A Novel Dynamic Analysis Infrastructure to Instrument Untrusted Execution Flow Across User-Kernel Spaces

Malware is one of the biggest security threats on the Internet today and deploying effective defensive solutions requires the rapid analysis of a continuously increasing number of malware samples. With the proliferation of metamorphic malware the analysis is further complicated as the efficacy of signature-based static analysis systems is greatly reduced. While dynamic malware analysis is an effective alternative, the approach faces significant challenges as the ever increasing number of samples requiring analysis places a burden on hardware resources. At the same time modern malware can both detect the monitoring environment and hide in unmonitored corners of the system.In this paper we present DRAKVUF, a novel dynamic malware analysis system designed to address these challenges by building on the latest hardware virtualization extensions and the Xen hypervisor. We present a technique for improving stealth by initiating the execution of malware samples without leaving any trace in the analysis machine. We also present novel techniques to eliminate blind-spots created by kernel-mode rootkits by extending the scope of monitoring to include kernel internal functions, and to monitor file-system accesses through the kernel's heap allocations. With extensive tests performed on recent malware samples we show that DRAKVUF achieves significant improvements in conserving hardware resources while providing a stealthy, in-depth view into the behavior of modern malware.

In order to thwart dynamic analysis and bypass protection mechanisms, malware have been using several file formats and evasive techniques. While publicly available dynamic malware analysis systems are one of the main sources of information for researchers, security analysts and incident response professionals, they are unable to cope with all types of threats. Therefore, it is difficult to gather information from public systems about CPL, .NET/Mono, 64-bits, reboot-dependent, or malware targeting systems newer than Windows XP, which result in a lack of understanding about how current malware behave during infections on modern operating systems. In this paper, we discuss the challenges and issues faced during the development of this type of analysis system, mainly due to security features available in NT 6.x kernel versions of Windows OS. We also introduce a dynamic analysis system that addresses the aforementioned types of malware as well as present results obtained from their analyses.

In order to design the perception system of the lower limb wearable rehabilitation robot, this study established the kinematics theoretical model of human lower limb and conducted the kinematics analysis of human body. By using the dynamic attitude analysis system, combined with the human body mark points, the position data of human body mark points in the process of standing up, sitting up, walking, stepping up, and squatting were collected. Combined with the movement mechanism of human lower limbs, the characteristics of human motion state transition are analyzed, and the perceptual algorithm for judging human motion intention is studied, so as to determine the wearer's current posture, standing intention while sitting, walking intention while standing, moving intention, and stopping intention during walking. The results show that the angle of the hip joint changes regularly between 0° and 37° and the angle of the knee joint changes regularly between 0° and 70°during the standing process, which is consistent with the angle change trajectory collected by the dynamic attitude analysis system. The angle trajectories of the hip and knee joints measured by the absolute angle sensor are the same as those obtained by the dynamic attitude analysis system. 1.5 rad and 0.3 rad were selected as reasonable and effective thresholds for determining sitting and standing states.

This paper provides a comprehensive analysis of the impact of wind farm integration on the stability of an electrical power system, with a particular focus on the dynamic effects induced by wind power during severe system disturbances. The primary objective is to evaluate how wind power integration influences system behavior, particularly under fault conditions. The research utilized the IEEE 9-bus test system, which consists of three generators and nine buses, as a reference benchmark for the stability analysis. Simulations and modeling were performed using PSAT (Power System Analysis Toolbox), a robust tool for static, dynamic, and control analysis of power systems, integrated with Matlab. The study specifically investigated the effects of a three-phase short circuit, representing a significant system disturbance. The dynamic analysis was structured into three phases: pre-fault, fault, and post-fault, to capture the complete impact on system behavior. The results provided valuable insights into critical electrical and electromechanical variables, shedding light on the role of wind farms in maintaining the stability of the power grid, with particular emphasis on the transmission network's resilience and response to disturbances. This work offers a deeper understanding of the integration of renewable energy sources in enhancing grid stability during extreme events.

The Dynamic Analysis and Design System software is a set of general purpose computer programs that can be used to model and predict the motion of a variety of real world mechanical systems. Using a set of data that describes the machine to be modeled, DADS builds a mathematical model of the real system that calculates positions, velocities, and accelerations of the various parts of the machine, as well as resultant forces that act in the system. By using such a computer program to analyze a machine, the designer can simulate the behavior of a wide range of alternate designs prior to building and testing prototypes. The DADS program is often used for analysis of existing mechanical systems also.

: A dynamic model of the Polaris Sportsman 500 All-Terrain Vehicle (ATV) was built using Dynamic Analysis and Design System (DADS) version 8.5. Aspects of the model included the front MacPherson struts and rear independent suspension. The model also allowed control over the path and speed of the vehicle using the DADS control elements. The modeling methods discussed here are general in nature and may be applied to other DADS vehicle models of similar systems. This report also provides a usefull reference source to those using this model.

Antivirus companies, mobile application marketplaces, and the security research community, employ techniques based on dynamic code analysis to detect and analyze mobile malware. In this paper, we present a broad range of anti-analysis techniques that malware can employ to evade dynamic analysis in emulated Android environments. Our detection heuristics span three different categories based on (i) static properties, (ii) dynamic sensor information, and (iii) VM-related intricacies of the Android Emulator. To assess the effectiveness of our techniques, we incorporated them in real malware samples and submitted them to publicly available Android dynamic analysis systems, with alarming results. We found all tools and services to be vulnerable to most of our evasion techniques. Even trivial techniques, such as checking the value of the IMEI, are enough to evade some of the existing dynamic analysis frameworks. We propose possible countermeasures to improve the resistance of current dynamic analysis tools against evasion attempts.

In this paper we describe how the knowledge related to a specific domain and the available visual analysis tools can be used to create dynamic visual analysis systems for video surveillance.Firstly, the knowledge is described in terms of application domain (types of objects, events... that can appear in such domain) and system capabilities (algorithms, detection procedures...) by using an existing ontology.Secondly, the ontology is integrated into a framework to create the visual analysis systems for each domain by inspecting the relations between the entities defined in the domain and system knowledge.Additionally, when necessary, analysis tools could be added or removed on-line.Experiments/Application of the framework show that the proposed approach for creating dynamic visual analysis systems is suitable for analyzing different video surveillance domains without decreasing the overall performance in terms of computational time or detection accuracy.

Interval dynamic response analysis of vehicle-bridge interaction system with uncertainty

This paper presents an argument for distributing dynamic software analyses to large populations of users in order to locate bugs that cause security flaws. We review a collection of dynamic analysis systems and show that, despite a great deal of effort from the research community, their performance is still too low to allow their use in the field. We then show that there are effective sampling mechanisms for accelerating a wide range of powerful dynamic analyses. These mechanisms reduce the rate at which errors are observed by individual analyses, but this loss can be offset by the subsequent increase in test population. Nevertheless, there are unsolved issues in this domain that deserve attention if this technique is to be widely utilized.

This paper presents a comprehensive dynamical systems analysis of a generalized (3 + 1)-dimensional Davey–Stewartson equation with parabolic law nonlinearity. The complex partial differential equation is reduced to a planar dynamical system, enabling detailed bifurcation analysis, equilibrium point characterization, and complete phase portrait construction across different parameter regimes. External periodic forcing transforms the conservative system into a dissipative one, facilitating chaotic dynamics that are confirmed through Lyapunov exponent computation and sensitivity analysis. The complete Lyapunov spectrum provides quantitative evidence of chaotic behavior. Using the new mapping method and the new Kudryashov method, we obtain novel exact solutions, including bright and dark solitons, rogue waves, kink-shaped structures, and periodic patterns. The derivation of these exact solutions addresses the distinctive challenges posed by parabolic law nonlinearity and establishes crucial connections with phase space structures identified through bifurcation analysis. The interplay between analytical solutions and dynamical systems theory reveals fundamental mechanisms governing wave stability, bifurcations, and chaos in higher-dimensional nonlinear systems, with applications in nonlinear optics and fluid dynamics.

The [formula omitted]-compound of a difference–algebraic system

For the multisensor systems with unknown noise variances, using correlation method and least squares fusion criterion, information fusion noise variance estimators are presented by the average of local noise variance estimators, which have the consistence. Substituting the fused noise variance online estimators into the optimal Riccati equation and the optimal weighted measurement fusion Kalman filter, a self-tuning Riccati equation and a new self-tuning weighted measurement fusion Kalman filter are presented. In order to prove the convergence of the self-tuning Riccati equation, a dynamic variance error system analysis (DVSEA)method is presented, which converts the convergence problem to the stability problem of a time-varying Lyapunov equation. A stability decision criterion is presented for the Lyapunov equation. By the dynamic error system analysis (DESA) method and DVSEA method, it proves that the self-tuning weighted measurement fusion Kalman filter converges to the globally optimal weighted measurement fusion Kalman filter in a realization, so that it has asymptotic global optimality. A simulation example for target tracking system with 3-sensor shows its effectiveness.

For networked sensor systems (NSSs) with hard and soft sensors including five uncertainties, two universal approaches of solving the robust fusion estimation problems are presented. It includes an integrated sequential covariance intersection (SCI) fusion minimax robust Kalman filtering approach with cross‐covariance information and a generalized Lyapunov equation approach with four pairs of Lyapunov equations. Applying them, the robust local and SCI fused time‐varying and steady‐state Kalman filters are presented in the sense that their actual estimation error variances are guaranteed to have the corresponding minimal upper bounds. The equivalent batch SCI fusers are also presented. Their robustness and accuracy relations are proved, and the sensitivity of the SCI fuser with respect to the fused orders of sensors is analyzed. Applying the dynamic error system analysis method and the dynamic variance error system analysis method, a new convergence and absolute asymptotic stability theory of robust fusion Kalman filtering is presented. The classical Kalman filtering convergence and stability theory is developed. Compared with the original covariance intersection fuser, they significantly reduced the computational complexity and burden. Compared with the optimal and conservative SCI fusers, they significantly improved the robust accuracies. They are suitable to deal with asynchronous or random delayed data and are suitable for real‐time applications. A simulation applied to the two‐mass spring damper mechanical system shows their effectiveness.

For the multisensor linear discrete time‐invariant stochastic systems with unknown noise variances, using the correlation method, the information fusion noise variance estimators with consistency are given by taking the average of the local noise variance estimators. Substituting them into two optimal weighted measurement fusion steady‐state Kalman filters, two new self‐tuning weighted measurement fusion Kalman filters with a self‐tuning Riccati equation are presented. By the dynamic variance error system analysis (DVESA) method, it is rigorously proved that the self‐tuning Riccati equation converges to the steady‐state optimal Riccati equation. Further, by the dynamic error system analysis (DESA) method, it is proved that the steady‐state optimal and self‐tuning Kalman fusers converge to the global optimal centralized Kalman fuser, so that they have the asymptotic global optimality. Compared with the centralized Kalman fuser, they can significantly reduce the computational burden. A simulation example for the target tracking systems shows their effectiveness. Copyright © 2010 John Wiley & Sons, Ltd.