to engage in the behavior; this intention is rooted in attitude, subjective norm, and perceived behavioral control concerning the behavior. These components are, in turn, influenced by behavioral, normative, and control beliefs. The theory enables predictions of intentions and behaviors regarding the purchase or use of individual brands or products, as well as decisions involving the selection between various brands or products. This approach offers a nuanced understanding of consumer decision-making that goes beyond mere preference revelation, providing a comprehensive framework for analyzing food consumption choices.

The Theory of Planned Behavior (TPB) is contrasted here with the multi-attribute and subjective expected utility (SEU) models often used in consumer behavior research. Unlike the latter, which deduce decision processes from observed preferences, TPB directly measures its constructs. The theory posits that consumer behavior is a result of behavioral intention, which is influenced by attitude, subjective norm, and perceived behavioral control related to the behavior in question. These determinants are themselves shaped by behavioral, normative, and control beliefs. This theoretical framework facilitates the prediction of intentions and behaviors concerning the consumption or acquisition of single brands or products, as well as decisions made between different options. By moving beyond the simple interpretation of revealed preferences, TPB offers a detailed perspective on food consumption decisions, encompassing the complex interplay of beliefs and intentions that guide consumer choices.

Individuals with Down syndrome typically have low fitness levels and obesity despite data that indicate physiological gains from physical activity and exercise interventions. Low fitness levels and obesity in individuals with Down syndrome may be related to sedentary lifestyles, social and recreational opportunities, or low motivation to be physically active. These causal influences on the overall health of individuals with Down syndrome may be related to parental or caregiver support. Through this study, parents of children with Down syndrome from preschool to adolescent ages were interviewed about their perceptions of the health and physical activity needs of their children. Data from four focus groups indicated the following most salient themes: (1) all parents believed participation in physical activity has immediate and long-term positive health impacts on their child with Down syndrome, and most of the parents thought their child would benefit from being more physically active, (2) most parents observed that their child participated in physical activities primarily for social reasons, most notably to be with their peers with or without Down syndrome or to be with their sibling(s), and that without such motivation their child would choose sedentary activities, (3) parents of teenagers identified a need for their child to learn an individual sport to have sporting opportunities that do not require ability-matched teammates and opponents, and (4) parents recognised their need for help from physical activity specialists through either parent education regarding home-based physical activity programmes or an increase in appropriate community-based physical activity programmes for their child with Down syndrome. The interview data suggest future research should evaluate the outcomes of long-term individualised home-based physical activity interventions for children with Down syndrome. Additionally, educators, recreation specialists, and therapists should assist children and youth with their acquisition of skills used in individual and dual sports.

Recent studies have begun to uncover the genetic architecture of educational attainment. We build on this work using genome-wide data from siblings in the National Longitudinal Study of Adolescent to Adult Health (Add Health). We measure the genetic predisposition of siblings to educational attainment using polygenic scores. We then test how polygenic scores are related to social environments and educational outcomes. In Add Health, genetic predisposition to educational attainment is patterned across the social environment. Participants with higher polygenic scores were more likely to grow up in socially advantaged families. Even so, the previously published genetic associations appear to be causal. Among pairs of siblings, the sibling with the higher polygenic score typically went on to complete more years of schooling as compared to their lower-scored co-sibling. We found subtle differences between sibling fixed effect estimates of the genetic effect versus those based on unrelated individuals.

Employees increasingly are expressing ideas and feelings through enterprise social media. Recent work in CHI and CSCW has applied linguistic analysis towards understanding employee experiences. In this paper, we apply dictionary based linguistic analysis to measure 'Employee Engagement'. Employee engagement is a measure of employee willingness to apply discretionary effort towards organizational goals, and plays an important role in organizational outcomes such as financial or operational results. Organizations typically use surveys to measure engagement. This paper describes an approach to model employee engagement based on word choice in social media. This method can potentially complement surveys, thus providing more real-time insights into engagement and allowing organizations to address engagement issues faster. Our results predicting engagement scores on a survey by combining demographics with social media text demonstrate that social media text has significant predictive power compared to demographic data alone. We also find that engagement may be a state than a stable trait since social media posts closer to the administration of the survey had the most predictive power. We further identify the minimum number of social media posts required per employee for the best prediction.

Cooperative learning has increasingly become a popular form of active pedagogy employed in academic institutions. This case study explores the relationship between cooperative learning and academic performance in higher education, specifically in the field of communication. Findings from a questionnaire administered to undergraduate students in a communication research course indicate that involvement in cooperative learning is a strong predictor of a student’s academic performance. A significant positive relationship was found between the degree to which grades are important to a student and his or her active participation in cooperative learning. Further, the importance of grades and sense of achievement are strong predictors of performance on readiness assessment tests.

Identifying the function of problem behavior can lead to the development of more effective interventions. One way to identify the function is through functional behavior assessment (FBA). Teachers conduct FBA in schools. However, the task load of recording the data manually is high, and the challenge of accurately identifying antecedents and consequences is significant while interacting with students. These issues often result in imperfect information capture. CareLog allows teachers more easily to conduct FBAs and enhances the capture of relevant information. In this paper, we describe the design process that led to five design principles that governed the development of CareLog. We present results from a five-month, quasi-controlled study aimed at validating those design principles. We reflect on how various constraints imposed by special education settings impact the design and evaluation process for HCI practitioners and researchers.

0747-5632/$ see front matter 2012 Elsevier Ltd. A http://dx.doi.org/10.1016/j.chb.2012.08.001 ⇑ Corresponding author. Tel.: +886 02 7734 3347; f E-mail address: joum@ntnu.edu.tw (M. Jou). Cloud computing technology has matured as it has been integrated with every kind of digitalization processes. It offers numerous advantages for data and software sharing, and thus making the management of complex IT systems much simpler. For education in engineering, cloud computing even provides students with versatile and ubiquitous access to software commonly used in the field without having to step into an actual computer lab. Our study analyzed learning attitudes and academic performances induced by the utilization of resources driven by cloud computing technologies. Comparisons were made between college students with high school and vocational high school backgrounds. One hundred and thirtytwo students who took the computer-aided designing (CAD) course participated in the study. Technology Acceptance Model (TAM) was used as the fundamental framework. Open-ended sets of questionnaires were designed to measure academic performance and causal attributions; the results indicated no significant differences in the cognitive domain between the two groups of students, though it is not so in both the psychomotor and the affective domains. College students with vocational high school background appeared to possess higher learning motivation in CAD applications. 2012 Elsevier Ltd. All rights reserved.

I have recently completed my third year of study in the Educational Psychology and Educational Technology doctoral program at Michigan State University. I have successfully completed all of my coursework and comprehensive/qualifying exams. I will be proposing my dissertation study in the Fall semester of 2016 and expect to defend my dissertation in the Fall semester of 2017. My prior research has been focused on issues related to computational thinking, creativity, and computer science education. I am currently developing my literature review and honing my core research questions. I hope to subsequently develop my research methods and measures more fully, with plans to begin fieldwork in Fall of 2016.

Using an iterative design along with multiple methodological approaches and a large representative sample, this study presents reliability, validity, and fairness evidence for two surveys measuring student attitudes toward science, technology, engineering, and math (S-STEM) and interest in STEM careers for (a) 4ththrough 5th-grade students (Upper Elementary S-STEM) and (b) 6ththrough 12th-grade students (Middle/High S-STEM). Findings from exploratory factor analysis (EFA) and confirmatory factor analysis (CFA) suggested the use of a four-factor structure to measure student attitudes toward science, math, engineering/technology, and 21st century skills. Subject matter experts and literature reviews provided evidence of content validity. Reliability levels were high for both versions. Furthermore, both the Upper Elementary S-STEM and Middle/High S-STEM Surveys demonstrated evidence of configural, metric, and scalar invariance across grade levels, races/ethnicities, and genders. The findings support the validity of interpretations and inferences made from scores on the instruments’ items and subscales.

Computer-based instruction (CBI) is becoming increasingly popular in the classroom, particularly because the latest technological advancements allow for visually rich and interactive environments. While the inherent nature of CBIs is often thought to engage learners, research examining the role of motivation in learning with these environments has resulted in mixed findings. These findings are further complicated by unique design characteristics of distinct CBIs. This literature review synthesizes research that has examined the role of theoretically-grounded constructs of motivation in the context of three popular CBIs, multimedia, hypermedia, and hypertext. Specifically, this literature review considered empirical studies that examined the effect of these CBIs on motivation, in addition to the effect of motivation on learning outcomes and the learning process within the context of these environments. The literature review concludes with a theoretical consideration of previous research and a discussion of a framework for future directions. 2010 Published by Elsevier Ltd.


Question: The Theory of Planned Behavior and parental engagement: a conceptual model for reducing academic achievement disparities.

This study explores the role of children's academic and social competencies as mediators in the positive association between parent-school involvement and academic achievement, specifically focusing on ethnic variations within socioeconomically similar African American and Euro-American families. The investigation aims to clarify the pathways through which parent-school involvement impacts early academic success, considering the complex interplay between involvement, competencies, and achievement. In examining reading achievement, it was found that academic skills acted as a mediator for both African American and Euro-American families, bridging the gap between parent-school involvement and academic outcomes. However, the mechanisms underlying math achievement revealed distinct ethnic differences. For African American families, academic skills served as the primary mediator between school involvement and math performance, whereas for Euro-American families, social competence was found to be the crucial link between home involvement and school achievement. This nuanced analysis highlights the importance of understanding the specific competencies that mediate the effects of parent-school involvement on academic achievement within different ethnic contexts, particularly when socioeconomic status is accounted for.

Four studies demonstrate the psychometric adequacy and validity of scales designed to assess coping through emotional approach. In separate undergraduate samples, exploratory and confirmatory factor analyses of dispositional (Study 1) and situational (Study 3) coping item sets yielded 2 distinct emotional approach coping factors: emotional processing (i.e., active attempts to acknowledge and understand emotions) and emotional expression. The 2 scales yielded high internal consistency and test-retest reliability, as well as convergent and discriminant validity. A study (Study 2) of young adults and their parents established the scales' interjudge reliabilities. Longitudinal (Study 3) and experimental (Study 4) research supported the predictive validity of the emotional approach coping scales with regard to adjustment to stressful encounters. Findings highlight the utility of functionalist theories of emotion as applied to coping theory.

This nonexperimental study explored the predictive strength of English proficiency levels on academic achievement of middle school students in a sample of 17,470 native English-speaking (NES) students, 558 English language learners (current ELLs), and 500 redesignated fluent English proficient students (former ELLs). Results of multilevel analyses indicated that after controlling for relevant studentand school-level characteristics, former ELLs significantly outperformed current ELL and NES students in reading (effect sizes: 1.07 and 0.52) and mathematics (effect sizes: 0.86 and 0.42). The results support Cummins’s (1979, 2000) lower level threshold hypothesis predicting that upon reaching adequate proficiency in the language of schooling and testing, ELLs would no longer experience academic disadvantages. Refinements for the theory and directions for future research are discussed.

BACKGROUND
Health literacy concerns the knowledge and competences of persons to meet the complex demands of health in modern society. Although its importance is increasingly recognised, there is no consensus about the definition of health literacy or about its conceptual dimensions, which limits the possibilities for measurement and comparison. The aim of the study is to review definitions and models on health literacy to develop an integrated definition and conceptual model capturing the most comprehensive evidence-based dimensions of health literacy.

METHODS
A systematic literature review was performed to identify definitions and conceptual frameworks of health literacy. A content analysis of the definitions and conceptual frameworks was carried out to identify the central dimensions of health literacy and develop an integrated model.

RESULTS
The review resulted in 17 definitions of health literacy and 12 conceptual models. Based on the content analysis, an integrative conceptual model was developed containing 12 dimensions referring to the knowledge, motivation and competencies of accessing, understanding, appraising and applying health-related information within the healthcare, disease prevention and health promotion setting, respectively.

CONCLUSIONS
Based upon this review, a model is proposed integrating medical and public health views of health literacy. The model can serve as a basis for developing health literacy enhancing interventions and provide a conceptual basis for the development and validation of measurement tools, capturing the different dimensions of health literacy within the healthcare, disease prevention and health promotion settings.

We studied how specific motivational processes are related to the salience of mastery and performance goals in actual classroom settings. One hundred seventy-six students attending a junior high/high school for academically advanced students were randomly selected from one of their classes and responded to a questionnaire on their perceptions of the classroom goal orientation, use of effective learning strategies, task choices, attitudes, and causal attributions. Students who perceived an emphasis on mastery goals in the classroom reported using more effective strategies, preferred challenging tasks, had a more positive attitude toward the class, and had a stronger belief that success follows from one's effort. Students who perceived performance goals as salient tended to focus on their ability, evaluating their ability negatively and attributing failure to lack of ability. The pattern and strength of the findings suggest that the classroom goal orientation may facilitate the maintenance of adaptive motivation patterns when mastery goals are salient and are adopted by students.

This study extends the technology acceptance model to identify factors that influence technology acceptance among pre-service teachers in Ghana. Data from 380 usable questionnaires were tested against the research model. Utilising the extended technology acceptance model (TAM) as a research framework, the study found that: pre-service teachers’ pedagogical beliefs, perceived ease of use, perceived usefulness of computer technology and attitude towards computer use to be significant determinants of actual use of computer technology. Results obtained employing multiple stepwise regression analysis revealed that: (1) pre-service teachers’ pedagogical beliefs significantly influenced both perceived ease of use and perceived usefulness, (2) both perceived ease of use and perceived usefulness influence attitude towards computer use and attitude towards computer use significantly influences pre-service teachers’ actual use of computers. However, statistically, perceived ease of use did not significantly influence perceived usefulness. The findings contribute to the literature by validating the TAM in the Ghanaian context and provide several prominent implications for the research and practice of technology integration development.

What was noted by E. J. hanger (1978) remains true today: that much of contemporary psychological research is based on the assumption that people are consciously and systematically processing incoming information in order to construe and interpret their world and to plan and engage in courses of action. As did E. J. hanger, the authors question this assumption. First, they review evidence that the ability to exercise such conscious, intentional control is actually quite limited, so that most of moment-to-moment psychological life must occur through nonconscious means if it is to occur at all. The authors then describe the different possible mechanisms that produce automatic, environmental control over these various phenomena and review evidence establishing both the existence of these mechanisms as well as their consequences for judgments, emotions, and behavior. Three major forms of automatic self-regulation are identified: an automatic effect of perception on action, automatic goal pursuit, and a continual automatic evaluation of one's experience. From the accumulating evidence, the authors conclude that these various nonconscious mental systems perform the lion's share of the self-regulatory burden, beneficently keeping the individual grounded in his or her current environment.

Employees increasingly are expressing ideas and feelings through enterprise social media. Recent work in CHI and CSCW has applied linguistic analysis towards understanding employee experiences. In this paper, we apply dictionary based linguistic analysis to measure 'Employee Engagement'. Employee engagement is a measure of employee willingness to apply discretionary effort towards organizational goals, and plays an important role in organizational outcomes such as financial or operational results. Organizations typically use surveys to measure engagement. This paper describes an approach to model employee engagement based on word choice in social media. This method can potentially complement surveys, thus providing more real-time insights into engagement and allowing organizations to address engagement issues faster. Our results predicting engagement scores on a survey by combining demographics with social media text demonstrate that social media text has significant predictive power compared to demographic data alone. We also find that engagement may be a state than a stable trait since social media posts closer to the administration of the survey had the most predictive power. We further identify the minimum number of social media posts required per employee for the best prediction.

Temporal construal theory states that distant future situations are construed on a higher level (i.e., using more abstract and central features) than near future situations. Accordingly, the theory suggests that the value associated with the high-level construal is enhanced over delay and that the value associated with the low-level construal is discounted over delay. In goal-directed activities, desirability of the activity's end state represents a high-level construal, whereas the feasibility of attaining this end state represents a low-level construal. Study 1 found that distant future activities were construed on a higher level than near future activities. Studies 2 and 3 showed that decisions regarding distant future activities, compared with decisions regarding near future activities, were more influenced by the desirability of the end state and less influenced by the feasibility of attaining the end state. Study 4 presented students with a real-life choice of academic assignments varying in difficulty (feasibility) and interest (desirability). In choosing a distant future assignment, students placed relatively more weight on the assignment's interest, whereas in choosing a near future assignment, they placed relatively more weight on difficulty. Study 5 found that distant future plans, compared with near future plans, were related to desirability of activities rather than to time constraints.

Information on personality, on anxiety and depression and on several aspects of religion was collected in 1974 Dutch families consisting of adolescent and young adult twins and their parents. Analyses of these data showed that differences between individuals in religious upbringing, in religious affiliation and in participation in church activities are not influenced by genetic factors. The familial resemblance for different aspects of religion is high, but can be explained entirely by environmental influences common to family members. Shared genes do not contribute to familial resemblances in religion. The absence of genetic influences on variation in several dimensions of religion is in contrast to findings of genetic influences on a large number of other traits that were studied in these twin families. Differences in religious background are associated with differences in personality, especially in Sensation Seeking. Subjects with a religious upbringing, who are currently religious and who engage in church activities score lower on the scales of the Sensation Seeking Questionnaire. The most pronounced effect is on the Disinhibition scale. The resemblances between twins for the Disinhibition scale differ according to their religious upbringing. Receiving a religious upbringing seems to reduce the influence of genetic factors on Disinhibition, especially in males.

Social learning theory began as an attempt by Robert Sears and others to meld psychoanalytic and stimulus-response learning theory into a comprehensive explanation of human behavior, drawing on the clinical richness of the former and the rigor of the latter. Albert Bandura abandoned the psychoanalytic and drive features of the approach, emphasizing instead cognitive and informationprocessing capacities that mediate social behavior. Both theories were intended as a general framework for the understanding of human behavior, and their developmental aspects remain to be worked out in detail. Nevertheless, Bandura has provided a strong theoretical beginning: The theory appears to be capable of accounting well for existing developmental data as well as guiding new investigation.


Question: The Theory of Planned Behavior and Parental Engagement: A Conceptual Model for Reducing Academic Disparities.

This paper explores how the structure of decision problems and the psychological mechanisms underlying the assessment of probabilities and outcomes can lead to consistent changes in preference when the same issue is presented in alternative ways. Illustrations of preference reversals are provided in contexts involving monetary outcomes, both in hypothetical and actual scenarios, as well as in scenarios concerning the loss of human lives. The influence of framing on preference formation is analogized to the impact of perspective on perceptual interpretation. The reliance of preferences on the specific framing of decision dilemmas poses a critical challenge to the classical theory of rational choice, highlighting the need for a more nuanced understanding of decision-making processes.

**Question**: An Empirical Analysis of the Effects of Financial Development on Economic Growth in China

**Documents**: The impact of financial development on economic growth: A meta-analysis
This paper presents a meta-analysis of the relationship between financial development and economic growth. We consider studies that have estimated the relationship between measures of financial development and economic growth. Our results suggest that there is a positive and significant relationship between financial development and economic growth. However, the magnitude of the effect varies across studies. We also find that the relationship between financial development and economic growth is stronger in developing countries than in developed countries. Our results have important implications for policy makers, as they suggest that financial development can be an important driver of economic growth.

**Similar Documents**: This study conducts a comprehensive meta-analysis to explore the correlation between financial development and economic growth. By reviewing a range of empirical research that quantifies the linkage between financial development indicators and economic growth rates, we ascertain that a positive and statistically significant association exists. Nevertheless, the strength of this relationship exhibits variability across different studies. A notable finding is that the positive impact of financial development on economic growth is more pronounced in developing nations compared to developed economies. These findings carry significant policy implications, indicating that financial development serves as a potent catalyst for economic expansion, particularly in less developed economies.

OBJECTIVES
The Internet and social media provide various possibilities for online peer support. The aim of this review was to explore Internet-based peer-support interventions and their outcomes for parents.

DESIGN
A systematic integrative review.

DATA SOURCES
The systematic search was carried out in March 2014 in PubMed, Cinahl, PsycINFO and Cochrane databases.

REVIEW METHODS
Two reviewers independently screened the titles (n=1793), abstracts and full texts to decide which articles should be chosen. The inclusion criteria were: (1) an Internet-based community as an intervention, or at least as a component of an intervention; (2) the participants in the Internet-based community had to be mothers and/or fathers or pregnant women; (3) the parents had to interact and communicate with each other through the Internet-based community. The data was analysed using content analysis. When analysing peer-support interventions only interventions developed by researchers were included and when analysing the outcomes for the parents, studies that focused on mothers, fathers or both parents were separated.

RESULTS
In total, 38 publications met the inclusion criteria. Most of the studies focused on Internet-based peer support between mothers (n=16) or both parents (n=15) and seven focused on fathers. In 16 studies, the Internet-based interventions had been developed by researchers and 22 studies used already existing Internet peer-support groups, in which any person using the Internet could participate. For mothers, Internet-based peer support provided emotional support, information and membership in a social community. For fathers, it provided support for the transition to fatherhood, information and humorous communication. Mothers were more active users of Internet-based peer-support groups than fathers. In general, parents were satisfied with Internet-based peer support. The evidence of the effectiveness of Internet-based peer support was inconclusive but no harmful effects were reported in these reviewed studies.

CONCLUSIONS
Internet-based peer support provided informational support for parents and was accessible despite geographical distance or time constraints. Internet-based peer support is a unique form of parental support, not replacing but supplementing support offered by professionals. Experimental studies in this area are needed.

Most textbooks in HCI and CSCW do not offer a coherent and over–arching understanding of social and technological issues. They present a variety of techniques and technologies, and outline a little history, but offer little in terms of theory that addresses the complexity of collaborative systems’ structure and use. The majority of practitioners and researchers do not see theory as one of the things that they do. Immersed in their craft, focusing on technological innovation or ethnomethodological detail, they do not engage in theoretical abstraction. Technologists contentedly explore new tools and devices, with little heed to older disciplines or deeper discussion about the limits and assumptions inherent in their craft. The area of sociology most influential in CSCW, ethnomethodology, deliberately keeps theorising and generalisation at a distance, seeing abstraction as brutish and creativity as foreign. In our field, theory is like the public library. If asked, most of us would say that we are glad that it is around—but few of us actually go there. Most see it as a haven for the old, the unemployed and the eccentric. Paul Dourish is a card–carrying member, however. He reads avidly and widely, but is also a skilful system designer and developer. The result is a book that is deep, accessible and useful, which is a rare thing nowadays. In the introduction, Dourish lays out the structure of the book. He describes and reflects on two current trends in system design: tangible and social computing. By looking at the usually hidden assumptions in system design, he makes his later theoretical discussion more relevant and accessible to a computer science audience. He does not develop new philosophy or social theory, but draws upon established 20th century philosophy of language and phenomenology. Much of this material is likely to be unfamiliar to ‘the average programmer’ and, although Dourish presents it well, it may still be challenging to the reader. However, its use is one of the book’s main contributions. He uses it to ground a conceptual framework and a corresponding set of principles for system design practice. He aims to do justice to the sociality and heterogeneity of interactive media, and to avoid putting theory above practice—or vice versa. His ideal is balance: “the ability to develop systemsthat resonate with, rather than restrict (or, worse, refute), the social organization of action”. The term ‘tangible computing’ is used very broadly in this book. The chapter on this theme covers the designs of Hiroshi Ishii’s group at MIT’s Media Lab, but also ubiquitous computing work such as the badges, tabs and LiveBoards of Xerox PARC, and augmented reality systems such as Pierre Wellner’s DigitalDesk. Although ‘UbiComp’ is more fashionable nowadays, Dourish chooses a term that helps him focus more on our perception and “the ways we experience the everyday world” than on computation and technology. Much of this discussion centres on exemplary systems, and the way that an increasing number and variety of computational devices and sensors are distributed in our environment. This contrasts with older systems that used very few media and which were encapsulated in the beige box of the traditional PC. The following chapter is on social computing: “the application of sociological understanding to the design of interactive systems”. This stands in contrast to the more traditional tendency for designers to treat people as isolated system users, with little account taken of organisational and social context. Dourish draws upon some influential studies of existing technology such as that of an air traffic control room by Hughes et al., and the ethnography of a print shop by Bowers, Button and Sharrock. Compared to the previous chapter, exemplary systems are scarce. There are none of the previous chapter’s attractive images of exotic displays and devices, so beloved in undergraduate lectures and conference presentations, as this chapter addresses systems’ internal structure rather than external interaction. Dourish has developed more systems in the ‘social’ category than the ‘tangible’, and here he offers as examples Mansfield et al.’s Orbit and some of his own work: using a system design technique, computational reflection, to offer users an account of deep system structure. In describing this particular technique, Dourish touches on the essence of the entire book: What is radical is the relationship it proposes between technical design and social understandings. It argues that the most fruitful place to forge these relationships is at a foundational level, one that attempts to take sociological insights into the heart of the process and fabric of design. (p. 87)

This study examines the utility of three prospective models for understanding the continued IT usage behavior. The three models include: Expectation-Confirmation Model in IT Domain (ECM-IT), Technology Acceptance Model (TAM), and a hybrid model integrating TAM and ECM-IT (extended ECM-IT). Based on a survey of 1826 mobile Internet users, the LISREL analysis shows that all three models meet the various goodness-of-fit criteria. When compared using special indices for differentiating among alternative good models, TAM has the best fit to the data followed by ECM-IT, and the extended ECM-IT. In terms of variance explained for intention to continue IT usage, the extended ECM-IT has the highest R (67%) followed by TAM (63%), and ECM-IT (50%). We conclude that TAM is the most parsimonious and generic model that can be used to study both initial and continued IT adoption; the extended ECM-IT explains continued IT usage behavior as well as TAM; and both the ECM-IT and extended ECM-IT models provide additional information to increase our understanding of continued IT usage. © 2006 Elsevier B.V. All rights reserved.

A single subject, withdrawal design was used to investigate the effects of therapy balls as seating on engagement and in-seat behavior of young children with Autism Spectrum Disorder (ASD). In addition, social validity was assessed to evaluate teachers' opinions regarding the intervention. During baseline and withdrawal (A phases) participants used their typical classroom seating device (chair, bench or carpet square). During the intervention (B phases) participants sat on therapy balls. Results indicated substantial improvements in engagement and in-seat behavior when participants were seated on therapy balls. Social validity findings indicated that the teachers' preferred the therapy balls. This study suggests therapy balls as classroom seating may facilitate engagement and in-seat behavior and create opportunities to provide effective instruction.

BACKGROUND
Self-regulated learning (SRL) models position metacognitive monitoring as central to SRL processing and predictive of student learning outcomes (Winne & Hadwin, 2008; Zimmerman, 2000). A body of research evidence also indicates that depth of strategy use, ranging from surface to deep processing, is predictive of learning performance.

AIMS
In this study, we investigated the relationships among the frequency of metacognitive monitoring and the utilization of deep and surface-level strategies, and the connections between these SRL processes and learning outcomes across two academic domains, science and history.

SAMPLE
This was a secondary data analysis of two studies. The first study sample was 170 undergraduate students from a University in the south-eastern United States. The second study sample consisted of 40 US high school students in the same area.

METHODS
We collected think-aloud protocol SRL and knowledge measure data and conducted both structural equation modelling and path analysis to investigate our research questions.

RESULTS
Findings showed across both studies and two distinct academic domains, students who enacted more frequent monitoring also enacted more frequent deep strategies resulting in better performance on academic evaluations.

CONCLUSIONS
These findings suggest the importance of measuring not only what depth of strategies learners use, but also the degree to which they monitor their learning. Attention to both is needed in research and practice.

Student engagement is a key concept in contemporary education, where it is valued as a goal in its own right. In this paper we explore approaches for automatic recognition of engagement from students' facial expressions. We studied whether human observers can reliably judge engagement from the face; analyzed the signals observers use to make these judgments; and automated the process using machine learning. We found that human observers reliably agree when discriminating low versus high degrees of engagement (Cohen's κ = 0.96). When fine discrimination is required (four distinct levels) the reliability decreases, but is still quite high ( κ = 0.56). Furthermore, we found that engagement labels of 10-second video clips can be reliably predicted from the average labels of their constituent frames (Pearson r=0.85), suggesting that static expressions contain the bulk of the information used by observers. We used machine learning to develop automatic engagement detectors and found that for binary classification (e.g., high engagement versus low engagement), automated engagement detectors perform with comparable accuracy to humans. Finally, we show that both human and automatic engagement judgments correlate with task performance. In our experiment, student post-test performance was predicted with comparable accuracy from engagement labels ( r=0.47) as from pre-test scores ( r=0.44).

Cooperative learning has increasingly become a popular form of active pedagogy employed in academic institutions. This case study explores the relationship between cooperative learning and academic performance in higher education, specifically in the field of communication. Findings from a questionnaire administered to undergraduate students in a communication research course indicate that involvement in cooperative learning is a strong predictor of a student’s academic performance. A significant positive relationship was found between the degree to which grades are important to a student and his or her active participation in cooperative learning. Further, the importance of grades and sense of achievement are strong predictors of performance on readiness assessment tests.

Individuals with Down syndrome typically have low fitness levels and obesity despite data that indicate physiological gains from physical activity and exercise interventions. Low fitness levels and obesity in individuals with Down syndrome may be related to sedentary lifestyles, social and recreational opportunities, or low motivation to be physically active. These causal influences on the overall health of individuals with Down syndrome may be related to parental or caregiver support. Through this study, parents of children with Down syndrome from preschool to adolescent ages were interviewed about their perceptions of the health and physical activity needs of their children. Data from four focus groups indicated the following most salient themes: (1) all parents believed participation in physical activity has immediate and long-term positive health impacts on their child with Down syndrome, and most of the parents thought their child would benefit from being more physically active, (2) most parents observed that their child participated in physical activities primarily for social reasons, most notably to be with their peers with or without Down syndrome or to be with their sibling(s), and that without such motivation their child would choose sedentary activities, (3) parents of teenagers identified a need for their child to learn an individual sport to have sporting opportunities that do not require ability-matched teammates and opponents, and (4) parents recognised their need for help from physical activity specialists through either parent education regarding home-based physical activity programmes or an increase in appropriate community-based physical activity programmes for their child with Down syndrome. The interview data suggest future research should evaluate the outcomes of long-term individualised home-based physical activity interventions for children with Down syndrome. Additionally, educators, recreation specialists, and therapists should assist children and youth with their acquisition of skills used in individual and dual sports.

The 4-H Study of Positive Youth Development (PYD), a longitudinal investigation of a diverse sample of 1,700 fifth graders and 1,117 of their parents, tests developmental contextual ideas linking PYD, youth contributions, and participation in community youth development (YD) programs, representing a key ecological asset. Using data from Wave 1 of the study, structural equation modeling procedures provided evidence for five first-order latent factors representing the “Five Cs” of PYD (competence, confidence, connection, character, and caring), and for their convergence on a second-order, PYD latent construct. A theoretical construct, youth “contribution,” was also created and examined. Both PYD and YD program participation independently related to contribution. The importance of longitudinal analyses for extending the present results is discussed.