Filter-resistant code injection on ARM

Code injection attacks are one of the most powerful and important classes of attacks on software. In these attacks, the attacker sends malicious input to a software application, where it is stored in memory. The malicious input is chosen in such a way that its representation in memory is also a valid representation of a machine code program that performs actions chosen by the attacker. The attacker then triggers a bug in the application to divert the control flow to this injected machine code. A typical action of the injected code is to launch a command interpreter shell, and hence the malicious input is often called shellcode. Attacks are usually performed against network facing applications, and such applications often perform validations or encodings on input. Hence, a typical hurdle for attackers, is that the shellcode has to pass one or more filtering methods before it is stored in the vulnerable application??s memory space. Clearly, for a code injection attack to succeed, the malicious input must survive such validations and transformations. Alphanumeric input (consisting only of letters and digits) is typically very robust for this purpose: it passes most filters and is untouched by most transformations. This paper studies the power of alphanumeric shellcode on the ARM architecture. It shows that the subset of ARM machine code programs that (when interpreted as data) consist only of alphanumerical characters is a Turing complete subset. This is a non-trivial result, as the number of instructions that consist only of alphanumeric characters is very limited. To craft useful exploit code (and to achieve Turing completeness), several tricks are needed, including the use of self-modifying code.     

Throughput optimization in two-machine flowshops with flexible operations

In this study, a two-machine flowshop producing identical parts is considered. Each of the identical parts is assumed to require a number of manufacturing operations, and the machines are assumed to be flexible enough to perform different operations. Due to economical or technological constraints, some specific operations are preassigned to one of the machines. The remaining operations, called flexible operations, can be performed on either one of the machines, so that the same flexible operation can be performed on different machines for different parts. The problem is to determine the assignment of the flexible operations to the machines for each part, with the objective of maximizing the throughput rate. We consider various cases regarding the number of parts to be produced and the capacity of the buffer between the machines. We present solution methods for each variant of the problem.     

Solving subgraph isomorphism problems with constraint programming

The subgraph isomorphism problem consists in deciding if there exists a copy of a pattern graph in a target graph. We introduce in this paper a global constraint and an associated filtering algorithm to solve this problem within the context of constraint programming. The main idea of the filtering algorithm is to label every node with respect to its relationships with other nodes of the graph, and to define a partial order on these labels in order to express compatibility of labels for subgraph isomorphism. This partial order over labels is used to filter domains. Labelings can also be strengthened by adding information from the labels of neighbors. Such a strengthening can be applied iteratively until a fixpoint is reached. Practical experiments illustrate that our new filtering approach is more effective on difficult instances of scale free graphs than state-of-the-art algorithms and other constraint programming approaches.     

Pollution source identification using a coupled diffusion model with a genetic algorithm

A new approach for the source quantification has been developed on the basis of real air pollutant hourly concentrations of SO₂, measured by three monitoring stations, during 9 h, around a group of three industrial sources. This inverse problem has been solved by coupling a direct model of diffusion (Pasquill’s Gaussian model) with a genetic algorithm, to search solutions leading to a minimum error between model outputs and measurements. The inversion performance depends on the relationship between the wind field and the configuration sources–receptors: good results are obtained when the monitoring stations are downwind from the sources, and in these cases, the order of magnitude of emissions is retrieved, sometimes with less than 10% error for at least two sources; there are some configurations (wind direction versus source and receptor locations) which do not permit to restore emissions. The latter situations reveal the need to conceive a specific network of sensors, taking into account the source locations and the most frequent weather patterns.     

Time‐Series Plots Integrated in Parallel‐Coordinates Displays

We present a natural extension of two‐dimensional parallel‐coordinates plots for revealing relationships in time‐dependent multi‐attribute data by building on the idea that time can be considered as the third dimension. A time slice through the visualization represents a certain point in time and can be viewed as a regular parallel‐coordinates display. A vertical slice through one of the axes of the parallel‐coordinates display would show a time‐series plot. For a focus‐and‐context Integration of both views, we embed time‐series plots between two adjacent axes of the parallel‐coordinates plot. Both time‐series plots are drawn using a pseudo three‐dimensional perspective with a single vanishing point. An independent parallel‐coordinates panel that connects the two perspectively displayed time‐series plots can move forward and backward in time to reveal changes in the relationship between the time‐dependent attributes. The visualization of time‐series plots in the context of the parallel‐coordinates plot facilitates the exploration of time‐related aspects of the data without the need to switch to a separate display. We provide a consistent set of tools for selecting and contrasting subsets of the data, which are important for various application domains.     

A method to select a successful interoperability solution through a simulation approach

Enterprise applications and software systems need to be interoperable in order to achieve seamless business across organizational boundaries and thus realize virtual networked organizations. Our proposition can be considered as an interoperability project selection approach and is based on three steps: (1) Modelling both collaborative business processes and potential related interoperability projects; (2) Evaluating the accessibility of each project regarding the current state of the organization; (3) Simulating each project and assessing the associated performance. These results are finally projected on a comparison matrix used as a decision support to select the most appropriate interoperability solution. An application case extracted from the French aerospace sector demonstrates the applicability and the benefits of the proposition.     

Static worksharing strategies for heterogeneous computers with unrecoverable interruptions

One has a large computational workload that is “divisible” (its constituent tasks’ granularity can be adjusted arbitrarily) and one has access to p remote computers that can assist in computing the workload. How can one best utilize the computers? Two features complicate this question. First, the remote computers may differ from one another in speed. Second, each remote computer is subject to interruptions of known likelihood that kill all work in progress on it. One wishes to orchestrate sharing the workload with the remote computers in a way that maximizes the expected amount of work completed. We deal with three versions of this problem. The simplest version ignores communication costs but allows computers to differ in speed (a heterogeneous set of computers). The other two versions account for communication costs, first with identical remote computers (a homogeneous set of computers), and then with computers that may differ in speed. We provide exact expressions for the optimal work expectation for all three versions of the problem - via explicit closed-form expressions for the first two versions, and via a recurrence that computes this optimal value for the last, most general version.     

Digital microfluidic design and optimization of classic and new fluidic functions for lab on a chip systems

This paper deals with microfluidic studies for lab-on-a-chip development. The first goal was to develop microsystems immediately usable by biologists for complex protocol integrations. All fluid operations are performed on nano-liter droplet independently handled solely by electrowetting on dielectric (EWOD) actuation. A bottom-up architecture was used for chip design due to the development and validation of elementary fluidic designs, which are then assembled. This approach speeds up development and industrialization while minimizing the effort in designing and simplifying chip-fluidic programming. Dispensing reproducibility for 64 nl droplets obtained a CV below 3% and mixing time was only a few seconds. Ease of the integration was demonstrated by performing on chip serial dilutions of 2.8-folds, four times. The second part of this paper concerns the development of new innovative fluidic functions in order to extend EWOD-actuated digital fluidics’ capabilities. Experiments of particle dispensing by EWOD droplet handling are reported. Finally, work is shown concerning the coupling of EWOD actuation and magnetic fields for magnetic bead manipulation.     

Goal Change in the Situation Calculus

Although there has been much discussion of belief change (e.g.[4, 21]), goal change has not received much attention. In thispaper, we propose a method for goal change in the frameworkof Reiter's; [12] theory of action in the situation calculus[8, 10], and investigate its properties. We extend the frameworkdeveloped by Shapiro et al. [17] and Shapiro and Lespérance[16], where goals and goal expansion were modelled, but goalcontraction was not.