E-mail Worm Detection Using the Analysis of Behavior

Propagation of Internet worms is a serious problem in our highly information oriented society. In this paper, we propose a stochastic model for Internet worm propagation to evaluate its dependability measures quantitatively. More precisely, the deterministic kill-signal model is reformulated based on a continuous-time Markov chain. We define some dependability measures and derive the recursive computation algorithms to assess them. In numerical experiments, we investigate the behavior of actual Internet worms with real infection data and characterize their propagation

Network worms spread widely over the global network within a short time, which are increasingly becoming one of the most potential threats to network security. However, the performance of traditional packet-oriented signature-based methods is questionable in the face of unknown worms, while anomaly-based approaches often exhibit high false positive rates. It is a common scenario that the life cycle of network worms consists of the same four stages, in which the target discovery phase and the transferring phase have specific interactive patterns. To this end, we propose Network Flow Connectivity Graph (NFCG) for identifying network worm victims. We model the flow-level interactions as graph and then identify sets of frequently occurring motifs related to network worms through Cascading Motif Discovery algorithm. In particular, a cascading motif is jointly extracted from graph target discovery phase and transferring phase. If a cascading motif exists in a connected behavior graph of one host, the host would be identified as a suspicious worm victim; the excess amount of suspicious network worm victims is used to reveal the outbreak of network worms. The simulated experiments show that our proposed method is effective and efficient in network worm victims’ identification and helpful for improving network security.

This paper proposes a novel anomaly detection method of network worms. The algorithm detects unknown worms by multidimensional worm abnormal detection technology, extracts its feature string via analyzing worm data with leap-style and creates new rules to detect the corresponding worm in case that the unknown worm attacks again. The paper has realized the automatic detection of unknown worms. Experiment data has showed that the method has high success detection rate and low false alarm rate.

Human behavior is often affected by sudden emergency directly or indirectly. In this paper, we focus on two groups of people under different types of medical emergency calls. Based on the quantitative analysis of calling volume and call interval distribution before and after the emergency call, we find that during most types of emergencies, calling volume will increase after the emergency call made and maintain a high level in the next several hours. Medical emergency makes influence on call volumes, but not affects power-law distribution in human communication behavior. From studying entropy of call detail records, we found that during the medical emergency, the richness of outgoing call numbers increases and falls after that. In this paper, we do quantitative analysis of temporal patterns of medical emergency call based on the combination of medical emergency call data and call detail record data, which not only study on the characteristics of human communication behavior in emergency situations, but also provide data basis for scientific rational allocation of aid resources and effective emergency measures.

A serious security threat today is malicious emails, especially new, unseen Internet worms and virus often arriving as email attachments. These new malicious emails are created at the rate of thousands every year and pose a serious security threat. Current anti-virus systems attempt to detect these new malicious mail viruses with signatures generated by hand but it is costly and oftentimes. In this paper, we present a method of combining self-organizing maps (SOM) and a k-medoids clustering for detecting new, previously unseen malicious emails accurately and automatically. This method automatically found behaviors in data set and used these behaviors to detect a set of new malicious mail viruses included scripts that hadn't been discussed before. Naive Bayes classification and anti-virus software's results are also shown for comparison. Comparison results show that our proposed method outperformed than other methods.

Heavyweight Class

Signature-based security tools such as network intrusion detection systems, anti-virus scanners, filters against network worms and other similar systems perform in real time computation-intensive task of multi-pattern string matching against tens of thousands or even millions of predefined malicious patterns. Due to rising traffic rates, increasing number and sophistication of attacks and the collapse of Moore's law for sequential processing, traditional software solutions can no longer meet the high requirements of today’s security challenges. Therefore, designers pay more attention to hardware approaches to accelerate pattern matching. The reconfigurable devices based on Field Programmable Gate Arrays (FPGA) combining the flexibility of software and the near-ASIC performance, have become increasingly popular for this purpose. The state-of-the-art solutions made in this area around the world were analyzed. There are three main approaches to fulfill the pattern matching using FPGA. The techniques (and underlying technologies) of these approaches are: content addressable memory (based on digital comparators), Bloom filter (based on hash-functions) and Aho-Corasick algorithm (based on finite automata). But none of them shows clear advantages over others. In this article, we propose a set of methods to increase the effectiveness of reconfigurable security tools by synthesizing optimal recognition modules that maximize the benefits of each approach. The Parallel Combination Method divides a set of patterns between several matching blocks that use different approaches to better fit each of them. The Sequential Cascading Method processes patterns in parts: if the first fragment does not match, the rest can be ignored. The Vertical Join Method couples together different approaches or techniques in a single unit to provide higher efficiency of the resulting device. The optimization procedure maximizes efficiency gains for each method. The methods and methodologies presented in this study will allow developers to create more efficient reconfigurable tools for information security systems.

Body-centric communications are emerging as a new paradigm in the panorama of personal communications. Being concerned with human behaviour, they are suitable for a wide variety of applications. The advances in the miniaturization of portable devices to be placed on or around the body, foster the diffusion of these systems, where the human body is the key element defining communication characteristics. This thesis investigates the human impact on body-centric communications under its distinctive aspects. First of all, the unique propagation environment defined by the body is described through a scenario-based channel modeling approach, according to the communication scenario considered, i.e., on- or on- to off-body. The novelty introduced pertains to the description of radio channel features accounting for multiple sources of variability at the same time. Secondly, the importance of a proper channel characterisation is shown integrating the on-body channel model in a system level simulator, allowing a more realistic comparison of different Physical and Medium Access Control layer solutions. Finally, the structure of a comprehensive simulation framework for system performance evaluation is proposed. It aims at merging in one tool, mobility and social features typical of the human being, together with the propagation aspects, in a scenario where multiple users interact sharing space and resources.

Inherent correlations between visual and semantic features in real-world scenes make it difficult to determine how different scene properties contribute to neural representations. Here, we assessed the contributions of multiple properties to scene representation by partitioning the variance explained in human behavioral and brain measurements by three feature models whose inter-correlations were minimized a priori through stimulus preselection. Behavioral assessments of scene similarity reflected unique contributions from a functional feature model indicating potential actions in scenes as well as high-level visual features from a deep neural network (DNN). In contrast, similarity of cortical responses in scene-selective areas was uniquely explained by mid- and high-level DNN features only, while an object label model did not contribute uniquely to either domain. The striking dissociation between functional and DNN features in their contribution to behavioral and brain representations of scenes indicates that scene-selective cortex represents only a subset of behaviorally relevant scene information.

This project introduces a next-generation multimodal Human Computer Interaction (HCI) system that combines three natural input modalities eye-tracking, voice analysis, and hand gesture recognition to establish an intuitive, seamless, and highly efficient interaction framework between humans and digital systems. The core objective is to address the limitations of traditional input devices such as key boards, mice, and touch screens, particularly in environments where hands-free or contactless interaction is essential. The proposed system leverages a synergistic fusion of advanced technologies supported by machine learning models, including precise eye-tracking mechanisms to monitor gaze and attention, sophisticated voice recognition algorithms to interpret spoken commands, and real-time hand gesture interpretation for expressive and dynamic control. These models are trained to recognize complex patterns in user behaviours, enhancing the system's ability to interpret intent accurately and efficiently. Each modality operates in parallel and contributes uniquely to understanding user input, enabling flexible, adaptive, and reliable interaction with machines. By emulating natural human communication behaviours, the system substantially reduces interaction friction, lowers cognitive load, and enhances usability across diverse user groups. The integration of multiple input channels powered by machine learning also ensures greater accuracy, responsiveness, and robustness, especially under varying environmental and user conditions. This research advances the field of multimodal interaction by presenting a unified, extensible system architecture that supports more natural, inclusive, and intelligent human machine communication. The successful development and implementation of this machine learning based system represent a significant step toward the future of HCI, where machines can interact with users in a manner more closely aligned with human behaviors and intent.

Human behaviour is complex because of the multiplicity of influences from which it arises, so that it is obvious, ona priori grounds, that an empathetic or ‘relating’ approach cannot continue to sustain all of our investigations. A reorientation in thinking about behaviour and related psychological changes is necessary for psychiatry and for psychometric testing in order that the foundations of assessment in such areas are as secure and objective as possible. The assessment of behaviour is moving towards repeated measurements on a variety of parameters, which necessitate the development of automated testing and data collection to sustain the increasing demands in these areas.

Laboratory assessment of feeding behavior in bulimia nervosa and healthy women: methods for developing a human-feeding laboratory

Approach–avoidance conflicts are a hallmark of anxiety-related behaviors. A gold standard for assessing anxiety-related behaviors in rodents is the elevated plus-maze (EPM), which was recently translated to humans using immersive virtual reality. Repeated behavioral testing is particularly interesting for clinical and pharmacological research in humans but could be limited by habituation effects. Here, we tested whether comparable strategies that are used in rodents (different environments and inter-trial interval of 28 days) are sufficient to avoid habituation or sensitization effects on the EPM, making it possible to perform repeated measurement of anxiety-related behavior in humans. Moreover, we developed two novel virtual environments for repeated testing to explore whether a scenario resembling the real world is superior to a video game-like EPM in terms of lifelike physiological, emotional, and behavioral responses. On a behavioral level, no significant differences but a high correlation between first and repeated exposure to the human EPM independent of EPM version were found. On a psychophysiological level, salivary alpha-amylase, skin-conductance, and respiratory frequency increased at first and second exposure independent of EPM version. However, at repeated exposure, skin-conductance and heart rate showed indicators for anticipatory anxiety and a small sensitization effect, while no effect of real-world resemblance on these physiological measures was found. This was also reflected in slightly higher subjective anxiety levels at second exposure, although subjective anxiety still correlated strongly between first and second exposure. In conclusion, the human EPM can be used for longitudinal assessments of human anxiety-related behavior when strategies to avoid habituation and sensitization are considered.

To reduce the security authentication time cost, forwarding delay, and enhance message security of Beidou communication short messages, this paper proposes a Beidou communication short message encryption technology based on SM9 (Mobile Code Secure Communication). This technology uses split hierarchical clustering algorithm to cluster the short message data of Beidou Communication, in order to unify the processing of similar short message data and improve the encryption efficiency of subsequent short messages. Based on the data clustering results, this paper constructs a short message forwarding verification model using the SM9 identification password algorithm, and provides the message content of the communication application protocol and the communication receiving information protocol to achieve low‐cost and efficient forwarding verification. In addition, this article improves the initial value selection of Logistic chaotic mapping by coupling the tent map with coupled mapping lattice (CML) in the spatiotemporal chaos model to generate a chaotic initial value sequence, thereby expanding the key space, enhancing the ability to resist exhaustive attacks, enhancing the randomness of the generated key parameters, and optimizing the encryption effect of short messages. The experimental results show that the short message security authentication time of the technology proposed in this article is basically controlled within 25 ms, and the minimum forwarding delay is only 23.9 ms, which can effectively resist attacks and improve the security of Beidou communication.

The life-cycle assessment (LCA) method is typically applied to products, but the potential and demand for extending its use also to other applications are high. In this respect, this paper proposes an LCA concept to be used for the assessment of human beings as new study objects, namely Life-LCA. Key challenges of such a new approach and potential solutions for those are identified and discussed. The Life-LCA concept was developed based on a detailed desktop research. Several Life-LCA-specific challenges were identified and categorized under three research questions. One of these questions focusses on the conceptual design of a Life-LCA method while the others are addressing operational issues, which are the definition of the new study system and the practical assessment of complex human consumption behaviors. Methodological solutions are proposed, e.g., based on suggestions provided in the existing methods product LCA and organizational LCA (O-LCA). Conceptual challenges arise from the general diversity, complexity, and temporal development of human lives and consumption behaviors. We introduce Life-LCA as a two-dimensional method that covers both, the new human life cycle (dimension 1) and the life cycle of the consumed products (dimension 2). Furthermore, the two types Individual Life-LCA and Lifestyle-LCA are differentiated. Especially, the definition of a general system boundary for Life-LCA and data collection and evaluation face many operational challenges. For example, the social behavior of human beings is a new factor to be considered which causes new allocation problems in LCA. Moreover, the high demand for aggregated LCA data requires specific rules for data collection and evaluation as well as a new bottom-up product clustering scheme. Life-LCA, either used for the assessment of individual lives or lifestyles, has the potential to raise environmental awareness of people by making their specific environmental impacts comprehensively measurable and thus, tangible. However, many challenges need to be solved in future interdisciplinary research to develop a robust and applicable method. This paper conceptualizes such an approach and proposes solutions that can serve as a framework for ongoing method development.