Question: AntNet: A stigmergetic distributed control mechanism for communication networks.

This document delves into the exploration of optimization techniques, learning algorithms, and natural algorithms, particularly focusing on how these methodologies can be applied to enhance the efficiency and adaptability of communication networks. Inspired by the foraging behavior of ants and their ability to construct efficient paths through stigmergic communication, AntNet is introduced as a distributed control system for communications networks. AntNet employs a stigmergetic mechanism, mimicking the way ants leave pheromone trails to guide other ants, to dynamically optimize network routing. This approach not only allows for the self-organization of network paths but also ensures robustness and adaptability in the face of changing network conditions. By integrating elements of optimization theory, machine learning, and natural algorithms, AntNet represents a novel and effective strategy for managing complex communication networks, demonstrating its potential in improving network performance and resource utilization.

This exposition highlights the convergence of optimization techniques, learning algorithms, and natural algorithms, particularly in the context of their application to the enhancement of communication networks. Drawing inspiration from the natural world, specifically the foraging behavior of ants, AntNet is proposed as an innovative distributed control mechanism for such networks. AntNet leverages a stigmergetic strategy, akin to the pheromone trail-laying behavior of ants, to dynamically adjust network routing. This method facilitates the self-organization of network paths, ensuring resilience and adaptability to dynamic network conditions. By synthesizing optimization principles, machine learning techniques, and natural algorithms, AntNet emerges as a cutting-edge solution for the management of intricate communication networks. It showcases its efficacy in optimizing network performance and resource allocation, positioning itself as a promising approach in the realm of network control and optimization.

Due to their rapid evolution, mobile devices demand for more dynamic and flexible networking services. A major challenges of future mobile networks is the increased mobile traffic. With the recent upcoming technologies of network programmability like Software-Defined Network (SDN), it may be integrated to create a new communication platform for Internet of Things (IoT). In this work, we present how to determine the effectiveness of an approach to build a new secured network architecture based on SDN and clusters. Our proposed scheme is a starting point for some experiments providing perspective over SDN deployment in a cluster environment. With this aim in mind, we suggest a routing protocol that manages routing tasks over Cluster-SDN. By using network virtualization and OpenFlow technologies to generate virtual nodes, we simulate a prototype system controlled by SDN. With our testbed, we are able to manage 500 things. We can analyze every OpenFlow messages and we have discovered that with a particular flow, the things can exchange information unlike the routing principle.

Complex networks describe a wide range of systems in nature and society. Frequently cited examples include the cell, a network of chemicals linked by chemical reactions, and the Internet, a network of routers and computers connected by physical links. While traditionally these systems have been modeled as random graphs, it is increasingly recognized that the topology and evolution of real networks are governed by robust organizing principles. This article reviews the recent advances in the field of complex networks, focusing on the statistical mechanics of network topology and dynamics. After reviewing the empirical data that motivated the recent interest in networks, the authors discuss the main models and analytical tools, covering random graphs, small-world and scale-free networks, the emerging theory of evolving networks, and the interplay between topology and the network’s robustness against failures and attacks.

The Internet has led to the creation of a digital society, where (almost) everything is connected and is accessible from anywhere. However, despite their widespread adoption, traditional IP networks are complex and very hard to manage. It is both difficult to configure the network according to predefined policies, and to reconfigure it to respond to faults, load, and changes. To make matters even more difficult, current networks are also vertically integrated: the control and data planes are bundled together. Software-defined networking (SDN) is an emerging paradigm that promises to change this state of affairs, by breaking vertical integration, separating the network’s control logic from the underlying routers and switches, promoting (logical) centralization of network control, and introducing the ability to program the network. The separation of concerns, introduced between the definition of network policies, their implementation in switching hardware, and the forwarding of traffic, is key to the desired flexibility: by breaking the network control problem into tractable pieces, SDN makes it easier to create and introduce new abstractions in networking, simplifying network management and facilitating network evolution. In this paper, we present a comprehensive survey on SDN. We start by introducing the motivation for SDN, explain its main concepts and how it differs from traditional networking, its roots, and the standardization activities regarding this novel paradigm. Next, we present the key building blocks of an SDN infrastructure using a bottom-up, layered approach. We provide an in-depth analysis of the hardware infrastructure, southbound and northbound application programming interfaces (APIs), network virtualization layers, network operating systems (SDN controllers), network programming languages, and network applications. We also look at cross-layer problems such as debugging and troubleshooting. In an effort to anticipate the future evolution of this new paradigm, we discuss the main ongoing research efforts and challenges of SDN. In particular, we address the design of switches and control platforms with a focus on aspects such as resiliency, scalability, performance, security, and dependabilityVas well as new opportunities for carrier transport networks and cloud providers. Last but not least, we analyze the position of SDN as a key enabler of a software-defined

To the memory of my parents, Sara and Avraham Haviv To my mother and late father, Fela and Shimon Hassin Contents Preface xi 1. INTRODUCTION 1 1.1 Basic concepts 2 1.1.1 Strategies, payoffs, and equilibrium 2 1.1.2 Steady-state 4 1.1.3 Subgame perfect equilibrium 5 1.1.4 Evolutionarily stable strategies 5 1.1.5 The Braess paradox 5 1.1.6 Avoid the crowd or follow it? 6 1.2 Threshold strategies 7 1.3 Costs and objectives 9 1.4 Queueing theory preliminaries 11 1.5 A shuttle example 14 1.5.1 The unobservable model 14 1.5.2 The observable model 17 1.5.3 Social optimality 18 1.6 Non-stochastic models 19

The ultimate proof of our understanding of natural or technological systems is reflected in our ability to control them. Although control theory offers mathematical tools for steering engineered and natural systems towards a desired state, a framework to control complex self-organized systems is lacking. Here we develop analytical tools to study the controllability of an arbitrary complex directed network, identifying the set of driver nodes with time-dependent control that can guide the system’s entire dynamics. We apply these tools to several real networks, finding that the number of driver nodes is determined mainly by the network’s degree distribution. We show that sparse inhomogeneous networks, which emerge in many real complex systems, are the most difficult to control, but that dense and homogeneous networks can be controlled using a few driver nodes. Counterintuitively, we find that in both model and real systems the driver nodes tend to avoid the high-degree nodes.

Swarm intelligence is one of the most promising area for the researchers in the field of numerical optimization. Researchers have developed many algorithms by simulating the swarming behavior of various creatures like ants, honey bees, fish, birds and the findings are very motivating. In this paper, a new approach for numerical optimization is proposed by modeling the foraging behavior of spider monkeys. Spider monkeys have been categorized as fission–fusion social structure based animals. The animals which follow fission– fusion social systems, split themselves from large to smaller groups and vice-versa based on the scarcity or availability of food. The proposed swarm intelligence approach is named as Spider Monkey Optimization (SMO) algorithm and can broadly be classified as an algorithm inspired by intelligent foraging behavior of fission–fusion social structure based animals.

We design a peer-to-peer technique called ZIGZAG for single-source media streaming. ZIGZAG allows the media server to distribute content to many clients by organizing them into an appropriate tree rooted at the server. This applicationlayer multicast tree has a height logarithmic with the number of clients and a node degree bounded by a constant. This helps reduce the number of processing hops on the delivery path to a client while avoiding network bottleneck. Consequently, the end-to-end delay is kept small. Although one could build a tree satisfying such properties easily, an efficient control protocol between the nodes must be in place to maintain the tree under the effects of network dynamics and unpredictable client behaviors. ZIGZAG handles such situations gracefully requiring a constant amortized control overhead. Especially, failure recovery can be done regionally with little impact on the existing clients and mostly no burden on the server.

We introduce AutoMoDe: a novel approach to the automatic design of control software for robot swarms. The core idea in AutoMoDe recalls the approach commonly adopted in machine learning for dealing with the bias–variance tradedoff: to obtain suitably general solutions with low variance, an appropriate design bias is injected. AutoMoDe produces robot control software by selecting, instantiating, and combining preexisting parametric modules—the injected bias. The resulting control software is a probabilistic finite state machine in which the topology, the transition rules and the values of the parameters are obtained automatically via an optimization process that maximizes a task-specific objective function. As a proof of concept, we define AutoMoDe-Vanilla, which is a specialization of AutoMoDe for the e-puck robot. We use AutoMoDe-Vanilla to design the robot control software for two different tasks: aggregation and foraging. The results show that the control software produced by AutoMoDe-Vanilla (i) yields good results, (ii) appears to be robust to the so called reality gap, and (iii) is naturally human-readable.

Automated guided vehicles (AGVs) are now becoming popular in automated materials handling systems, flexible manufacturing systems and even containers handling applications at seaports. Its performance affects the efficiency of the entire system. Deadlock formation is a serious problem as it stalls the AGVS. The objective of this paper is to develop an efficient AGV deadlock prediction and avoidance algorithm for container port operations. Deadlock in a broad sense is a situation in which at least a part of the system stalls. There are a lot of situations in which the system may stall and most of these situations can be avoided through the control and navigation system. This paper discusses the development of an efficient strategy for predicting and avoiding the deadlocks in a large scale AGVS A variety of deadlock-detecting algorithms are available, but these methods work mainly for manufacturing system where the network layout is simple and uses only a small number of AGVs. The AGVS under study has complex layout and involves close to 80 AGVs. The proposed solution is implemented using the Automod simulation software, and the performance of the technique is presented. Simulation shows that all the potential deadlock situations can be detected and avoided via this methodology. Also, the proposed strategy is computationally efficient and is able to provide the movement decision to the vehicles within the 1.5-s sampling time. r 2002 Published by Elsevier Science B.V.

An algorithm is proposed that creates mutual exclusion in a computer network whose nodes communicate only by messages and do not share memory. The algorithm sends only 2*(N 1) messages, where N is the number of nodes in the network per critical section invocation. This number of messages is at a minimum if parallel, distributed, symmetric control is used; hence, the algorithm is optimal in this respect. The time needed to achieve mutual exclusion is also minimal under some general assumptions. As in Lamport's "bakery algorithm," unbounded sequence numbers are used to provide first-come firstserved priority into the critical section. It is shown that the number can be contained in a fixed amount of memory by storing it as the residue of a modulus. The number of messages required to implement the exclusion can be reduced by using sequential node-by-node processing, by using broadcast message techniques, or by sending information through timing channels. The "readers and writers" problem is solved by a simple modification of the algorithm and the modifications necessary to make the algorithm robust are described.


Question: A method for identifying webshell using Random Forest classification enhanced by FastText.

In this study, we investigate an optimized and swift baseline technique for text classification, specifically focusing on a fast text classifier known as fastText. Our empirical results reveal that fastText frequently matches the accuracy of deep learning classifiers while significantly outperforming them in terms of training and evaluation speed. Remarkably, fastText can be trained on a dataset containing over a billion words in under ten minutes, utilizing a standard multicore CPU. Furthermore, it can classify half a million sentences across 312,000 categories in less than a minute, showcasing its exceptional efficiency and scalability in text classification tasks. This makes fastText a compelling choice for large-scale text classification challenges, where speed and accuracy are both critical.

An intrusion Detection System (IDS) provides alarts against intrusion attacks where a traditional firewall fails. Machine learning algorithms aim to detect anomalies using supervised and unsupervised approaches. Features selection techniques identify important features and remove irrelevant and redundant attributes to reduce the dimensionality of feature space. This paper presents a features selection framework for efficient network anomaly detection using different machine learning classifiers. The framework applies different strategies by using filter and wrapper features selection methodologies. The aim of this framework is to select the minimum number of features that achieve the highest accuracy. UNSW-NB15 dataset is used in the experimental results to evaluate the proposed framework. The results show that by using 18 features from one of the filter ranking methods and applying J48 as a classifier, an accuracy of 88% is achieved.

We describe a simple, functioning web search engine for indexing and searching online documents using python programming language. Python was chosen because it is an elegant language with simple syntax, is easy to learn and debug, and supports main operating systems almost evenly. The remarkable characteristics of this program are an adjustable search function that allows users to rank documents with several combinations of score functions and the focus on anchor text analysis as we provide four additional schemes to calculate scores based on anchor text. We also provide an additional ranking algorithm based on link addition process in network motivated by PageRank and HITS as an experimental tool. This algorithm is the original contribution of this paper.

In recent years, with rapid growth of social networking websites, users are very active in these platforms and large amount of data are aggregated. Among those social networking websites, Facebook is the most popular website that has most users. However, in Facebook, the abusing problem is a very critical issue, such as Hate Groups. Therefore, many researchers are devoting on how to detect potential hate groups, such as using the techniques of social networks analysis. However, we believe content is also a very important factors for hate groups detection. Thus, in this paper, we will propose an architecture to for hate groups detection which is based on the technique of Social Networks Analysis and Web Mining (Text Mining; Natural Language Processing). From the experiment result, it shows that content plays an critical role for hate groups detection and the performance is better than the system that just applying social networks analysis.

The world wide web represents vast stores of information. However, the sheer amount of such information makes it practically impossible for any human user to be aware of much of it. Therefore, it would be very helpful to have a system that automatically discovers relevant, yet previously unknown information, and reports it to users in human-readable form. As the first attempt to accomplish such a goal, we proposed a new clustering algorithm and compared it with existing clustering algorithms. The proposed method is motivated by constructive and competitive learning from neural network research. In the construction phase, it tries to find the optimal number of clusters by adding a new cluster when the intrinsic difference between the instance presented and the existing clusters is detected. Each cluster then moves toward the optimal cluster center according to the learning rate by adjusting its weight vector. From the experimental results on the three different real world data sets, the proposed method shows an even trend of performance across the different domains, while the performance of our algorithm on text domains was better than that reported in previous research.

Malicious software, i.e., malware, has been a persistent threat in the information security landscape since the early days of personal computing. The recent targeted attacks extensively use non-executable malware as a stealthy attack vector. There exists a substantial body of previous work on the detection of non-executable malware, including static, dynamic, and combined methods. While static methods perform orders of magnitude faster, their applicability has been hitherto limited to specific file formats. This paper introduces Hidost, the first static machine-learning-based malware detection system designed to operate onmultiple file formats. Extending a previously published, highly effective method, it combines the logical structure of files with their content for even better detection accuracy. Our system has been implemented and evaluated on two formats, PDF and SWF (Flash). Thanks to its modular design and general feature set, it is extensible to other formats whose logical structure is organized as a hierarchy. Evaluated in realistic experiments on timestamped datasets comprising 440,000 PDF and 40,000 SWF files collected during several months, Hidost outperformed all antivirus engines deployed by the website VirusTotal to detect the highest number of malicious PDF files and ranked among the best on SWF malware.

The exponential growth of the internet has led to a great deal of interest in developing useful and efficient tools and software to assist users in searching the Web. Document retrieval, categorization, routing and filtering can all be formulated as classification problems. However, the complexity of natural languages and the extremely high dimensionality of the feature space of documents have made this classification problem very difficult. We investigate four different methods for document classification: the naive Bayes classifier, the nearest neighbour classifier, decision trees and a subspace method. These were applied to seven-class Yahoo news groups (business, entertainment, health, international, politics, sports and technology) individually and in combination. We studied three classifier combination approaches: simple voting, dynamic classifier selection and adaptive classifier combination. Our experimental results indicate that the naive Bayes classifier and the subspace method outperform the other two classifiers on our data sets. Combinations of multiple classifiers did not always improve the classification accuracy compared to the best individual classifier. Among the three different combination approaches, our adaptive classifier combination method introduced here performed the best. The best classification accuracy that we are able to achieve on this seven-class problem is approximately 83 %, which is comparable to the performance of other similar studies. However, the classification problem considered here is more difficult because the pattern classes used in our experiments have a large overlap of words in their corresponding documents.

Backdoors in software systems probably exist since the very first access control mechanisms were implemented and they are a well-known security problem. Despite a wave of public discoveries of such backdoors over the last few years, this threat has only rarely been tackled so far.
 In this paper, we present an approach to reduce the attack surface for this kind of attacks and we strive for an automated identification and elimination of backdoors in binary applications. We limit our focus on the examination of server applications within a client-server model. At the core, we apply variations of the delta debugging technique and introduce several novel heuristics for the identification of those regions in binary application that backdoors are typically installed in (i.e., authentication and command processing functions). We demonstrate the practical feasibility of our approach on several real-world backdoors found in modified versions of the popular software tools ProFTPD and OpenSSH. Furthermore, we evaluate our implementation not only on common instruction set architectures such as x86-64, but also on commercial off-the-shelf embedded devices powered by a MIPS32 processor.

This paper describes IBCOW (Image-based Classi cation of Objectionable Websites), a system capable of classifying a website as objectionable or benign based on image content. The system uses WIPETM (Wavelet Image Pornography Elimination) and statistics to provide robust classi cation of on-line objectionable World Wide Web sites. Semantically-meaningful feature vector matching is carried out so that comparisons between a given on-line image and images marked as "objectionable" and "benign" in a training set can be performed efciently and e ectively in the WIPE module. If more than a certain number of images sampled from a site is found to be objectionable, then the site is considered to be objectionable. The statistical analysis for determining the size of the image sample and the threshold number of objectionable images is given in this paper. The system is practical for real-world applications, classifying a Web site at a speed of less than 2 minutes each, including the time to compute the feature vector for the images downloaded from the site, on a Pentium Pro PC. Besides its exceptional speed, it has demonstrated 97% sensitivity and 97% speci city in classifying a Web site based solely on images. Both the sensitivity and the speci city in real-world applications is expected to be higher because our performance evaluation is relatively conservative and surrounding text can be used to assist the classi cation process.

Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named.WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities. After notifying the developers, 38 acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%.

Critical Infrastructures (CIs) use Supervisory Control And Data Acquisition (SCADA) systems for remote control and monitoring. Sophisticated security measures are needed to address malicious intrusions, which are steadily increasing in number and variety due to the massive spread of connectivity and standardisation of open SCADA protocols. Traditional Intrusion Detection Systems (IDSs) cannot detect attacks that are not already present in their databases. Therefore, in this paper, we assess Machine Learning (ML) for intrusion detection in SCADA systems using a real data set collected from a gas pipeline system and provided by the Mississippi State University (MSU). The contribution of this paper is two-fold: 1) The evaluation of four techniques for missing data estimation and two techniques for data normalization, 2) The performances of Support Vector Machine (SVM), and Random Forest (RF) are assessed in terms of accuracy, precision, recall and F 1 score for intrusion detection. Two cases are differentiated: binary and categorical classifications. Our experiments reveal that RF detect intrusions effectively, with an F_1 score of respectively > 99%.


Question: A method for identifying webshell using Random Forest algorithm enhanced by FastText.

This study explores the utilization of convolutional neural networks (CNNs) in conjunction with pre-trained word vectors for sentence classification tasks, demonstrating remarkable outcomes. Our experiments confirm that a straightforward CNN, requiring minimal hyperparameter tuning and leveraging static word vectors, excels in various benchmarks for sentence-level classification. Enhancing the model by fine-tuning the vectors specifically for the task at hand leads to additional performance gains. We also introduce a minor architectural tweak that enables the simultaneous use of task-specific and static vectors. The CNN models detailed herein surpass previous state-of-the-art results in 4 out of 7 tasks, encompassing sentiment analysis and question classification. This showcases the effectiveness of combining CNNs with pre-trained word vectors for a variety of natural language processing challenges.

The increasing network throughput challenges the current Network Intrusion Detection Systems (NIDS) to have compatible highperformance data processing. In this paper, we describe an in-depth research on the related techniques of high-performance network intrusion detection and an implementation of a Rule-based High-performance Network Intrusion Detection System (RHPNIDS) for high-speed networks. By integrating several performance optimizing methods, the performance of RHPNIDS is very impressive compared with the popular open source NIDS Snort. q 2004 Elsevier B.V. All rights reserved.

An intrusion Detection System (IDS) provides alarts against intrusion attacks where a traditional firewall fails. Machine learning algorithms aim to detect anomalies using supervised and unsupervised approaches. Features selection techniques identify important features and remove irrelevant and redundant attributes to reduce the dimensionality of feature space. This paper presents a features selection framework for efficient network anomaly detection using different machine learning classifiers. The framework applies different strategies by using filter and wrapper features selection methodologies. The aim of this framework is to select the minimum number of features that achieve the highest accuracy. UNSW-NB15 dataset is used in the experimental results to evaluate the proposed framework. The results show that by using 18 features from one of the filter ranking methods and applying J48 as a classifier, an accuracy of 88% is achieved.

This paper describes IBCOW (Image-based Classi cation of Objectionable Websites), a system capable of classifying a website as objectionable or benign based on image content. The system uses WIPETM (Wavelet Image Pornography Elimination) and statistics to provide robust classi cation of on-line objectionable World Wide Web sites. Semantically-meaningful feature vector matching is carried out so that comparisons between a given on-line image and images marked as "objectionable" and "benign" in a training set can be performed efciently and e ectively in the WIPE module. If more than a certain number of images sampled from a site is found to be objectionable, then the site is considered to be objectionable. The statistical analysis for determining the size of the image sample and the threshold number of objectionable images is given in this paper. The system is practical for real-world applications, classifying a Web site at a speed of less than 2 minutes each, including the time to compute the feature vector for the images downloaded from the site, on a Pentium Pro PC. Besides its exceptional speed, it has demonstrated 97% sensitivity and 97% speci city in classifying a Web site based solely on images. Both the sensitivity and the speci city in real-world applications is expected to be higher because our performance evaluation is relatively conservative and surrounding text can be used to assist the classi cation process.

Detecting and identifying e-banking Phishing websites is really a complex and dynamic problem involving many factors and criteria. Because of the subjective considerations and the ambiguities involved in the detection, Fuzzy Data Mining Techniques can be an effective tool in assessing and identifying e-banking phishing websites since it offers a more natural way of dealing with quality factors rather than exact values. In this paper, we present novel approach to overcome the „fuzziness‟ in the e-banking phishing website assessment and propose an intelligent resilient and effective model for detecting e-banking phishing websites. The proposed model is based on Fuzzy logic combined with Data Mining algorithms to characterize the e-banking phishing website factors and to investigate its techniques by classifying there phishing types and defining six e-banking phishing website attack criteria‟s with a layer structure. A Case study was applied to illustrate and simulate the phishing process. Our experimental results showed the significance and importance of the e-banking phishing website criteria (URL & Domain Identity) represented by layer one, and the variety influence of the phishing characteristic layers on the final e-banking phishing website rate. KeywordsPhishing, Fuzzy Logic, Data Mining, Classification, association, apriori, e-banking risk assessment

This paper explores the effectiveness of different semantic web page segmentation algorithms on modern websites. We compare three known algorithms each serving as an example of a particular approach to the problem, and one self-developed algorithm, WebTerrain, that combines two of the approaches. With our testing framework we have compared the performance of four algorithms for a large benchmark we have constructed. We have examined each algorithm for a total of eight different configurations (varying datasets, evaluation metric and the type of the input HTML documents). We found that all algorithms performed better on random pages on average than on popular pages, and results are better when running the algorithms on the HTML obtained from the DOM rather than on the plain HTML. Overall there is much room for improvement as we find the best average F-score to be 0.49, indicating that for modern websites currently available algorithms are not yet of practical use.

To improve software reliability, software defect prediction is utilized to assist developers in finding potential bugs and allocating their testing efforts. Traditional defect prediction studies mainly focus on designing hand-crafted features, which are input into machine learning classifiers to identify defective code. However, these hand-crafted features often fail to capture the semantic and structural information of programs. Such information is important in modeling program functionality and can lead to more accurate defect prediction.In this paper, we propose a framework called Defect Prediction via Convolutional Neural Network (DP-CNN), which leverages deep learning for effective feature generation. Specifically, based on the programs' Abstract Syntax Trees (ASTs), we first extract token vectors, which are then encoded as numerical vectors via mapping and word embedding. We feed the numerical vectors into Convolutional Neural Network to automatically learn semantic and structural features of programs. After that, we combine the learned features with traditional hand-crafted features, for accurate software defect prediction. We evaluate our method on seven open source projects in terms of F-measure in defect prediction. The experimental results show that in average, DP-CNN improves the state-of-the-art method by 12%.

In this paper, we present an implementation of a new method for text classification that achieves significantly faster results than most existing classifiers. We extract features that are computationally efficient and forgo more computationally expensive ones used by many other text classifiers, most notably n-grams (contiguous sequences of n words). We then analyze the feature vectors through a hybrid SVM technique that sequentially classifies them with a one-versus-all classifier and a sequence of binary classifiers. Our overall method finishes execution within seconds on large novels, with accuracy comparable to that of standard classifiers but with a significantly shorter runtime.

A Random Forest consists of several independent decision trees arranged in a forest. A majority vote over all trees leads to the final decision. In this paper we propose a Random Forest framework which incorporates a cascade structure consisting of several stages together with a bootstrap approach. By introducing the cascade, 99% of the test images can be rejected by the first and second stage with minimal computational effort leading to a massively speeded-up detection framework. Three different cascade voting strategies are implemented and evaluated. Additionally, the training and classification speed-up is analyzed. Several experiments on public available datasets for pedestrian detection, lateral car detection and unconstrained face detection demonstrate the benefit of our contribution.

This paper presents an approach for automatic assessment of web sites in large scale e-Government surveys. The approach aims at supplementing and to some extent replacing human evaluation which is typically the core part of these surveys.
 The heart of the solution is a colony inspired algorithm, called the lost sheep, which automatically locates targeted governmental material online. The algorithm centers around classifying link texts to determine if a web page should be downloaded for further analysis.
 The proposed algorithm is designed to work with minimum human interaction and utilize the available resources as best possible. Using the lost sheep, the people carrying out a survey will only provide sample data for a few web sites for each type of material sought after. The algorithm will automatically locate the same type of material in the other web sites part of the survey. This way it significantly reduces the need for manual work in large scale e-Government surveys.

Crime analysis has become a critical area for helping law enforcement agencies to protect civilians. As a result of a rapidly increasing population, crime rates have increased dramatically, and appropriate analysis has become a timeconsuming effort. Text mining is an effective tool that may help to solve this problem to classify crimes in effective manner. The proposed system aims to detect and classify crimes in Twitter posts that written in the Arabic language, one of the most widespread languages today. In this paper, classification techniques are used to detect crimes and identify their nature by different classification algorithms. The experiments evaluate different algorithms, such as SVM, DT, CNB, and KNN, in terms of accuracy and speed in the crime domain. Also, different features extraction techniques are evaluated, including rootbased stemming, light stemming, n-gram. The experiments revealed the superiority of n-gram over other techniques. Specifically, the results indicate the superiority of SVM with trigram over other classifiers, with a 91.55% accuracy. Keywords—Crimes; text mining; classification; features extraction techniques; arabic posts; twitter


Question: A method for identifying webshell using Random Forest algorithm enhanced by FastText.

This document introduces a cutting-edge method for detecting WebShells, a form of web-based network backdoor that enables hackers to illicitly gain control over web services. The existing approaches to WebShell detection primarily rely on matching known characteristics or monitoring the resultant traffic or services, which limits their ability to identify novel types of WebShells. To address these limitations, this paper presents a new algorithm that leverages matrix decomposition for WebShell detection. This algorithm, rooted in supervised machine learning, is designed to analyze and learn from the features of both known WebShell and non-WebShell pages. By doing so, it can predict the status of unknown pages with a higher degree of accuracy. Experimental evaluations demonstrate that, in comparison to conventional detection techniques, this matrix decomposition-based algorithm is more efficient in terms of processing time, and it boasts superior accuracy and recall rates. Moreover, it can identify new varieties of WebShells with a certain level of probability, effectively overcoming the drawbacks associated with traditional feature-matching methods. This innovation significantly enhances the precision and recall rates in the detection of WebShells.

Mobile security is an important issue on Android platform. Most malware detection methods based on machine learning models heavily rely on expert knowledge for manual feature engineering, which are still difficult to fully describe malwares. In this paper, we present LSTM-based hierarchical denoise network (HDN), a novel static Android malware detection method which uses LSTM to directly learn from the raw opcode sequences extracted from decompiled Android files. However, most opcode sequences are too long for LSTM to train due to the gradient vanishing problem. Hence, HDN uses a hierarchical structure, whose first-level LSTM parallelly computes on opcode subsequences (we called them method blocks) to learn the dense representations; then the secondlevel LSTM can learn and detect malware through method block sequences. Considering that malicious behavior only appears in partial sequence segments, HDN uses method block denoise module (MBDM) for data denoising by adaptive gradient scaling strategy based on loss cache. We evaluate and compare HDN with the latest mainstream researches on three datasets. The results show that HDN outperforms these Android malware detection methods,and it is able to capture longer sequence features and has better detection efficiency thanN-gram-based malware detection which is similar to our method.

Currently system logs are an important source of information for system administrators to monitor system behaviors and to identify system problems. The manual examining is infeasible for the complex system and the existing automated methods for identifying system problems have different disadvantages such as the extreme dependency on the source code of the system, the low accuracy of predicting or identifying the system problems, or the requirement of the balanced and labeled training data set. This paper proposes a one- class Support Vector Machine (OCSVM) based method to identify the runtime system problems. Firstly, log sequences are generated for describing the running trajectories of the monitored system by parsing log messages; Secondly, variable length n-gram features are extracted, and moreover, the log sequences are represented as feature vectors based on these variable length n-gram features and Vector Space Model (VSM). Finally, all the feature vectors of the training log sequence set, which only includes the labeled normal log sequences, are input into OCSVM. Experimental results show that it performs better to use linear kernel to train OCSVM on our feature vectors than Gaussian kernel and the size of the sliding window hardly affects the performance of our method. Moreover, the proposed method achieves better performance on unbalanced training dataset than the method based on Random Indexing (RI) and weighted SVM.

Recently, anomaly-based intrusion detection techniques are valuable methodology to detect both known as well as unknown/new attacks, so they can cope with the diversity of the attacks and the constantly changing nature of network attacks. There are many problems need to be considered in anomaly-based network intrusion detection system (NIDS), such as ability to adapt to dynamic network environments, unavailability of labeled data, false positive rate. This paper, we use Deep learning techniques to implement an anomaly-based NIDS. These techniques show the sensitive power of generative models with good classification, capabilities to deduce part of its knowledge from incomplete data and the adaptability. Our experiments with KDDCup99 network traffic connections show that our work is effective to exact detect in anomaly-based NIDS and classify intrusions into five groups with the accuracy based on network data sources.

Mining for crypto currencies is usually performed on high-performance single purpose hardware or GPUs. However, mining can be easily parallelized and distributed over many less powerful systems. Cryptojacking is a new threat on the Internet and describes code included in websites that uses a visitor's CPU to mine for crypto currencies without the their consent. This paper introduces MiningHunter, a novel web crawling framework which is able to detect mining scripts even if they obfuscate their malicious activities. We scanned the Alexa Top 1 million websites for cryptojacking, collected more than 13,400,000 unique JavaScript files with a total size of 246 GB and found that 3,178 websites perform cryptocurrency mining without their visitors' consent. Furthermore, MiningHunter can be used to provide an in-depth analysis of cryptojacking campaigns. To show the feasibility of the proposed framework, three of such campaigns are examined in detail. Our results provide the most comprehensive analysis to date of the spread of cryptojacking on the Internet.

Botnets are networks formed with a number of machines infected by malware called bots. Detection of these malicious networks is becoming a major concern as they pose a serious threat to the network security. Most of the research on bot detection is based on particular botnet characteristics which fail to detect other types of botnets and bots. Furthermore, there are very few bot detection methods that considered real-life class-imbalanced dataset. A dataset is class-imbalanced if there are significantly more instances in one class than the other classes. In this paper, we develop three generic features to detect different types of bots regardless of their botnet characteristics. We develop five classification models based on those features to classify bots from a large, real-life, class-imbalanced network dataset. Results show that our methodology can detect bots more accurately than the existing methods. Experimental results also demonstrate that the developed methodology can successfully detect bots when the proportion of bots to normal activity is very small. We also provide a performance comparison of our methodology with a recent study on bot detection in a real-life, large, imbalanced dataset.

As the Internet has changed the way people communicate with each other in everyday life, the number of home Wi-Fi access routers has grown up significantly over the past few years. However, the security of routers used in every household is still in the low level. The common vulnerabilities in routers can be easily exploited by an attacker in order to obtain user’s sensitive information or even compromise the devices to be a part of the botnet network. Therefore, we developed one-stop service firmware analysis tool that can perform both static and dynamic analysis for the router firmware called “Firmaster”. textbfThe program is operated under graphical user interface (GUI) of Qt creator running on the Ubuntu Linux machine. textbfVulnerabilities of firmware analyzed by Firmaster program are based on OWASP’s Top 10 IoT Vulnerabilities 2014. Firmaster contains seven main functions: password cracking, SSL scanning, web static analysis, firmware update analysis, web dynamic analysis, port scanning and the summary report.

In this paper we apply Machine Learning (ML) techniques on static features that are extracted from Android's application files for the classification of the files. Features are extracted from Android’s Java byte-code (i.e.,.dex files) and other file types such as XML-files. Our evaluation focused on classifying two types of Android applications: tools and games. Successful differentiation between games and tools is expected to provide positive indication about the ability of such methods to learn and model Android benign applications and potentially detect malware files. The results of an evaluation, performed using a test collection comprising 2,285 Android. apk files, indicate that features, extracted statically from. apk files, coupled with ML classification algorithms can provide good indication about the nature of an Android application without running the application, and may assist in detecting malicious applications. This method can be used for rapid examination of Android. apks and informing of suspicious applications.

Most modern malware download attacks occur via the browser, typically due to social engineering and driveby downloads. In this paper, we study the “origin” of malware download attacks experienced by real network users, with the objective of improving malware download defenses. Specifically, we study the web paths followed by users who eventually fall victim to different types of malware downloads. To this end, we propose a novel incident investigation system, named WebWitness. Our system targets two main goals: 1) automatically trace back and label the sequence of events (e.g., visited web pages) preceding malware downloads, to highlight how users reach attack pages on the web; and 2) leverage these automatically labeled in-the-wild malware download paths to better understand current attack trends, and to develop more effective defenses. We deployed WebWitness on a large academic network for a period of ten months, where we collected and categorized thousands of live malicious download paths. An analysis of this labeled data allowed us to design a new defense against drive-by downloads that rely on injecting malicious content into (hacked) legitimate web pages. For example, we show that by leveraging the incident investigation information output by WebWitness we can decrease the infection rate for this type of drive-by downloads by almost six times, on average, compared to existing URL blacklisting approaches.

Malware is a widespread problem and despite the common use of anti-virus software, the diversity of malware is still increasing. A major challenge facing the anti-virus industry is how to effectively detect thousands of malware samples that are received every day. In this paper, a novel approach based Run Length Encoding (RLE) algorithm and n-gram are proposed to improve malware detect on dynamic analysis of based on API sequences.

JavaScript is a scripting language that is commonly used to create sophisticated interactive client-side web applications. However, JavaScript code can also be used to exploit vulnerabilities in the web browser and its extensions, and in recent years it has become a major mechanism for web-based malware delivery. In order to avoid detection, attackers often take advantage of the dynamic nature of JavaScript to create highly obfuscated code. This paper describes a semantics-based approach for automatic deobfuscation of JavaScript code. Experiments using a prototype implementation indicate that our approach is able to penetrate multiple layers of complex obfuscations and extract the core logic of the computation, which makes it easier to understand the behavior of the code.


Question: Identifying webshell through a random forest method enhanced by FastText.

This paper delves into the application and effectiveness of the randomForest package for classification and regression tasks, particularly focusing on its utility in ensemble learning methods. Ensemble learning, which has garnered significant attention in recent years, involves aggregating the results from multiple classifiers to enhance predictive accuracy. Two prominent ensemble techniques are boosting and bagging. Boosting algorithms, such as those described by Shapire et al. (1998), progressively build classifiers, giving more weight to data points misclassified by previous predictors, and culminate in a weighted vote for final prediction. Conversely, bagging, as introduced by Breiman (1996), constructs each classifier independently using a bootstrap sample of the dataset, leading to a simple majority vote for prediction. Building upon the concept of bagging, Breiman (2001) introduced random forests, a method that introduces an extra layer of randomness. Not only does each tree in a random forest rely on a distinct bootstrap sample, but the tree construction process is also altered. Unlike traditional decision trees where each node is split based on the best split among all variables, random forests select the best split from a random subset of predictors at each node. This seemingly unconventional approach has been shown to outperform various other classifiers, including discriminant analysis, support vector machines, and neural networks, while being highly resistant to overfitting. Moreover, random forests are user-friendly, requiring only two parameters—the number of variables in the random subset at each node and the total number of trees in the forest—and are generally robust to changes in these parameter values. The randomForest package in R serves as an interface to the Fortran programs developed by Breiman and Cutler, and this paper aims to provide an overview of the package's usage and features in the context of R programming.

In summary, the randomForest package, with its implementation of random forests, offers a robust and versatile approach to classification and regression tasks. By combining the strengths of multiple decision trees and introducing randomness in the tree construction process, it achieves high predictive accuracy and is relatively insensitive to parameter settings, making it a valuable tool in the ensemble learning toolbox.

Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities have been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named.WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities. After notifying the developers, 38 acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%.

The classification of a real text should not be necessarily treated as a binary or multi-class classification, since the text may belong to one or more labels. This type of problem is called multi-label classification. In this paper, we propose the use of latent semantic indexing to text representation, convolutional neural networks to feature extraction and a single multi layer perceptron for multi-label classification in real text data. The experiments show that the model outperforms state of the art techniques when the dataset has long documents, and we observe that the precision is poor when the size of the texts is small.

We have developed an efficient way to determine the syntactic similarity of files and have applied it to every document on the World Wide Web. Using this mechanism, we built a clustering of all the documents that are syntactically similar. Possible applications include a “Lost and Found” service, filtering the results of Web searches, updating widely distributed web-pages, and identifying violations of intellectual property rights.

Function recognition in program binaries serves as the foundation for many binary instrumentation and analysis tasks. However, as binaries are usually stripped before distribution, function information is indeed absent in most binaries. By far, identifying functions in stripped binaries remains a challenge. Recent research work proposes to recognize functions in binary code through machine learning techniques. The recognition model, including typical function entry point patterns, is automatically constructed through learning. However, we observed that as previous work only leverages syntax-level features to train the model, binary obfuscation techniques can undermine the pre-learned models in real-world usage scenarios. In this paper, we propose FID, a semantics-based method to recognize functions in stripped binaries. We leverage symbolic execution to generate semantic information and learn the function recognition model through well-performing machine learning techniques.FID extracts semantic information from binary code and, therefore, is effectively adapted to different compilers and optimizations. Moreover, we also demonstrate that FID has high recognition accuracy on binaries transformed by widely-used obfuscation techniques. We evaluate FID with over four thousand test cases. Our evaluation shows that FID is comparable with previous work on normal binaries and it notably outperforms existing tools on obfuscated code.

Nowadays, most botnets utilize domain generation algorithms (DGAs) to build resilient and agile command and control (C&C) channels. Specifically, botmasters employ DGAs to dynamically produce a large number of random domains and only register a small subset for their actual C&C servers with the purpose to defend them from takeovers and blacklisting attempts. While many approaches and models have been developed to detect DGA-based botnets, they suffer from several limitations, such as difficulties of DNS traffic collection, low feasibility and scalability, and so forth. In this paper, we present BotCensor, a new system that can determine if a host is infected with certain DGA malware with two-stage anomaly detection. In the first stage, we preliminarily attempt to identify malicious domains using a Markov model, and in the second stage, we re-examine the hosts that requested aforementioned malicious domains using novelty detection algorithms. Our experimental results show that our approach performs very well on identifying previously unknown DGA-generated domains and detects DGA bots with high efficiency and efficacy. Our approach not only can be regarded as security forensics tools, but also can be used to prevent malware infections and spread.

Different from long texts, the features of Chinese short texts is much sparse, which is the primary cause of the low accuracy in the classification of short texts by using traditional classification methods. In this paper, a novel method was proposed to tackle the problem by expanding the features of short text based on Wikipedia and Word2vec. Firstly, build the semantic relevant concept sets of Wikipedia. We get the articles that have high relevancy with Wikipedia concepts and use the word2vec tools to measure the semantic relatedness between target concepts and related concepts. And then we use the relevant concept sets to extend the short texts. Compared to traditional similarity measurement between concepts using statistical method, this method can get more accurate semantic relatedness. The experimental results show that by expanding the features of short texts, the classification accuracy can be improved. Specifically, our method appeared to be more effective.

The popularity of smartphones usage especially Android mobile platform has increased to 80% of share in global smartphone operating systems market, as a result of which it is on the top in the attacker's target list. The fact of having more private data and low security assurance letting the attacker to write several malware programs in different ways for smartphone, and the possibility of obfuscating the malware detection applications through different coding techniques is giving more energy to attacker. Several approaches have been proposed to detect malwares through code analysis which are now severely facing the problem of code obfuscation and high computation requirement. We propose a machine learning based method to detect android malware by analyzing the visual representation of binary formatted apk file into Grayscale, RGB, CMYK and HSL. GIST feature from malware and benign image dataset were extracted and used to train machine learning algorithms. Initial experimental results are encouraging and computationally effective. Among machine learning algorithms Random Forest have achieved highest accuracy of 91% for grayscale image, which can be further improved by tuning the various parameters.

As the threat of malicious software (malware) becomes urgently serious, automatic malware detection techniques have received increasing attention recently, where the machine learning (ML)-based visualization detection plays a significant role. However, this leads to a fundamental problem whether such detection methods can be robust enough against various potential attacks. Even though ML algorithms show superiority to conventional ones in malware detection in terms of high efficiency and accuracy, this paper demonstrates that such ML-based malware detection methods are vulnerable to adversarial examples (AE) attacks. We propose the first AE-based attack framework, named Adversarial Texture Malware Perturbation Attacks (ATMPA), based on the gradient descent or L-norm optimization method. By introducing tiny perturbations on the transformed dataset, ML-based malware detection methods completely fail. The experimental results on the MS BIG malware dataset show that a small interference can reduce the detection rate of convolutional neural network (CNN), support vector machine (SVM) and random forest(RF)-based malware detectors down to 0 and the attack transferability can achieve up to 88.7% and 74.1% on average in different ML-based detection methods.

The number of client-side attacks has grown significantly in the past few years, shifting focus away from defendable positions to a broad, poorly defended space filled with vulnerable clients. Just as honeypots enabled deep research into server-side attacks, honeyclients can permit the deep study of client-side attacks. A complement to honeypots, a honeyclient is a tool designed to mimic the behavior of a userdriven network client application, such as a web browser, and be exploited by an attacker’s content. These systems are instrumented to discover what happened and how. This paper presents PhoneyC, a honeyclient tool that can provide visibility into new and complex client-side attacks. PhoneyC is a virtual honeyclient, meaning it is not a real application but rather an emulated client. By using dynamic analysis, PhoneyC is able to remove the obfuscation from many malicious pages. Furthermore, PhoneyC emulates specific vulnerabilities to pinpoint the attack vector. PhoneyC is a modular framework that enables the study of malicious HTTP pages and understands modern vulnerabilities and attacker techniques.

Android is arguably the most widely used mobile operating system in the world. Due to its widespead use and huge user base, it has attracted a lot of attention from the unsavory crowd of malware writers. Traditionally, techniques to counter such malicious software involved manually analyzing code and figuring out whether it was malicious or benign. However, due to the immense pace at which newer malware families are surfacing, such an approach is no longer feasible. Machine learning offers a way to tackle this issue of speed by automating the classification task. While several efforts have been made to use traditional machine learning techniques to Android malware detection, no reasonable effort has been made to utilize the newer, deep learning models in this domain. In this paper, we apply several deep learning models including fully connected, convolutional and recurrent neural networks as well as autoencoders and deep belief networks to detect Android malware from a large scale dataset of more than 55 GBs of Android malware. Further, we apply Bayesian machine learning to this problem domain to see how it fares with the deep learning based models while also providing insights into the dataset. We show that we are able to achieve better results using these models as compared to the state-of-the-art approaches. Our best model gets an F1 score of 0.986 with an AUC of 0.983 as compared to the existing best F1 score of 0.875 and AUC of 0.953.


Question: A method for identifying webshell using Random Forest classification enhanced by FastText.

This paper introduces an innovative method for detecting webshells within web applications, focusing on enhancing website security against the growing threat of malicious online activities. As the use of online services expands, so does the risk posed by harmful web entities, with attackers exploiting system vulnerabilities to upload webshells—malicious files—to web servers, facilitating further illicit activities. Recognizing the urgency to locate and neutralize these webshells, this study presents a distinctive approach centered on utilizing optimal threshold values to pinpoint files harboring malicious code within web applications. The proposed detection system meticulously scans each file for signs of malicious code, promptly generating a list of suspicious files alongside detailed analysis logs for administrator review. Experimental outcomes affirm the effectiveness of this approach, demonstrating its superiority in identifying webshells compared to alternative methods. This advancement in webshell detection is a significant stride towards bolstering web application security and mitigating the risks associated with cyber attacks.

Malware classification is a critical part in the cyber-security. Traditional methodologies for the malware classification typically use static analysis and dynamic analysis to identify malware. In this paper, a malware classification methodology based on its binary image and extracting local binary pattern (LBP) features is proposed. First, malware images are reorganized into 3 by 3 grids which is mainly used to extract LBP feature. Second, the LBP is implemented on the malware images to extract features in that it is useful in pattern or texture classification. Finally, Tensorflow, a library for machine learning, is applied to classify malware images with the LBP feature. Performance comparison results among different classifiers with different image descriptors such as GIST, a spatial envelop, and the LBP demonstrate that our proposed approach outperforms others.

Mobile malware has been growing in scale and complexity spurred by the unabated uptake of smartphones worldwide. Android is fast becoming the most popular mobile platform resulting in sharp increase in malware targeting the platform. Additionally, Android malware is evolving rapidly to evade detection by traditional signature-based scanning. Despite current detection measures in place, timely discovery of new malware is still a critical issue. This calls for novel approaches to mitigate the growing threat of zero-day Android malware. Hence, in this paper we develop and analyze proactive Machine Learning approaches based on Bayesian classification aimed at uncovering unknown Android malware via static analysis. The study, which is based on a large malware sample set of majority of the existing families, demonstrates detection capabilities with high accuracy. Empirical results and comparative analysis are presented offering useful insight towards development of effective static-analytic Bayesian classification based solutions for detecting unknown Android malware.

Social interactions take place in environments that influence people’s behaviours and perceptions. Nowadays, the users of Online Social Network (OSN) generate a massive amount of content based on social interactions. However, OSNs wide popularity and ease of access created a perfect scenario to practice malicious activities, compromising their reliability. To detect automatic information broadcast in OSN, we developed a wavelet-based model that classifies users as being human, legitimate robot, or malicious robot, as a result of spectral patterns obtained from users’ textual content. We create the feature vector from the Discrete Wavelet Transform along with a weighting scheme called Lexicon-based Coefficient Attenuation. In particular, we induce a classification model using the Random Forest algorithm over two real Twitter datasets. The corresponding results show the developed model achieved an average accuracy of 94.47% considering two different scenarios: single theme and miscellaneous one.

For the Android malware detection / classification anti-malware community has relied on traditional malware detection methods as a countermeasure. However, traditional detection methods are developed for detecting the computer malware, which is different from Android malware in structure and characteristics. Thus, they may not be useful for Android malware detection. Moreover, majority of suggested detection approaches may not be generalized and are incapable of detecting zero-day malware due to different reasons such as available data set with specific set of examples. Thus, their detection accuracy may be questionable. To address this problem, this paper presents a malware classification approach with a reliable detection accuracy and evaluate the approach using artificially generated examples. The suggested approach generates the signature profiles and behavior profiles of each application in the data set, which are further used as input for the classification task. For improving the detection accuracy, feature fusion of features from filter methods and wrapper method and algorithm fusion is investigated. Without affecting the detection accuracy, the optimal balance between real world examples and synthetic examples is also investigated. The experimental results suggest that both AUC and F1 can be obtained up to 0.94 for both known and unknown malware using original examples and synthetic examples.

The sharp increase in the number of smartphones on the market, with the Android platform posed to becoming a market leader makes the need for malware analysis on this platform an urgent issue.
 In this paper we capitalize on earlier approaches for dynamic analysis of application behavior as a means for detecting malware in the Android platform. The detector is embedded in a overall framework for collection of traces from an unlimited number of real users based on crowdsourcing. Our framework has been demonstrated by analyzing the data collected in the central server using two types of data sets: those from artificial malware created for test purposes, and those from real malware found in the wild. The method is shown to be an effective means of isolating the malware and alerting the users of a downloaded malware. This shows the potential for avoiding the spreading of a detected malware to a larger community.

Malicious software is generated with more and more modified features of which the methods to detect malicious software use characteristics. Automatic classification of malicious software is efficient because it does not need to store all characteristic. In this paper, we propose a transferred generative adversarial network (tGAN) for automatic classification and detection of the zero-day attack. Since the GAN is unstable in training process, often resulting in generator that produces nonsensical outputs, a method to pre-train GAN with autoencoder structure is proposed. We analyze the detector, and the performance of the detector is visualized by observing the clustering pattern of malicious software using t-SNE algorithm. The proposed model gets the best performance compared with the conventional machine learning algorithms.

Phishing websites are fake websites that are created by dishonest people to mimic webpages of real websites. Victims of phishing attacks may expose their financial sensitive information to the attacker whom might use this information for financial and criminal activities. Various approaches have been proposed to detect phishing websites, among which, approaches that utilize data mining techniques had shown to be more effective. The main goal of data mining is to analyze a large set of data to identify unsuspected relation and extract understandable useful patterns. Associative Classification (AC) is a promising data mining approach that integrates association rule and classification to build classification models (classifiers). This paper, proposes a new AC algorithm called Phishing Associative Classification (PAC), for detecting phishing websites. PAC employed a novel methodology in construction the classifier which results in generating moderate size classifiers. The algorithm improved the effectiveness and efficiency of a known algorithm called MCAR, by introducing a new prediction procedure and adopting a different rule pruning procedure. The conducted experiments compared PAC with 4 well-known data mining algorithms, these are: covering algorithm (Prism), decision tree (C4.5), associative Classification (CBA) and MCAR. Experiments are performed on a dataset that consists of 1010 website. Each Website is represented using 17 features categorized into 4 sets. The features are extracted from the website contents and URL. The results on each features set show that PAC is either equivalent or more effective than the compared algorithms. When all features are considered, PAC outperformed the compared algorithms and correctly identified 99.31% of the tested websites. Furthermore, PAC produced less number of rules than MCAR, and therefore, is more efficient.

Requirement engineers are not able to elicit and analyze the security requirements clearly, that are essential for the development of secure and reliable software. Proper identification of security requirements present in the Software Requirement Specification (SRS) document has been a problem being faced by the developers. As a result, they are not able to deliver the software free from threats and vulnerabilities. Thus, in this paper, we intend to mine the descriptions of security requirements present in the SRS document and thereafter develop the classification models. The security-based descriptions are analyzed using text mining techniques and are then classified into four types of security requirements viz. authentication-authorization, access control, cryptography-encryption and data integrity using J48 decision tree method. Corresponding to each type of security requirement, a prediction model has been developed. The effectiveness of the prediction models is evaluated against requirement specifications collected from 15 projects which have been developed by MS students at DePaul University. The result analysis indicated that all the four models have performed very well in predicting their respective type of security requirements.

We have developed an efficient way to determine the syntactic similarity of files and have applied it to every document on the World Wide Web. Using this mechanism, we built a clustering of all the documents that are syntactically similar. Possible applications include a “Lost and Found” service, filtering the results of Web searches, updating widely distributed web-pages, and identifying violations of intellectual property rights.

This paper presents HeNet, a hierarchical ensemble neural network, applied to classify hardware-generated control flow traces for malware detection. Deep learning-based malware detection has so far focused on analyzing executable files and runtime API calls. Static code analysis approaches face challenges due to obfuscated code and adversarial perturbations. Behavioral data collected during execution is more difficult to obfuscate but recent research has shown successful attacks against API call based malware classifiers. We investigate control flow based characterization of a program execution to build robust deep learning malware classifiers. HeNet consists of a low-level behavior model and a toplevel ensemble model. The low-level model is a per-application behavior model, trained via transfer learning on a time-series of images generated from control flow trace of an execution. We use Intel R © Processor Trace enabled processor for low overhead execution tracing and design a lightweight image conversion and segmentation of the control flow trace. The top-level ensemble model aggregates the behavior classification of all the trace segments and detects an attack. The use of hardware trace adds portability to our system and the use of deep learning eliminates the manual effort of feature engineering. We evaluate HeNet against real-world exploitations of PDF readers. HeNet achieves 100% accuracy and 0% false positive on test set, and higher classification accuracy compared to classical machine learning algorithms.


Question: The connection between personality characteristics and counterproductive work behaviors: exploring the mediating role of job satisfaction.

This paper offers a comprehensive meta-analysis exploring the connection between the five-factor model of personality and key theories of performance motivation, including goal-setting, expectancy, and self-efficacy. The review encompasses 150 correlations from 65 studies, systematically categorizing personality traits within the framework of the five-factor model. The findings reveal that Neuroticism (with an average validity of -.31) and Conscientiousness (with an average validity of .24) are the most robust and consistent predictors of performance motivation across the three theoretical frameworks. Moreover, the analysis shows that the validity of three of the Big Five traits—Neuroticism, Extraversion, and Conscientiousness—remains consistent across various studies. Collectively, the Big Five traits display a strong association with motivational criteria, with an average multiple correlation of .49, underscoring their significant role in driving performance motivation.

Gray (1981, 1982) holds that 2 general motivational systems underlie behavior and affect: a behavioral inhibition system (BIS) and a behavioral activation system (BAS). Self-report scales to assess dispositional BIS and BAS sensitivities were created. Scale development (Study 1) and convergent and discriminant validity in the form of correlations with alternative measures are reported (Study 2). In Study 3, a situation in which Ss anticipated a punishment was created. Controlling for initial nervousness, Ss high in BIS sensitivity (assessed earlier) were more nervous than those low. In Study 4, a situation in which Ss anticipated a reward was created. Controlling for initial happiness, Ss high in BAS sensitivity (Reward Responsiveness and Drive scales) were happier than those low. In each case the new scales predicted better than an alternative measure. Discussion is focused on conceptual implications.

Seven experts on personality measurement here discuss the viability of public-domain personality measures, focusing on the International Personality Item Pool (IPIP) as a prototype. Since its inception in 1996, the use of items and scales from the IPIP has increased dramatically. Items from the IPIP have been translated from English into more than 25 other languages. Currently over 80 publications using IPIP scales are listed at the IPIP Web site (http://ipip.ori.org), and the rate of IPIPrelated publications has been increasing rapidly. The growing popularity of the IPIP can be attributed to Wve factors: (1) It is cost free; (2) its items can be obtained instantaneously via the Internet; (3) it includes over 2000 items, all easily available for inspection; (4) scoring keys for IPIP scales are This article represents a synthesis of contributions to the presidential symposium, The International Personality Item Pool and the Future of Public-Domain Personality Measures (L.R. Goldberg, Chair) at the sixth annual meeting of the Association for Research in Personality, New Orleans, January 20, 2005. Authorship order is based on the order of participation in the symposium. The IPIP project has been continually supported by Grant MH049227 from the National Institute of Mental Health, U.S. Public Health Service. J.A. Johnson’s research was supported by the DuBois Educational Foundation. The authors thank Paul T. Costa Jr., Samuel D. Gosling, Leonard G. Rorer, Richard Reed, and Krista Trobst for their helpful suggestions. * Corresponding author. Fax: +1 814 375 4784. E-mail address: j5j@psu.edu (J.A. Johnson). 0092-6566/$ see front matter  2005 Elsevier Inc. All rights reserved. doi:10.1016/j.jrp.2005.08.007 L.R. Goldberg et al. / Journal of Research in Personality 40 (2006) 84–96 85 provided; and (5) its items can be presented in any order, interspersed with other items, reworded, translated into other languages, and administered on the World Wide Web without asking permission of anyone. The unrestricted availability of the IPIP raises concerns about possible misuse by unqualiWed persons, and the freedom of researchers to use the IPIP in idiosyncratic ways raises the possibility of fragmentation rather than scientiWc uniWcation in personality research.  2005 Elsevier Inc. All rights reserved.

Although there is evidence that academically successful students are engaged with their studies, it has proved difficult to define student engagement clearly. Student engagement is commonly construed as having two dimensions, social and academic. The rapid adoption of social media and digital technologies has ensured increasing interest in using them for improving student engagement. This paper examines Facebook usage among a first year psychology student cohort and reports that although the majority of students (94%) had Facebook accounts and spent an average of one hour per day on Facebook, usage was found to be predominantly social. Personality factors influenced usage patterns, with more conscientious students tending to use Facebook less than less conscientious students. This paper argues that, rather than promoting social engagement in a way that might increase academic engagement, it appears that Facebook is more likely to operate as a distracting influence.

Several theorists have argued in favor of a distinction between overt and covert narcissism, and factor analytic studies have supported this distinction. In this paper I demonstrate that overt narcissists report higher self-esteem and higher satisfaction with life, whereas covert narcissists report lower self-esteem and lower satisfaction with life. I also present mediational models to explain why overt narcissists are relatively happy and covert narcissists are relatively unhappy. In analyses using both partial correlations and structural equation modeling, self-esteem consistently mediated the associations between both types of narcissism and happiness, whereas self-deception did not. These results further demonstrate some of the selfcentered benefits associated with overt narcissism and some of the strong psychological costs associated with covert narcissism. # 2002 Elsevier Science Ltd. All rights reserved.

Although people's handshakes are thought to reflect their personality and influence our first impressions of them, these relations have seldom been formally investigated. One hundred twelve participants had their hand shaken twice by 4 trained coders (2 men and 2 women) and completed 4 personality measures. The participants' handshakes were stable and consistent across time and coders. There were also gender differences on most of the handshaking characteristics. A firm handshake was related positively to extraversion and emotional expressiveness and negatively to shyness and neuroticism; it was also positively related to openness to experience, but only for women. Finally, handshake characteristics were related to the impressions of the participants formed by the coders. These results demonstrate that personality traits, assessed through self-report, can predict specific behaviors assessed by trained observers. The pattern of relations among openness, gender, handshaking, and first impressions suggests that a firm handshake may be an effective form of self-promotion for women.

© International Association for Applied Psychology, 2004. Published by Blackwell Publishing, 9600 Garsington Road, Oxford OX4 2DQ, UK and 350 Main Street, Malden, MA 02148, USA. Blackwell Publishing, Ltd. Oxford, UK APPS pplied Psychology: an International Review 0269-994X © Blackwell Publishing 2004 ct ber 2004 53 4 riginal Arti le PERFORMANCE MANAGEMENT D N HARTOG ET AL. Performance Management: A Model and Research Agenda

This research utilizes the survey questionnaire data collected in May/June 2010 from 200 Amway Company’s direct sales forces in Klang Valley areas (Malaysia) to analyze the effectiveness of intrinsic and extrinsic motivation in influencing job satisfaction. The research will be analyzed using the well-established correlation analysis, regression analysis, independent sample t-test, and one-way ANOVA. There are four major findings. First, there is a relationship between intrinsic and extrinsic motivations with job satisfaction. According to the correlation value, intrinsic motivation compared to extrinsic motivation tends to contribute more in job satisfaction. Second, there are significant and positive relationship between intrinsic and extrinsic motivations and job satisfaction. Both of the intrinsic and extrinsic motivation is identified as the predictor for job satisfaction. In other words, they are both significantly contribute in better job satisfaction. Third, there is no difference between gender and intrinsic and extrinsic motivations. Hence, gender is not a factor that affects both of the intrinsic and extrinsic motivations. Lastly, the result indicates that there is a difference between age and intrinsic and extrinsic motivations. Therefore, age is the factor that influences on both intrinsic and extrinsic motivations. Last but not least, the results have demonstrated the effectiveness of intrinsic and extrinsic motivations in influencing job satisfaction among the Amway Company’s direct sales forces, as well as establishing appropriate intrinsic motivations may promote higher job satisfaction.

This article presents an empirical test of organizational identification in the context of customer-company (C-C) relationships. It investigates whether customers identify with companies and what the antecedents and consequences of such identification are. The model posits that perceived company characteristics, construed external image, and the perception of the company's boundary-spanning agent lead to C-C identification. In turn, such identification is expected to impact both in-role behavior (i.e., product utilization) as well as extra-role behavior (i.e., citizenship). The model was tested in a consultative selling context of pharmaceutical sales reps calling on physicians. Results from the empirical test indicated that customers do indeed identify with organizations and that C-C identification positively impacts both product utilization behavior and extra-role behavior even when the effect of brand perception is accounted for. Second, the study found that the organization's characteristics as well as the salesperson's characteristics contributed to the development of C-C identification.

Article History: Received 26.06.2016 Received in revised form 25.10.2016 Accepted 26.10.2016 Available online 25.11.2016 Circadian preference refers to individuals’ preference for morning or evening activities. Its two dimensions (i.e., morningness and eveningness) are related to a number of academic outcomes. While morningness shows positive relations with academic achievement, eveningness shows negative relations. Further, morningness and eveningness show the same correlational pattern with conscientiousness (i.e., positive relations for morningness, negative relations for eveningness), which – in turn – predicts academic achievement. Therefore, the main aim of the present study was to investigate if the relation between circadian preference and academic achievement was mediated by conscientiousness. The sample comprised 422 students attending the 11th grade at a grammar school in Germany. Circadian preference (morningness and eveningness) and conscientiousness were assessed by self-report questionnaires; academic achievement was operationalized by school grades. Using confirmatory analyses and structural equation modelling, the results supported the assumption that conscientiousness mediates the relation between circadian preference and academic achievement. Implications for research into circadian preference and for education are discussed. © 2016 IOJES. All rights reserved