An investigation of byte n-gram features for malware classification

Malware classification using machine learning algorithms is a difficult task, in part due to the absence of strong natural features in raw executable binary files. Byte n-grams previously have been used as features, but little work has been done to explain their performance or to understand what concepts are actually being learned. In contrast to other work using n-gram features, in this work we use orders of magnitude more data, and we perform feature selection during model building using Elastic-Net regularized Logistic Regression. We compute a regularization path and analyze novel multi-byte identifiers. Through this process, we discover significant previously unreported issues with byte n-gram features that cause their benefits and practicality to be overestimated. Three primary issues emerged from our work. First, we discovered a flaw in how previous corpora were created that leads to an over-estimation of classification accuracy. Second, we discovered that most of the information contained in n-grams stem from string features that could be obtained in simpler ways. Finally, we demonstrate that n-gram features promote overfitting, even with linear models and extreme regularization.     

Sleeping on the Job: Energy-Efficient and Robust Broadcast for Radio Networks

We address the problem of minimizing power consumption when broadcasting a message from one node to all the other nodes in a radio network. To enable power savings for such a problem, we introduce a compelling new data streaming problem which we call the Bad Santa problem. Our results on this problem apply for any situation where: (1) a node can listen to a set of n nodes, out of which at least half are non-faulty and know the correct message; and (2) each of these n nodes sends according to some predetermined schedule which assigns each of them its own unique time slot. In this situation, we show that in order to receive the correct message with probability 1, it is necessary and sufficient for the listening node to listen to a \(\Theta(\sqrt{n})\) expected number of time slots. Moreover, if we allow for repetitions of transmissions so that each sending node sends the message O(log?^? n) times (i.e. in O(log?^? n) rounds each consisting of the n time slots), then listening to O(log?^? n) expected number of time slots suffices. We show that this is near optimal.We describe an application of our result to the popular grid model for a radio network. Each node in the network is located on a point in a two dimensional grid, and whenever a node sends a message m, all awake nodes within L _∞ distance r receive m. In this model, up to \(t<\frac{r}{2}(2r+1)\) nodes within any 2r+1 by 2r+1 square in the grid can suffer Byzantine faults. Moreover, we assume that the nodes that suffer Byzantine faults are chosen and controlled by an adversary that knows everything except for the random bits of each non-faulty node. This type of adversary models worst-case behavior due to malicious attacks on the network; mobile nodes moving around in the network; or static nodes losing power or ceasing to function. Let n=r(2r+1). We show how to solve the broadcast problem in this model with each node sending and receiving an expected \(O(n\log^{2}{|m|}+\sqrt{n}|m|)\) bits where |m| is the number of bits in m, and, after broadcasting a fingerprint of m, each node is awake only an expected \(O(\sqrt{n})\) time slots. Moreover, for t≤(1?ε)(r/2)(2r+1), for any constant ε>0, we can achieve an even better energy savings. In particular, if we allow each node to send O(log?^? n) times, we achieve reliable broadcast with each node sending O(nlog?²|m|+(log?^? n)|m|) bits and receiving an expected O(nlog?²|m|+(log?^? n)|m|) bits and, after broadcasting a fingerprint of m, each node is awake for only an expected O(log?^? n) time slots. Our results compare favorably with previous protocols that required each node to send Θ(|m|) bits, receive Θ(n|m|) bits and be awake for Θ(n) time slots.     

Characterization of fecal concentrations in human and other animal sources by physical,culture-based,and quantitative real-time PCR methods

The characteristics of fecal sources, and the ways in which they are measured, can profoundly influence the interpretation of which sources are contaminating a body of water. Although feces from various hosts are known to differ in mass and composition, it is not well understood how those differences compare across fecal sources and how differences depend on characterization methods. This study investigated how nine different fecal characterization methods provide different measures of fecal concentration in water, and how results varied across twelve different fecal pollution sources. Sources investigated included chicken, cow, deer, dog, goose, gull, horse, human, pig, pigeon, septage and sewage. A composite fecal slurry was prepared for each source by mixing feces from 6 to 22 individual samples with artificial freshwater. Fecal concentrations were estimated by physical (wet fecal mass added and total DNA mass extracted), culture-based (Escherichia coli and enterococci by membrane filtration and defined substrate), and quantitative real-time PCR (Bacteroidales, E. coli, and enterococci) characterization methods. The characteristics of each composite fecal slurry and the relationships between physical, culture-based and qPCR-based characteristics varied within and among different fecal sources. An in silico exercise was performed to assess how different characterization methods can impact identification of the dominant fecal pollution source in a mixed source sample. A comparison of simulated 10:90 mixtures based on enterococci by defined substrate predicted a source reversal in 27% of all possible combinations, while mixtures based on E. coli membrane filtration resulted in a reversal 29% of the time. This potential for disagreement in minor or dominant source identification based on different methods of measurement represents an important challenge for water quality managers and researchers.     

Detailed Specifications for Global Heat Treatment Sourcing and Materials

The very nature of global sourcing means that components must carry clear and detailed specifications for material, heat treatment, and test methods. Qualified global heat treat facilities can achieve good control of not only the common features such as surface and gradient hardness, but also of microstructure, core hardness, residual stress, and other critical metallurgical parameters. This paper will discuss a new concept for material specifications and more detailed heat treatment specifications for the global marketplace.     

Psychotherapy appointment no-shows: Rates and reasons.

Patients who frequently miss or do not show for their scheduled psychotherapy appointments create administrative and clinical difficulties, and may not be receiving effective treatment. Prior research has predominately focused on either identifying demographic and administrative factors related to patient no-show rates or evaluating the effectiveness of administrative procedures for reducing no-shows. This paper attempts to identify rates of missed appointments in clinical practice and explore more specific clinical process factors related to patient no-shows. Psychotherapists (N = 24) and their patients (N = 542) in the outpatient department of a public safety-net hospital were surveyed to examine how frequently patients missed scheduled psychotherapy appointments and for what reasons. Findings indicate that the majority of missed appointments were accounted for by patients with occasional absences (approx. 1 per month), while only a small percentage of patients missed appointments with high frequency. Patients missed their psychotherapy appointments for a number of reasons, including clinical symptoms, practical matters, motivational concerns, and negative treatment reactions. (PsycINFO Database Record (c) 2010 APA, all rights reserved)     

The effect of solidification direction with respect to gravity on ice-templated TiO2 microstructures

Unidirectional ice-templating produces materials with aligned, elongated pores via: (i) directional solidification of particle suspensions wherein suspended particles are rejected and incorporated between aligned dendrites, (ii) sublimation of the solidified fluid, and (iii) sintering of the particles into elongated walls which are templated by the ice dendrites. Most ice-templating studies utilize upward solidification techniques, where solid ice is located at the bottom of the solidification mold (closest to the cold source), the liquid suspension is above the ice, and the solidification front advances upward, against gravity. Liquid water reaches its maximum density at 4 °C; thus, liquid nearest the solid/liquid interface, at 0ºC, is less dense than warmer liquid above (up to 4 °C, above which, a density inversion occurs, and liquid density decreases with increasing temperature). The lower density liquid nearest the solidification front is thus expected to rise due to buoyancy, promoting convective fluid motion in the liquid during solidification. Here, we investigate the effect of solidification direction with respect to the direction of gravity on ice-templated microstructures to study the role of buoyancy-driven fluid motion during solidification. We hypothesize that, for upward solidification, the convective fluid motion that results from the liquid density gradient occurs near the solidification front. For downward solidification, we expect that this fluid motion occurs farther away from the solidification front. Aqueous suspensions of TiO₂ nanoparticles (10–30 nm in size, 10, 15, and 21 vol.%) are solidified upward (against gravity, with ice on bottom and water on top), downward (water on bottom, ice on top), and horizontally (perpendicular to gravity). Microstructural investigation of sintered samples shows evidence of buoyancy-driven, convective fluid flow during solidification for samples solidified upwards (against gravity), including (i) tilting of the wall (and pore) orientation with respect to the induced temperature gradient, (ii) ice lens defects (cracks oriented perpendicular to the freezing direction), and (iii) radial macrosegregation. These features are not observed for downward nor horizontal solidification configurations, consistent with the hypothesis that convective fluid motion does not interact directly with the solidification front for downward solidification.     

Structural brain correlates of verbal and nonverbal fluency measures in Alzheimer's disease.

This study examined the relationships between regional brain volumes and semantic, phonological, and nonverbal fluency in 32 participants with Alzheimer's disease (AD). Object but not animal semantic fluency correlated with frontal and temporal gray matter volumes. Phonological fluency was not significantly associated with any brain volume examined. Nonverbal fluency was selectively associated with bilateral frontal gray matter volumes. Hippocampal volumes, although markedly reduced in these patients, were not related to any of the fluency measures. Results lend evidence to the importance of the frontal lobes in the directed generation of nonverbal and verbal exemplars by AD patients. Furthermore, both left and right-hemisphere regions contribute to the generation of verbal and nonverbal exemplars. (PsycINFO Database Record (c) 2010 APA, all rights reserved)     

Literacy development in early French immersion programs.

Research findings on reading acquisition in early French immersion programs are reviewed. Findings on general reading outcomes, in English and French, are reviewed first, followed by a review of reading outcomes for students who are at risk for reading difficulty because of below-average levels of academic ability, poor first language abilities, disadvantaged socioeconomic backgrounds, and minority language status. There follows a review of studies on individual differences in reading outcomes, including research on students with or at risk for reading difficulties, and on interventions to support students with reading difficulties in immersion. Conclusions along with suggestions for future research are offered. (PsycINFO Database Record (c) 2011 APA, all rights reserved)