Integrated Analysis of Malicious Software: Insights from Static and Dynamic Perspectives

Methodologies for the use of VMware to boot cloned/mounted subject hard disk images

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

A general-purpose file management system designed specifically for memory cards is described. The file system provides a standardized data handling technique to support a wide variety of biomedical applications. Any type of file may be used. System overhead is minimal, and the file structure is independent of microprocessor, word width and implementation language. >

We conduct a comprehensive study of file-system code evolution. By analyzing eight years of Linux file-system changes across 5079 patches, we derive numerous new (and sometimes surprising) insights into the file-system development process; our results should be useful for both the development of file systems themselves as well as the improvement of bug-finding tools.

Since the 21st century, the world has increasingly focused on the issue of sustainable development, and the green transformation issues have become a new hot topic worldwide. Green and low-carbon transformation has become an international consensus. Urban agglomerations are important connections between urban development and regional coordination, as well as important spatial carriers for economic activities. They are not only the main source of carbon emissions, but also the main battlefield for energy conservation and emission reduction. As an important field for carbon reduction, the green transformation of cities is crucial for achieving the “dual carbon” goals. This article focuses on 48 cities in the three most mature and influential urban agglomerations in China from 2011 to 2019, namely, the Beijing-Tianjin-Hebei urban agglomeration, the Yangtze River Delta urban agglomeration, and the Pearl River Delta urban agglomeration. The three-stage DEA model and Malmquist index model are used to measure the green transformation efficiency of the three urban agglomerations from both dynamic and static perspectives, and a Tobit regression model is constructed to explore the influencing factors of green transformation efficiency in urban agglomerations. Research has found that: 1) From a static perspective, the overall efficiency of green transformation in the three major urban agglomerations is at a high level, but from a temporal perspective, it shows a downward trend. The Pearl River Delta urban agglomeration is known for its green development, with the highest average efficiency of green transformation, followed by the Yangtze River Delta urban agglomeration. The Beijing-Tianjin-Hebei urban agglomeration has the lowest level of green transformation; 2) From a dynamic perspective, technological progress is the main driving factor for improving the efficiency of green transformation in the three major urban agglomerations. Therefore, the government should pay special attention to the progressiveness of technology when formulating relevant policies to promote urban green transformation; 3) From the perspective of spatiotemporal differences, there are significant differences in the spatiotemporal characteristics of green transformation among the three major urban agglomerations, and there are significant differences in green transformation strategies among different urban agglomerations. Eliminating environmental factors and random interference is necessary for accurately measuring the efficiency of green transformation in urban agglomerations; 4) From the perspective of influencing factors, factors such as industrial structure upgrading, green innovation level, and environmental regulation intensity jointly affect the efficiency of green transformation in urban agglomerations. Based on this, we should pay attention to the differences between urban agglomerations and implement policies tailored to local conditions; Strengthen the network system of urban agglomerations and avoid conflicts between cities; Encourage green technology innovation, accelerate industrial structure upgrading, and so on. This article focuses on the issue of green transformation in urban agglomerations, and conducts research from three perspectives: efficiency measurement, influencing factors, and implementation mechanisms. A relatively systematic theoretical framework for green transformation in urban agglomerations is formed, and an evaluation index system for green transformation efficiency in urban agglomerations is constructed and optimized. The composition mechanism of the five dimensional evaluation system for transformation efficiency is analyzed, and the bottleneck and breakthrough direction of the three major urban agglomerations in China in the development process are grasped. It has a good demonstration effect on the green transformation of other urban agglomerations.

In this study, we analyze the unified healthcare efficiency in China at the regional level from 2009 to 2019. To accurately evaluate the evolution of unified efficiency from both static and dynamic perspectives, we combine the non-radial directional distance function and the meta-frontier method to evaluate the unified healthcare efficiency and its dynamic changes. This new approach allows for regional heterogeneity and non-radial slack simultaneously. The decomposition of the meta-frontier non-radial Malmquist unified healthcare efficiency index (MNMHEI) can be used to identify the driving factors of dynamic changes. The results show that the unified healthcare efficiency in eastern China is generally higher than that in non-eastern China from the static perspective, implying significant regional differences. Moreover, the unified efficiency in both eastern and non-eastern regions shows similar time trends and reaches the maximum in 2012. From the dynamic perspective, the unified healthcare efficiency increases annually by 2.68% during the study period. This increase in eastern China as a technology leader is mainly driven by technological progress, whereas the increase in non-eastern China is mainly driven by a better catch-up effect. In addition, the impact of the reform on the non-eastern region is more significant for the decreasing technology gap, the stronger growth momentum of technological progress, and global innovative provinces.

Flash memory has become increasingly popular in today’s storage systems. However, replacing hard drives with flash memory in current systems often either requires major file system changes or causes performance degradation due to the limitations of block-based interface and out-of-place updates required by flash. To alleviate this problem, we propose an object-based model for flash memory that gives the hardware and firmware the ability to optimize performance for the underlying implementation. Based on this model, we propose two new data placement policies that exploit richer information from an object-based interface. Using simulation, we show that cleaning overhead can be reduced by up to 9% by separating data and metadata. Segregating the access time from metadata can further reduce the cleaning overhead by up to 23%.

Flash memory has been widely used in various embedded devices, such as digital cameras and smart cell phones, because it has a fast access speed, a high availability and an economization of power. However, replacing hard drives with flash memory in current systems often either requires major file system changes or causes performance degradation due to the limitations of block based interface and out-of-place updates required by flash. We introduce a management framework of object-based storage system which can optimize the performance for the underlying implementation. Based on this model, we propose a data allocation method that takes richer information from an object-based interface. Using simulation, we show that cleaning overhead can be reduced by up to 11% by separating data and metadata. Segregating the hot data and cold data can further reduce the cleaning overhead by up to 19%.KeywordsFlash memoryObject-based flash file systemData allocation

Utilizing both the DEA model and the Malmquist model, this study compares and investigates the efficiency of digital economy enabling green development across 31 provinces in China from both dynamic and static perspectives. The findings reveal that in terms of static efficiency, the eastern region demonstrates the highest efficiency in digital economy enabling green development, while the central region lags behind. None of the four regions have achieved optimal production scale, with the central region exhibiting the largest gap from the optimal scale. Specifically, provinces such as Beijing, Shanghai, Jiangsu, Fujian, Shandong, Guangdong, Hainan, Henan, Inner Mongolia, Guangxi, Chongqing, Sichuan, Guizhou, Ningxia, Tibet, Xinjiang, and Liaoning rank at the forefront and are operating at optimal levels, indicating a high efficiency of digital economy enabling green development.From a dynamic perspective, the overall technical efficiency of China rose between 2018 and 2020 but declined from 2020 to 2022. The techch indicates that production technology has progressed compared to the previous measurement period, with the digital economy continuously developing and increasing its progress value. The tfpch for each period from 2018 to 2022 is greater than 1, with a 1.2% increase from 2020 to 2021 compared to 2019 to 2020. Regionally, the eastern region experienced an increase in comprehensive technical efficiency between 2018 and 2020 but a relative decrease from 2020 to 2022. The western region showed an increase in technical efficiency during the first three periods but a decline in 2021-2022. Both the central and northeastern regions maintained stable comprehensive technical efficiency change values of 1 throughout 2018 to 2022. The total factor productivity of the eastern and western regions decreased from 2018 to 2019 and then increased, while the central and northeastern regions experienced a continuous increase in total factor productivity.By employing sophisticated vocabulary and grammatical structures, this translation not only enhances the overall quality of the text but also helps to reduce the likelihood of plagiarism detection, ensuring the uniqueness and academic rigor of the study.

Influence of pier settlement on contact behavior between CRTS II track and bridge in high-speed railways

This paper describes the design and implementation of a distributed file system (dfs) for embedded applications. The services provided in dfs include transaction management, file management and file access. Client processes use message passing to access these services. The file system provides client processes with different types of files. These include replicated files, with identical copies stored at multiple nodes, and consistent files, stored at a single node. Both are accessed only within transactions. Multiple readers or a single writer are allowed access to the files, and updates are performed atomically using a co-ordinated commit protocol over multiple sites. A novel concurrency control algorithm which provides deterministic response and avoids deadlock has been designed to resolve contention. Other types of file are also provided for low-overhead storage of less critical data. This paper motivates the need for different types of file, and describes the design and implementation of dfs using the CONIC programming environment for the construction of distributed systems.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Malware is a problem spread out worldwide. Current techniques to analyze these malware are static analysis technique and dynamic analysis technique. Later, the two analysis technique is combined into a technique called hybrid analysis technique. This paper discusses on the current analysis technique and introduces a new approach towards the hybrid analysis technique by introducing memory analysis technique into it. The expected outcome of producing memory analysis technique in hybrid analysis technique will be discussed in the latter part of this paper.

Several static analysis techniques, e.g., symbolic execution or scope-bounded checking, as well as dynamic analysis techniques, e.g., specification-based testing, use constraint solvers as an enabling technology. To analyze code that manipulates structurally complex data, the underlying solver must support structural constraints. Solving such constraints can be expensive due to the large number of aliasing possibilities that the solver must consider. This paper presents a novel technique to selectively reduce the number of test cases to be generated. Our technique applies across a class of structural constraint solvers. Experimental results show that the technique enables an order of magnitude reduction in the number of test cases to be considered.

Access control vulnerabilities that lead to elevated privileges are among the most dangerous vulnerabilities in Web applications. Most of the existing detection methods use dynamic or static analysis techniques alone, which suffer from high manual involvement, low automation, high leakage rate, low page coverage, and other deficiencies. To this end, this paper proposes a novel access control vulnerability detection method (DetAC) based on a sitemap model with global information representation. This method first constructs a static site-wide sitemap model based on the page link addresses in the Web application source code through static analysis techniques. After that, the application is logged in and executed dynamically with different role users. During this process, execution traces and request parameters are collected and converted into annotations to fill the corresponding edges of the static site-wide sitemap model. Then, the sitemap model with global information representation is obtained. This model can represent both the global control flow and data flow of the application. Then DetAC analyzes the role-based and user-based access control policies of the Web application based on the node reachability and annotated data features of the model. And according to the information such as role, user, and access resources, it generates attack vectors to achieve different roles and the same role of different users to access each other’s resources. Finally, access control vulnerabilities are detected based on the equivalence of the results obtained using attack vector access and normal access to the Web application server. DetAC was validated on five real open-source Web applications, and the results showed that DetAC successfully detected up to 12 access control vulnerabilities, which are more than those of the traditional seven tools. The dynamic analysis page coverage rate was significantly improved during the detection process, reaching an average of 91.37%.