Holography: a behavior‐based profiler for malware analysis

Behavior‐based detection and signature‐based detection are two popular approaches to malware (malicious software) analysis. The security industry, such as the sector selling antivirus tools, has been using signature and heuristic‐based technologies for years. However, this approach has been proven to be inefficient in identifying unknown malware strains. On the other hand, the behavior‐based malware detection approach has a greater potential in identifying previously unknown instances of malicious software. The accuracy of this approach relies on techniques to profile and recognize accurate behavior models. Unfortunately, with the increasing complexity of malicious software and limitations of existing automatic tools, the current behavior‐based approach cannot discover many newer forms of malware either. In this paper, we implement ‘holography platform’, a behavior‐based profiler on top of a virtual machine emulator that intercepts the system processes and analyzes the CPU instructions, CPU registers, and memory. The captured information is stored in a relational database, and data mining techniques are used to extract information. We demonstrate the breadth of the ‘holography platform’ by conducting two experiments: a packed binary behavior analysis and a malvertising (malicious advertising) incident tracing. Both tasks are known to be very difficult to do efficiently using existing methods and tools. We demonstrate how the precise behavior information can be easily obtained using the ‘holography platform’ tool. With these two experiments, we show that the ‘holography platform’ can provide security researchers and automatic malware detection systems with an efficient malicious software behavior analysis solution. Copyright © 2011 John Wiley & Sons, Ltd.     

Fraud detection using fraud triangle risk factors

The objective of this study is to identify the financial statement fraud factors and rank the relative importance. First, this study reviews the previous studies to identify the possible fraud indicators. Expert questionnaires are distributed next. After questionnaires are collected, Lawshe’s approach is employed to eliminate these factors whose CVR (content validity ratio) values do not meet the criteria. Further, the remaining 32 factors are reviewed by experts to be the measurements suitable for the assessment of fraud detection. The Analytic Hierarchy Process (AHP) is utilized to determine the relative weights of the individual items. The result of AHP shows that the most important dimension is Pressure/Incentive and the least one is Attitude/rationalization. In addition, the top five important measurements are “Poor performance”, “The need for external financing”, “Financial distress”, “Insufficient board oversight”, and “Competition or market saturation”. The result provides a significant advantage to auditors and managers in enhancing the efficiency of fraud detection and critical evaluation.     

A distributed admission control model for QoS assurance in large-scale media delivery systems

Conventional admission control models incur some performance penalty. First, admission control computation can overload a server that is already heavily loaded. Also, in large-scale media systems with geographically distributed server clusters, performing admission control on each cluster can result in long response latency, if the client request is denied at one site and has to be forwarded to another site. Furthermore, in prefix caching, initial frames cached at the proxy are delivered to the client before the admission decisions are made. If the media server is heavily loaded and, finally, has to deny the client request, forwarding a large number of initial frames is a waste of critical network resources. In this paper, a novel distributed admission control model is presented. We make use of proxy servers to perform the admission control tasks. Each proxy hosts an agent to coordinate the effort. Agents reserve media server's disk bandwidth and make admission decisions autonomously based on the allocated disk bandwidth. We develop an effective game theoretic framework to achieve fairness in the bandwidth allocation among the agents. To improve the overall bandwidth utilization, we also consider an aggressive admission control policy where each agent may admit more requests than its allocated bandwidth allows. The distributed admission control approach provides the solution to the stated problems incurred in conventional admission control models. Experimental studies show that our algorithms significantly reduce the response latency and the media server load.     

Resolution enhanced light field near eye display using e‐shifting method with birefringent plate

Light field near eye displays (LFNED) can produce lightweight devices and address the accommodation–convergence conflict. However, low spatial resolution creates a poor immersive experience in LFNED. In addition, although many e‐shifting devices have been proposed to enhance resolution in projection system, yet those devices are too bulky to be applied in an LFNED to keep it lightweight. In this paper, a compact e‐shifting component is proposed to enhance image resolution in an LFNED by using a birefringent plate and twisted nematic switch cell. The proposed e‐shifting device is a flat and thin component with only 2.6 mm of thickness, which could be placed in the gap of an LFNED without increasing the thickness. The results show that the proposed components could be easily integrated in an LFNED with the result of resolution enhancement.     

An efficient algorithm for incrementally mining frequent closed itemsets

The purpose of mining frequent itemsets is to identify the items in groups that always appear together and exceed the user-specified threshold of a transaction database. However, numerous frequent itemsets may exist in a transaction database, hindering decision making. Recently, the mining of frequent closed itemsets has become a major research issue because sets of frequent closed itemsets are condensed yet complete representations of frequent itemsets. Therefore, all frequent itemsets can be derived from a group of frequent closed itemsets. Nonetheless, the number of transactions in a transaction database can increase rapidly in a short time period, and a number of the transactions may be outdated. Thus, frequent closed itemsets may be changed with the addition of new transactions or the deletion of old transactions from the transaction database. Updating previously closed itemsets when transactions are added or removed from the transaction database is challenging. This study proposes an efficient algorithm for incrementally mining frequent closed itemsets without scanning the original database. The proposed algorithm updates closed itemsets by performing several operations on the previously closed itemsets and added/deleted transactions without searching the previously closed itemsets. The experimental results show that the proposed algorithm significantly outperforms previous methods, which require a substantial length of time to search previously closed itemsets.     

Fast patterning microstructures using inkjet printing conformal masks

The presented paper describes a novel process using inkjet printing to pattern a conformal (built-on) mask onto photoresist for further microstructure formation. The advantages of using the inkjet printing conformal mask include no Cr photomask required, suitable for non-planar substrate, scalable for large area, and extreme low cost. The ink is ejected from the inkjet print-head controlled by the inkjet system. A CAD pattern from the designer can use this process to place the pattern ink onto the photoresist substrate. A conformal mask (made of ink) was directly built-on the photoresist substrate. The dried ink thickness has to be more than 1.8 μm thick as UV absorber. Following UV exposure, development, and ink removal, the designed microstructure patterns can be realized in photoresist such as microchannels and micro-columns.     

Do organizational citizenship behaviors lead to information system success?: Testing the mediation effects of integration climate and project management

We adapted a model in organizational theory to determine whether organizational citizenship behaviors (OCBs) of system implementation teams influenced that organization's integration climate and improved their project management, resulting in successful system implementation. Surveys were elicited from 254 system users in various business organizations that had implemented large-scale IS in the previous year; the analysis of their responses provided support for our model, suggesting that the OCB of the implementation team created a higher level of integration climate and more effective project management, and that these in turn influenced information system success. Implications for researchers and managers are discussed and limitations are identified.     

Nonlinear bilateral teleoperators under event‐driven communication with constant time delays

Bilateral teleoperation systems provide a platform for human operators to remotely manipulate slave robots in engaging various tasks in remote environments. Most of the previous studies in bilateral teleoperation were developed under continuous transmission or periodic communication with fixed data exchanging rates. This paper presents control schemes for bilateral teleoperation systems using nonperiodic event‐driven communication. By using P‐like and PD‐like controllers, this study proposes triggering conditions for teleoperators to reduce network access frequency so that robots only transmit output signals when necessary. Stability and position tracking of the control system are studied, and nonzero minimum interevent time is guaranteed. The proposed event‐driven teleoperation is studied with a velocity estimator to avoid the requirement of velocity information in the controller and triggering condition. Without velocity measurements, the boundedness of tracking errors and stability are ensured for teleoperation systems under event‐driven communication. Simulations and experiments are illustrated to validate the performance of the proposed event‐driven teleoperation systems.     

A hybrid approach to modeling metabolic systems using a geneticalgorithm and simplex method

One of the main obstacles in applying genetic algorithms (GA's) to complex problems has been the high computational cost due to their slow convergence rate. We encountered such a difficulty in our attempt to use the classical GA for estimating parameters of a metabolic model. To alleviate this difficulty, we developed a hybrid approach that combines a GA with a stochastic variant of the simplex method in function optimization. Our motivation for developing the stochastic simplex method is to introduce a cost-effective exploration component into the conventional simplex method. In an attempt to make effective use of the simplex operation in a hybrid GA framework, we used an elite-based hybrid architecture that applies one simplex step to a top portion of the ranked population. We compared our approach with five alternative optimization techniques including a simplex-GA hybrid independently developed by Renders-Bersini (R-B) and adaptive simulated annealing (ASA). Our empirical evaluations showed that our hybrid approach for the metabolic modeling problem outperformed all other techniques in terms of accuracy and convergence rate. We used two additional function optimization problems to compare our approach with the five alternative methods.     

MULTIMEDIA NETWORKING A Leading-Edge Communication Technology

The realization of digital multimedia's full business potential requires networking. This article discusses the value-added benefits to the corporation of networked multimedia as well as the choice of architectures and technologies needed to deliver multimedia networking solutions.