首页 | 本学科首页   官方微博 | 高级检索  
相似文献
 共查询到20条相似文献,搜索用时 31 毫秒
1.
2.

This article addresses a new pattern mining problem in time series sensor data, which we call correlated attribute pattern mining. The correlated attribute patterns (CAPs for short) are the sets of attributes (e.g., temperature and traffic volume) on sensors that are spatially close to each other and temporally correlated in their measurements. Although the CAPs are useful to accurately analyze and understand spatio-temporal correlation between attributes, the existing mining methods are inefficient to discover CAPs because they extract unnecessary patterns. Therefore, we propose a mining method Miscela to efficiently discover CAPs. Miscela can discover not only simultaneous correlated patterns but also time delayed correlated patterns. Furthermore, we extend Miscela to automatically search for correlated patterns with any time delays. Through our experiments using three real sensor datasets, we show that the response time of Miscela is up to 20.84 times faster compared with the state-of-the-art method. We show that Miscela discovers meaningful patterns for urban managements and environmental studies.

  相似文献   

3.
Zhu  Hui-Juan  Jiang  Tong-Hai  Ma  Bo  You  Zhu-Hong  Shi  Wei-Lei  Cheng  Li 《Neural computing & applications》2018,30(11):3353-3361

Mobile phones are rapidly becoming the most widespread and popular form of communication; thus, they are also the most important attack target of malware. The amount of malware in mobile phones is increasing exponentially and poses a serious security threat. Google’s Android is the most popular smart phone platforms in the world and the mechanisms of permission declaration access control cannot identify the malware. In this paper, we proposed an ensemble machine learning system for the detection of malware on Android devices. More specifically, four groups of features including permissions, monitoring system events, sensitive API and permission rate are extracted to characterize each Android application (app). Then an ensemble random forest classifier is learned to detect whether an app is potentially malicious or not. The performance of our proposed method is evaluated on the actual data set using tenfold cross-validation. The experimental results demonstrate that the proposed method can achieve a highly accuracy of 89.91%. For further assessing the performance of our method, we compared it with the state-of-the-art support vector machine classifier. Comparison results demonstrate that the proposed method is extremely promising and could provide a cost-effective alternative for Android malware detection.

  相似文献   

4.
针对Android恶意软件持续大幅增加的现状以及恶意软件检测能力不足这一问题,提出了一种基于非用户操作序列的静态检测方法。首先,通过对恶意软件进行逆向工程分析,提取出恶意软件的应用程序编程接口(API)调用信息;然后,采用广度优先遍历算法构建恶意软件的函数调用流程图;进而,从函数流程图中提取出其中的非用户操作序列形成恶意行为库;最后,采用编辑距离算法计算待检测样本与恶意行为库中的非用户操作序列的相似度进行恶意软件识别。在对360个恶意样本和300的正常样本进行的检测中,所提方法可达到90.8%的召回率和90.3%的正确率。与Android恶意软件检测系统Androguard相比,所提方法在恶意样本检测中召回率提高了30个百分点;与FlowDroid方法相比,所提方法在正常样本检测中准确率提高了11个百分点,在恶意样本检测中召回率提高了4.4个百分点。实验结果表明,所提方法提高了恶意软件检测的召回率,有效提升恶意软件的检测效果。  相似文献   

5.

We present Wolverine2, an integrated Debug-Localize-Repair environment for heap manipulating programs. Wolverine2 provides an interactive debugging environment: while concretely executing a program via on an interactive shell supporting common debugging facilities, Wolverine2 displays the abstract program states (as box-and-arrow diagrams) as a visual aid to the programmer, packages a novel, proof-directed repair algorithm to quickly synthesize the repair patches and a new bug localization algorithm to reduce the search space of repairs. Wolverine2 supports “hot-patching” of the generated patches to provide a seamless debugging environment, and also facilitates new debug-localize-repair possibilities: specification refinement and checkpoint-based hopping. We evaluate Wolverine2 on 6400 buggy programs (generated using automated fault injection) on a variety of data-structures like singly, doubly, and circular linked lists, AVL trees, Red-Black trees, Splay Trees and Binary Search Trees; Wolverine2 could repair all the buggy instances within realistic programmer wait-time (less than 5 s in most cases). Wolverine2 could also repair more than 80% of the 247 (buggy) student submissions where a reasonable attempt was made.

  相似文献   

6.

ProB provides a constraint solver for the B-method written in Prolog and can make use of different backends based on SAT and SMT solving. One such backend translates B and Event-B operators to SMT-LIB using the Z3 solver. This translation uses quantifiers to axiomatize some operators, which are not well-handled by Z3. Several relational constraints such as the transitive closure are not supported by this translation. In this article, we substantially improve the translation to SMT-LIB by employing a more constructive rather than axiomatized style using Z3’s lambda function. Thereby, we are able both to translate more B and Event-B operators to SMT-LIB and improve the overall performance. We further extend ProB’s interface to Z3 to run different solver configurations in parallel. In addition, we present a direct implementation of SMT solving in Prolog using ProB’s constraint solver as a theory solver. We hereby aim to combine the strengths of conflict-driven clause learning for identifying contradictions with ProB’s constraint solver for finding solutions. We deem this implementation to be worthwhile since ProB’s constraint solver is tailored toward solving B and Event-B constraints, and we herewith avoid the dependency on an external SMT solver. Empirical results show that the new integration of Z3 has improved performance of constraint solving and enables to solve several constraints which cannot be solved by ProB’s constraint solver. Furthermore, the direct implementation of SMT solving in ProB shows benefits compared to ProB’s constraint solver and the integration of Z3.

  相似文献   

7.
当前大量的Android恶意软件在后台收集用户的位置信息、通话记录、电话号码及短信等信息并将其上传至指定服务器,造成了难以估量的危害。为解决此问题,提出一种Android恶意软件静态检测方法。对收集到的训练集中的所有APK文件进行静态反编译,提取其中的静态信息;对静态信息中的API和Permission进行统计学分析,得到API和Permission在恶意APK和正常APK中的使用率;根据它们的使用率确定基准API和Permission集合,将每一个APK转换成可参与计算的关于API和Permission的特征向量;利用改进的k-NN分类器,对待检测的APK进行分类判定。实验结果表明,该方法可以有效地对APK进行恶意分类。  相似文献   

8.

Conflict detection is used in various scenarios ranging from interactive decision making (e.g., knowledge-based configuration) to the diagnosis of potentially faulty models (e.g., using knowledge base analysis operations). Conflicts can be regarded as sets of restrictions (constraints) causing an inconsistency. Junker’s QuickXPlain is a divide-and-conquer based algorithm for the detection of preferred minimal conflicts. In this article, we present a novel approach to the detection of such conflicts which is based on speculative programming. We introduce a parallelization of QuickXPlain and empirically evaluate this approach on the basis of synthesized knowledge bases representing feature models. The results of this evaluation show significant performance improvements in the parallelized QuickXPlain version.

  相似文献   

9.
Kocev  Dragi  Ceci  Michelangelo  Stepišnik  Tomaž 《Machine Learning》2020,109(11):2213-2241

We address the task of learning ensembles of predictive models for structured output prediction (SOP). We focus on three SOP tasks: multi-target regression (MTR), multi-label classification (MLC) and hierarchical multi-label classification (HMC). In contrast to standard classification and regression, where the output is a single (discrete or continuous) variable, in SOP the output is a data structure—a tuple of continuous variables MTR, a tuple of binary variables MLC or a tuple of binary variables with hierarchical dependencies (HMC). SOP is gaining increasing interest in the research community due to its applicability in a variety of practically relevant domains. In this context, we consider the Extra-Tree ensemble learning method—the overall top performer in the DREAM4 and DREAM5 challenges for gene network reconstruction. We extend this method for SOP tasks and call the extension Extra-PCTs ensembles. As base predictive models we propose using predictive clustering trees (PCTs)–a generalization of decision trees for predicting structured outputs. We conduct a comprehensive experimental evaluation of the proposed method on a collection of 41 benchmark datasets: 21 for MTR, 10 for MLC and 10 for HMC. We first investigate the influence of the size of the ensemble and the size of the feature subset considered at each node. We then compare the performance of Extra-PCTs to other ensemble methods (random forests and bagging), as well as to single PCTs. The experimental evaluation reveals that the Extra-PCTs achieve optimal performance in terms of predictive power and computational cost, with 50 base predictive models across the three tasks. The recommended values for feature subset sizes vary across the tasks, and also depend on whether the dataset contains only binary and/or sparse attributes. The Extra-PCTs give better predictive performance than a single tree (the differences are typically statistically significant). Moreover, the Extra-PCTs are the best performing ensemble method (except for the MLC task, where performances are similar to those of random forests), and Extra-PCTs can be used to learn good feature rankings for all of the tasks considered here.

  相似文献   

10.

Verification techniques are well-suited for automatic test-case generation. They basically need to check the reachability of every test goal and generate test cases for all reachable goals. This is also the basic idea of our CoVeriTest submission. However, the set of test goals is not fixed in CoVeriTest , instead we can configure the set of test goals. For Test-Comp’19, we support the set of all __VERIFIER_error() calls as well as the set of all branches. Thus, we can deal with the two test specifications considered in Test-Comp’19. Since the tasks in Test-Comp are diverse and verification techniques have different strengths and weaknesses, we also do not stick to a single verification technique, but use a hybrid approach that combines multiple techniques. More concrete, CoVeriTest interleaves different verification techniques and allows to configure the cooperation (i.e., information exchange and time limits). To choose from a large set of verification techniques, CoVeriTest is integrated into the analysis framework CPAchecker. For the competition, we interleave CPAchecker’s value and predicate analysis and let both analyses resume their analysis performed in the previous iteration.

  相似文献   

11.
吴月明  齐蒙  邹德清  金海 《软件学报》2023,34(6):2526-2542
自安卓发布以来,由于其开源、硬件丰富和应用市场多样等优势,安卓系统已经成为全球使用最广泛的手机操作系统。同时,安卓设备和安卓应用的爆炸式增长也使其成为96%移动恶意软件的攻击目标。现存的安卓恶意软件检测方法中,忽视程序语义而直接提取简单程序特征的方法检测速度快但精确度不理想,将程序语义转换为图模型并采用图分析的方法精确度高但开销大且扩展性低。为了解决上述挑战,本文将应用的程序语义提取为函数调用图,保留语义信息的同时采用抽象API技术将调用图转换为抽象图以减少运行开销并增强鲁棒性。基于得到的抽象图,以Triplet Loss损失训练构建基于图卷积神经网络的抗混淆安卓恶意软件分类器SriDroid。对20246个安卓应用进行实验分析之后,发现SriDroid可以达到99.17%的恶意软件检测精确度,并具有良好的鲁棒性。  相似文献   

12.
面对不断涌现的安卓恶意应用,虽然大量研究工作采用图神经网络分析代码图实现了准确高效的恶意应用检测,但由于未提供应用内恶意代码的具体位置信息,难以对后续的人工复核工作提供有效帮助.可解释技术的出现为此问题提供了灵活的解决方法,在基于不同类型神经网络及代码特征表示实现的检测模型上展示出了较好的应用前景.本研究聚焦于基于图神经网络的安卓恶意代码检测模型上,使用可解释技术实现安卓恶意代码的准确定位:(1)提出了基于敏感API及多关系图特征的敏感子图提取方法.根据敏感API,控制流逻辑以及函数调用结构三类特征与恶意代码子图分布的关联性,细致刻画恶意代码特征,精简可解释技术关注的代码图规模;(2)提出了基于敏感子图输入的可解释技术定位方法.使用基于扰动原理的可解释技术,在不改变检测模型结构的情况下对代码图边缘进行恶意性评分,为各类基于图神经网络安卓恶意代码检测提供解释定位;(3)设计实验验证敏感子图提取对于与恶意代码特征的刻画效果以及基于敏感子图提取的解释定位效果.实验结果显示,本文的敏感子图提取方法相较于MsDroid固定子图半径的方法更为精确,能够为可解释技术提供高质量的输入;基于此方法改进后得到的可解释技术定位方法相较于GNNExplainer通用解释器及MsDroid定位方法,在保证定位适用性和效率的同时,恶意代码平均定位准确率分别提高了8.8%和2.7%.  相似文献   

13.
为了提高Android恶意应用检测效率,将二值粒子群算法(BPSO,Binary Particle Swarm Optimization)用于原始特征全集的优化选择,并结合朴素贝叶斯(NB,Nave Bayesian)分类算法,提出一种基于BPSO-NB的Android恶意应用检测方法。该方法首先对未知应用进行静态分析,提取AndroidManifest.xml文件中的权限信息作为特征。然后,采用BPSO算法优化选择分类特征,并使用NB算法的分类精度作为评价函数。最后采用NB分类算法构建Android恶意应用分类器。实验结果表明,通过二值粒子群优化选择分类特征可以有效提高分类精度,缩短检测时间。   相似文献   

14.

Automatic test-suite generation tools are often complex and their behavior is not predictable. To provide a minimum baseline that test-suite generators should be able to surpass, we present PRTest, a random black-box test-suite generator for C programs: To create a test, PRTest natively executes the program under test and creates a new, random test value whenever an input value is required. After execution, PRTest checks whether any new program branches were covered and, if this is the case, the created test is added to the test suite. This way, tests are rapidly created either until a crash is found, or until the user aborts the creation. While this naive mechanism is not competitive with more sophisticated, state-of-the-art test-suite generation tools, it is able to provide a good baseline for Test-Comp and a fast alternative for automatic test-suite generation for programs with simple control flow. PRTest is publicly available and open source.

  相似文献   

15.
近几年,Android平台的恶意软件数量几乎以几何式的速度增长,故提出一种恶意软件检测方法是必要的.本文利用现如今疯涨的Android恶意样本量和机器学习算法建立分类预测模型实现对恶意软件的静态检测.首先,通过反编译APK文件获取AndroidManifest.xml文件中权限特征,baksmali工具反编译class.dex成smali文件得到危险API特征.然后运用机器学习中多种分类和预处理算法比较每一特征和联合特征检测的准确率.实验结果表明,联合特征检测准确率高于单独特征,准确率达到97.5%.  相似文献   

16.

Testing is a widely applied technique to evaluate software quality, and coverage criteria are often used to assess the adequacy of a generated test suite. However, manually constructing an adequate test suite is typically too expensive, and numerous techniques for automatic test-suite generation were proposed. All of them come with different strengths. To build stronger test-generation tools, different techniques should be combined. In this paper, we study cooperative combinations of verification approaches for test generation, which exchange high-level information. We present CoVeriTest, a hybrid technique for test-suite generation. CoVeriTest iteratively applies different conditional model checkers and allows users to adjust the level of cooperation and to configure individual time limits for each conditional model checker. In our experiments, we systematically study different CoVeriTest cooperation setups, which either use combinations of explicit-state model checking and predicate abstraction, or bounded model checking and symbolic execution. A comparison with state-of-the-art test-generation tools reveals that CoVeriTest achieves higher coverage for many programs (about 15%).

  相似文献   

17.
荣俸萍  方勇  左政  刘亮 《计算机科学》2018,45(5):131-138
基于动态分析的恶意代码检测方法由于能有效对抗恶意代码的多态和代码混淆技术,而且可以检测新的未知恶意代码等,因此得到了研究者的青睐。在这种情况下,恶意代码的编写者通过在恶意代码中嵌入大量反检测功能来逃避现有恶意代码动态检测方法的检测。针对该问题,提出了基于恶意API调用序列模式挖掘的恶意代码检测方法MACSPMD。首先,使用真机模拟恶意代码的实际运行环境来获取文件的动态API调用序列;其次,引入面向目标关联挖掘的概念,以挖掘出能够代表潜在恶意行为模式的恶意API调用序列模式;最后,将挖掘到的恶意API调用序列模式作为异常行为特征进行恶意代码的检测。基于真实数据集的实验结果表明,MACSPMD对未知和逃避型恶意代码进行检测的准确率分别达到了94.55%和97.73%,比其他基于API调用数据的恶意代码检测方法 的准确率分别提高了2.47%和2.66%,且挖掘过程消耗的时间更少。因此,MACSPMD能有效检测包括逃避型在内的已知和未知恶意代码。  相似文献   

18.
针对静态检测和动态检测方式存在的问题,提出了一种基于混合方式的恶意移动应用检测方法。该方法采用静态分析和动态分析相结合的方式,通过静态分析获取权限特征和函数调用特征,通过动态分析在沙盒环境下借助于事件仿真获取系统调用序列并提取函数调用依赖关系特征;在此基础上,提出了一种基于集成学习的分类器构造方法,区分恶意应用和正常应用。在来自于第三方应用市场中的3000个样本集上进行了实验验证,结果表明基于混合方式的恶意应用检测效果要优于基于静态分析的方式和基于动态分析的方式;考虑多种类型特征的样本上的检测精度要高于采用单一特征刻画的样本上的值;采用集成分类器具有较好的检测精度。  相似文献   

19.
谢丽霞  李爽 《计算机应用》2018,38(3):818-823
针对Android恶意软件检测中数据不平衡导致检出率低的问题,提出一种基于Bagging-SVM(支持向量机)集成算法的Android恶意软件检测模型。首先,提取AndroidManifest.xml文件中的权限信息、意图信息和组件信息作为特征;然后,提出IG-ReliefF混合筛选算法用于数据集降维,采用bootstrap抽样构造多个平衡数据集;最后,采用平衡数据集训练基于Bagging算法的SVM集成分类器,通过该分类器完成Android恶意软件检测。在分类检测实验中,当良性样本和恶意样本数量平衡时,Bagging-SVM和随机森林算法检出率均高达99.4%;当良性样本和恶意样本的数量比为4:1时,相比随机森林和AdaBoost算法,Bagging-SVM算法在检测精度不降低的条件下,检出率提高了6.6%。实验结果表明所提模型在数据不平衡时仍具有较高的检出率和分类精度,可检测出绝大多数恶意软件。  相似文献   

20.
随着Android操作系统的广泛应用,基于Android平台的应用程序的数量日益增长。如何有效地识别恶意软件,对保护手机的安全性至关重要。提出了基于权限和API特征结合的Android恶意软件检测方法,该方法通过反编译apk文件来提取权限特征和API特征,并将两者相结合作为一个整体的特征集合。在此基础上,采用分类算法进行恶意软件的甄别。实验结果表明,该方法的判别准确率高于权限集合或API集合单独作为特征的判别方法,从而能更加有效地检测Android恶意应用程序。  相似文献   

设为首页 | 免责声明 | 关于勤云 | 加入收藏

Copyright©北京勤云科技发展有限公司  京ICP备09084417号