Constructing malware normalizers using term rewriting

A malware mutation engine is able to transform a malicious program to create a different version of the program. Such mutation engines are used at distribution sites or in self-propagating malware in order to create variation in the distributed programs. Program normalization is a way to remove variety introduced by mutation engines, and can thus simplify the problem of detecting variant strains. This paper introduces the “normalizer construction problem” (NCP), and formalizes a restricted form of the problem called “NCP=”, which assumes a model of the engine is already known in the form of a term rewriting system. It is shown that even this restricted version of the problem is undecidable. A procedure is provided that can, in certain cases, automatically solve NCP= from the model of the engine. This procedure is analyzed in conjunction with term rewriting theory to create a list of distinct classes of normalizer construction problems. These classes yield a list of possible attack vectors. Three strategies are defined for approximate solutions of NCP=, and an analysis is provided of the risks they entail. A case study using the virus suggests the approximations may be effective in practice for countering mutated malware. R. Mathur is presently at McAfee AVERT Labs.     

Direct voltammetry and catalysis with Mycobacterium tuberculosis catalase-peroxidase, peroxidases, and catalase in lipid films.

Stable films of dimyristoylphosphatidylcholine and M. tuberculosis catalase-peroxidase (KatG), several peroxidases, myoglobin, and catalase showed reversible FeIII/FeII voltammetry on pyrolytic graphite electrodes and catalytic current for hydrogen peroxide and oxygen. Amperometric responses for these films to H2O2 at 0 V are likely to contain significant contributions from catalytic reduction of oxygen produced during the catalytic cycles. Relative apparent turnover rates at pH 6 based on steady-state currents at 0 V versus SCE in the presence of H2O2 were in the order horseradish peroxidase > cytochrome c peroxidase (CcP) > soybean peroxidase > myoglobin > KatG > catalase. Lower currents for the very efficient peroxide scavengers KatG and catalase may be related to the instability of their compounds I in the presence of H2O2. KatG catalyzed the electrochemical reduction of oxygen more efficiently than catalase and CcP but less efficiently than the other peroxidases. DMPC films incorporating glucose oxidase and peroxidases gave good analytical responses to glucose, demonstrating the feasibility of dual enzyme-lipid films for biosensor fabrication.     

A direct algebraic method for eigensolution sensitivity computation of damped asymmetric systems

In general, the derivative of an eigenvector of a vibrating symmetric system is the solution of a singular problem. Further complications are encountered in dealing with asymmetric damped systems for which the left and right eigenvectors and their derivatives become distinct and complex. Several approaches have been proposed to overcome this singularity such as Nelson's method and the modal method. In the present work, a new approach is presented for calculating simultaneously the derivatives of the eigenvalues and their associated derivatives of the left and right eigenvectors for asymmetric damped systems. With the proposed method, the exact eigenderivatives can be obtained by solving a first‐order linear algebraic system of equations. The method is applied on a 104 DOF ventilator–rotor system, which is used as an example of an asymmetric damped system with distinct eigenvalues. The diameter of the shaft has been chosen as the design parameter. The comparison of the computational time shows that the proposed method is more efficient than both Nelson's approach and the modal method. Copyright © 2006 John Wiley & Sons, Ltd.     

Natural occurrence of ochratoxin A in Tunisian cereals

Ochratoxin A (OTA) is a mycotoxin produced by several fungal species from Aspergillus and Penicillium genera. It is widespread in food and feed and its occurrence has been reported in cereals, cereal-derived products, dried fruits and spices. This mycotoxin was implicated in several human and animal pathologies such as the Balkan Endemic Nephropathy (BEN) and the Tunisian Chronic Interstitial Nephropathy (CIN) of unknown cause. In Tunisia, a clear correlation has been established between the consumption of OTA contaminated food and the induction of specific pathologies. Thereby, OTA was detected in human blood and tissues. The aim of our study was to investigate the presence of OTA in widely consumed cereals commercialized in Tunisia. The analytical methods used in our study involved the extraction of OTA by acidified toluene, immunoaffinity (IAC) clean-up and HPLC quantification with fluorescence detection. Levels and percentages of OTA contamination in different types of cereals, 110 wheat, 103 barley, 113 sorghum and 96 rice samples, were evaluated with incidences of 38%, 40%, 38% and 28%, respectively. The average of contamination by OTA found were 55, 96, 44 and 117 μg/kg, respectively, for wheat, barley, rice and sorghum. Our results showed that contamination percentages and levels in the period from 2004 to 2005 were higher then usual norms (5.0 μg OTA/kg) established by the European commission in 2002. The present report is the first one ever carried out on the natural occurrence of OTA in cereals, largely consumed by the Tunisian population.     

Microstructural analysis of low Ni content Zn alloy electrodeposited under applied magnetic field

The codeposition behaviour of Zn and Ni has been studied in sulphate electrolytes in presence of a superimposed magnetic field up to 1 T parallel to the surface. Structural analysis by X-Ray diffraction (XRD) method revealed that the alloys consisted of a mixture of zinc, η-phase and γ-phase. The results showed that the magnetic field B was responsible for variations of the alloy structural parameters (lattice imperfection and texture) for low pH. When the pH of electrolyte was increased, the effect of the magnetic field was erased. It was suggested that the preferential growth direction of Zn-Ni alloy was induced by the mass-transport enhancement of H⁺ ions promoted by B which induced an increase of the pH near the cathode. Then, for high value of pH up to 3.5, the crystallographic orientation (101) of Zn was always favoured to the prejudice of the Ni₅Zn₂₁ phase.     

Diagnosis of Partially Observed Petri Net Based on Analytical Redundancy Relationships

In this paper, we design an efficient diagnosis technique for partially observed discrete event systems modeled by labeled Petri nets. The fault detection is based on analytical redundancy relationships derived from the nominal model. The decomposition of the T_un‐induced subnet to connected subgraphs allows determining the subgraphs that may contain faults. To appreciate the fault localization, a set of analytical redundancy relationships is etablished for each fault transition based on the fault model. The proposed diagnosis approach is independent of the length of the observed sequence and independent of the number of unobservable transitions. The detected faults with the proposed approach are faults which led to a change in the number of tokens in the net.     

3D face verification across pose based on euler rotation and tensors

In this paper, we propose a new approach for 3D face verification based on tensor representation. Face challenges, such as illumination, expression and pose, are modeled as a multilinear algebra problem where facial images are represented as high order tensors. Particularly, to account for head pose variations, several pose scans are generated from a single depth image using Euler transformation. Multi-bloc local phase quantization (MB-LPQ) histogram features are extracted from depth face images and arranged as a third order tensor. The dimensionality of the tensor is reduced based on the higher-order singular value decomposition (HOSVD). HOSVD projects the input tensor in a new subspace in which the dimension of each tensor mode is reduced. To discriminate faces of different persons, we utilize the Enhanced Fisher Model (EFM). Experimental evaluations on CASIA-3D database, which contains large head pose variations, demonstrate the effectiveness of the proposed approach. A verification rate of 98.60% is obtained.     

Detecting machine-morphed malware variants via engine attribution

One method malware authors use to defeat detection of their programs is to use morphing engines to rapidly generate a large number of variants. Inspired by previous works in author attribution of natural language text, we investigate a problem of attributing a malware to a morphing engine. Specifically, we present the malware engine attribution problem and formally define its three variations: MVRP, DENSITY and GEN, that reflect the challenges malware analysts face nowadays. We design and implement heuristics to address these problems and show their effectiveness on a set of well-known malware morphing engines and a real-world malware collection reaching detection accuracies of 96 % and higher. Our experiments confirm the applicability of the proposed approach in practice and indicate that engine attribution may offer a viable enhancement of current defenses against malware.     

Polymorphism in the tumor necrosis factor-alpha promotor region and in the heat shock protein 70 genes associated with malignant tumors

BACKGROUND: Tumor necrosis factors (TNFs) and heat shock protein 70 (hsp70) are determining factors in immunologic mechanisms to tumor cells. The authors designed a case-controlled study to investigate the potential association of the polymorphisms of TNF-alpha and of hsp70-2 and hsp70-hom genes with malignant tumors. METHODS: The authors used an allele specific polymerase chain reaction to characterize the variation of the TNF-alpha promotor region in 124 unrelated Tunisian patients with malignant tumors (non-Hodgkin's lymphoma, breast carcinoma, and other tumors) and 106 healthy control subjects. Using polymerase chain reaction and restriction enzyme digestion, polymorphic analysis of hsp70-2 and hsp70-hom genes was performed in patients with non-Hodgkin's lymphoma, in those with breast carcinoma, and in control subjects. RESULTS: Analysis of TNF-alpha polymorphism in patients with malignant tumors and in control subjects demonstrated a high relative frequency of the TNF2 allele in the cancer patients. The relative risk (RR) of lymphoma was especially high in association with TNF1/TNF2 heterozygotes (RR = 6.7; P < or = 0.0001). Polymorphism analysis of the hsp70-2 and hsp70-hom genes in patients with lymphoma and in those with breast carcinoma revealed that these patients had highly significant differences in the genotypic distribution of these biallelic loci compared with the control subjects. Homozygosity for one hsp70-2 allele was significantly associated with lymphoma (RR = 18.2; P < or = 0.0001) and with breast carcinoma (RR = 16.3; P < or = 0.001). CONCLUSIONS: Tunisian persons carrying the TNF2 allele may have an increased risk of cancer. In this study, non-Hodgkin's lymphoma and breast carcinoma were significantly associated with polymorphism in hsp70 genes.