Behavior-based malware analysis is an important technique for automatically analyzing and detecting malware, and it has received considerable attention from both academic and industrial communities. By considering how malware behaves, we can tackle the malware obfuscation problem, which cannot be processed by traditional static analysis approaches, and we can also derive the as-built behavior specifications and cover the entire behavior space of the malware samples. Although there have been several works focusing on malware behavior analysis, such research is far from mature, and no overviews have been put forward to date to investigate current developments and challenges. In this paper, we conduct a survey on malware behavior description and analysis considering three aspects: malware behavior description, behavior analysis methods, and visualization techniques. First, existing behavior data types and emerging techniques for malware behavior description are explored, especially the goals, principles, characteristics, and classifications of behavior analysis techniques proposed in the existing approaches. Second, the inadequacies and challenges in malware behavior analysis are summarized from different perspectives. Finally, several possible directions are discussed for future research.
Developing an efficient and robust lightweight graphic user interface (GUI) for industry process monitoring is always a challenging task. Current implementation methods for embedded GUI are with the matters of real-time processing and ergonomics performance. To address the issue, an embedded lightweight GUI component library design method based on quasar technology embedded (Qt/E) is proposed. First, an entity-relationship (E-R) model for the GUI library is developed to define the functional framework and data coupling relations. Second, a cross-compilation environment is constructed, and the Qt/E shared library files are tailored to satisfy the requirements of embedded target systems. Third, by using the signal-slot communication interfaces, a message mapping mechanism that does not require a call-back pointer is developed, and the context switching performance is improved. According to the multi-thread method, the parallel task processing capabilities for data collection, calculation, and display are enhanced, and the real-time performance and robustness are guaranteed. Finally, the human-computer interaction process is optimized by a scrolling page method, and the ergonomics performance is verified by the industrial psychology methods. Two numerical cases and five industrial experiments show that the proposed method can increase real-time read-write correction ratios by more than 26% and 29%, compared with Windows-CE-GUI and Android-GUI, respectively. The component library can be tailored to 900 KB and supports 12 hardware platforms. The average session switch time can be controlled within 0.6 s and six key indexes for ergonomics are verified by different industrial applications.
After a composite service is deployed, user privacy requirements and trust levels of component services are subject to variation. When the changes occur, it is critical to preserve privacy information flow security. We propose an approach to preserve privacy information flow security in composite service evolution. First, a privacy data item dependency analysis method based on a Petri net model is presented. Then the set of privacy data items collected by each component service is derived through a privacy data item dependency graph, and the security scope of each component service is calculated. Finally, the evolution operations that preserve privacy information flow security are defined. By applying these evolution operations, the re-verification process is avoided and the evolution efficiency is improved. To illustrate the effectiveness of our approach, a case study is presented. The experimental results indicate that our approach has high evolution efficiency and can greatly reduce the cost of evolution compared with re-verifying the entire composite service.
We propose a novel discriminative learning approach for Bayesian pattern classification, called ‘constrained maximum margin (CMM)’. We define the margin between two classes as the difference between the minimum decision value for positive samples and the maximum decision value for negative samples. The learning problem is to maximize the margin under the constraint that each training pattern is classified correctly. This nonlinear programming problem is solved using the sequential unconstrained minimization technique. We applied the proposed CMM approach to learn Bayesian classifiers based on Gaussian mixture models, and conducted the experiments on 10 UCI datasets. The performance of our approach was compared with those of the expectation-maximization algorithm, the support vector machine, and other state-of-the-art approaches. The experimental results demonstrated the effectiveness of our approach.
A lack of labeled corpora obstructs the research progress on implicit discourse relation recognition (DRR) for Chinese, while there are some available discourse corpora in other languages, such as English. In this paper, we propose a cross-lingual implicit DRR framework that exploits an available English corpus for the Chinese DRR task. We use machine translation to generate Chinese instances from a labeled English discourse corpus. In this way, each instance has two independent views: Chinese and English views. Then we train two classifiers in Chinese and English in a co-training way, which exploits unlabeled Chinese data to implement better implicit DRR for Chinese. Experimental results demonstrate the effectiveness of our method.
To reduce the transmission cost in 5G multicast networks that have separate control and data planes, we focus on the minimum-power-cost network-coding subgraph problem for the coexistence of two multicasts in wireless networks. We propose two suboptimal algorithms as extensions of the Steiner tree multicast. The critical 1-cut path eliminating (C1CPE) algorithm attempts to find the minimum-cost solution for the coexistence of two multicast trees with the same throughput by reusing the links in the topology, and keeps the solution decodable by a coloring process. For the special case in which the two multicast trees share the same source and destinations, we propose the extended selective closest terminal first (E-SCTF) algorithm out of the C1CPE algorithm. Theoretically the complexity of the E-SCTF algorithm is lower than that of the C1CPE algorithm. Simulation results show that both algorithms have superior performance in terms of power cost and that the advantage is more evident in networks with ultra-densification.
This paper discusses transmission performance and power allocation strategies in an underlay cognitive radio (CR) network that contains relay and massive multi-input multi-output (MIMO). The downlink transmission performance of a relay-aided massive MIMO network without CR is derived. By using the power distribution criteria, the kth user’s asymptotic signal to interference and noise ratio (SINR) is independent of fast fading. When the ratio between the base station (BS) antennas and the relay antennas becomes large enough, the transmission performance of the whole system is independent of BS-to-relay channel parameters and relates only to the relay-to-users stage. Then cognitive transmission performances of primary users (PUs) and secondary users (SUs) in an underlay CR network with massive MIMO are derived under perfect and imperfect channel state information (CSI), including the end-to-end SINR and achievable sum rate. When the numbers of primary base station (PBS) antennas, secondary base station (SBS) antennas, and relay antennas become infinite, the asymptotic SINR of the kth PU and SU is independent of fast fading. The interference between the primary network and secondary network can be canceled asymptotically. Transmission performance does not include the interference temperature. The secondary network can use its peak power to transmit signals without causing any interference to the primary network. Interestingly, when the antenna ratio becomes large enough, the asymptotic sum rate equals half of the rate of a single-hop single-antenna K-user system without fast fading. Next, the PUs’ utility function is defined. The optimal relay power is derived to maximize the utility function. The numerical results verify our analysis. The relationships between the transmission rate and the antenna number, relay power, and antenna ratio are simulated. We show that the massive MIMO with linear pre-coding can mitigate asymptotically the interference in a multi-user underlay CR network. The primary and secondary networks can operate independently.
A spacecraft’s separation parameters directly affect its flying trace. If the parameters exceed their limits, it will be difficult to adjust the flying attitude of the spacecraft, and the spacescraft may go off-track or crash. In this paper, we present a composite optimization method, which combines angular velocities with external moments for separation parameters of large-eccentricity pico-satellites. By changing the positions of elastic launch devices, the method effectively controls the popping process under the condition of less change in the separation mechanism. Finally, the reasons for deviation of angular velocities and unreliable optimization results are presented and analyzed. This optimization method is proved through a ground test which offsets the gravity. Simulation and test results show that the optimization method can effectively optimize the separation parameters of large-eccentricity pico-satellites. The proposed method adapts particularly to the fixed and non-stable status elastic parameters, the distribution of all kinds of elastic devices, and large-eccentricity spacecrafts for which attitude corrections are difficult. It is generally applicable and easy to operate in practical applications.