Detecting unknown computer worm activity via support vector machines and active learning

To detect the presence of unknown worms, we propose a technique based on computer measurements extracted from the operating system. We designed a series of experiments to test the new technique by employing several computer configurations and background application activities. In the course of the experiments, 323 computer features were monitored. Four feature-ranking measures were used to reduce the number of features required for classification. We applied support vector machines to the resulting feature subsets. In addition, we used active learning as a selective sampling method to increase the performance of the classifier and improve its robustness in the presence of misleading instances in the data. Our results indicate a mean detection accuracy in excess of 90?%, and an accuracy above 94?% for specific unknown worms using just 20 features, while maintaining a low false-positive rate when the active learning approach is applied.     

“Andromaly”: a behavioral malware detection framework for android devices

This article presents Andromaly—a framework for detecting malware on Android mobile devices. The proposed framework realizes a Host-based Malware Detection System that continuously monitors various features and events obtained from the mobile device and then applies Machine Learning anomaly detectors to classify the collected data as normal (benign) or abnormal (malicious). Since no malicious applications are yet available for Android, we developed four malicious applications, and evaluated Andromaly’s ability to detect new malware based on samples of known malware. We evaluated several combinations of anomaly detection algorithms, feature selection method and the number of top features in order to find the combination that yields the best performance in detecting new malware on Android. Empirical results suggest that the proposed framework is effective in detecting malware on mobile devices in general and on Android in particular.     

Microstructure of GaN grown by lateral confined epitaxy 2. GaN on patterned sapphire

Transmission electron microscopy (TEM), atomic force microscopy (AFM), and photoluminescence (PL) spectroscopy were used in order to study the microstructure and optical properties of GaN films grown by metal-organic chemical vapor deposition (MOCVD) on c-plane sapphire by lateral confined epitaxy (LCE). In this method, the substrate is etched prior to growth to form uniform mesas separated by trenches for laterally restricting growth area. As previously observed for LCE GaN on Si(111), the density of threading dislocations was significantly reduced in the areas close to the edge of mesas due to the lateral propagation of the dislocations. Hence, the overall material quality improves with decreasing mesa size, which is consistent with the observed increase in photoluminescence band edge peak intensity. Electron diffraction indicated ∼1° rotation about the [ ] axis between the mesa and trench material, which was also observed in the image contrast of these two regions with g= . Additionally, LCE samples prepared in [ ] and [ ] cross sections were used for comparing the growth rates in these two perpendicular directions. As theoretically expected, growth in the [ ] direction appears to proceed considerably faster than that in the [% MathType!MTEF!2!1!+-% feaafiart1ev1aaatCvAUfeBSjuyZL2yd9gzLbvyNv2CaerbuLwBLn% hiov2DGi1BTfMBaeXatLxBI9gBaerbd9wDYLwzYbItLDharqqtubsr% 4rNCHbGeaGqiVu0Je9qqqrpepC0xbbL8F4rqqrFfpeea0xe9Lq-Jc9% vqaqpepm0xbba9pwe9Q8fs0-yqaqpepae9pg0FirpepeKkFr0xfr-x% fr-xb9adbaqaaeGaciGaaiaabeqaamaabaabaaGcbaGaaGymaiaaig% daceaIYaGbaebacaaIWaaaaa!38D1!\[11\bar 20\]] direction.