Learning metamorphic malware signatures from samples

Metamorphic malware identification using engine-specific patterns based on co-opcode graphs

As a powerful and object-oriented graphical modeling language, Unified Modeling Language (UML) has been introduced into the design and development of safety-critical computer systems. However, UML model is difficult to reflect the concurrency and consistency of constraint rules between objects and impossible to completely demonstrate the dynamic behavior characteristics of a system. Further, it cannot be directly expressed and analyzed by mathematical tools. Petri net modeling technology uses graphical element place and transition to clearly describe the internal interactions of a system. Meanwhile, Petri net has mature mathematical analysis methods. We have proposed to combine these two tools for designing and analyzing a system with a set of transformation rules from UML statecharts to Petri net. In this paper, an automatic conversion tool is introduced. The tool performs the transformation with three steps as follows: (1) Transforming UML model into XML document, which makes information extraction of the UML model become easier. (2) Analyzing semantics of UML model and Petri net model, then designing data structure for transformation, and completing the transformation based on the transformation rules. (3) Analyzing the transformed Petri net model to verify the characteristics of the UML model. The transformation rules and the tools are developed based on a new railway interlocking system.

In this paper we introduce a planning approach based on a method of deductive program synthesis. The program synthesis system we rely upon takes first-order specifications and from these derives recursive programs automatically. It uses a set of transformation rules whose applications are guided by an overall strategy. Additionally several heuristics are involved which considerably reduce the search space. We show by means of an example taken from the blocks world how even recursive plans can be obtained with this method. Some modifications of the synthesis strategy and heuristics are discussed, which are necessary to obtain a powerful and automatic planning system. Finally it is shown how subplans can be introduced and generated separately.

In this paper we address the problem of generating alternative solutions for implicit AND/OR DAGs which are described using a start state and a set of transformation rules. Unlike the explicit representation of AND/OR graph, for implicitly specified AND/OR graphs, the transformation rules are used to dynamically make a portion of an AND/OR graph explicit as per requirement. We propose an algorithm, ASGAO*, for generating alternative solutions for implicitly specified AND/OR graphs. Experimental results in several domains show that, on an average, our proposed algorithm performs hundred times better with respect to running time and fifty times better with respect to space than the existing algorithm. In view of the renewed research interest towards applying AND/OR graphs in domains like graphical model, constraint satisfaction, and service composition, it is not hard to see useful applications of ASGAO*.

The relationship between the set of productions of a context-free grammar and the corresponding set of defining equations is first pointed out. The closure operation on a matrix of strings is defined and this concept is used to formalize the solution to a set of linear equations. A procedure is then given for rewriting a context-free grammar in Greibach normal form, where the replacements string of each production begins with a terminal symbol. An additional procedure is given for rewriting the grammar so that each replacement string both begins and ends with a terminal symbol. Neither procedure requires the evaluation of regular begins and ends with a terminal symbol. Neither procedure requires the evaluation of regular expressions over the total vocabulary of the grammar, as is required by Greibach's procedure.

Malware landscape has been dramatically elevated over the last decade. The main reason of the increase is that new malware variants can be produced easily using simple code obfuscation techniques. Once the obfuscation is applied, the malware can change their syntactics while preserving semantics, and bypass anti-virus (AV) scanners. Malware authors, thus, commonly use the code obfuscation techniques to generate metamorphic malware. Nevertheless, signature based AV techniques are limited to detect the metamorphic malware since they are commonly based on the syntactic signature matching. In this paper, we propose BinGraph, a new mechanism that accurately discovers metamorphic malware. BinGraph leverages the semantics of malware, since the mutant malware is able to manipulate their syntax only. To this end, we first extract API calls from malware and convert to a hierarchical behavior graph that represents with identical 128 nodes based on the semantics. Later, we extract unique subgraphs from the hierarchical behavior graphs as semantic signatures representing common behaviors of a specific malware family. To evaluate BinGraph, we analyzed a total of 827 malware samples that consist of 10 malware families with 1,202 benign binaries. Among the malware, 20% samples randomly chosen from each malware family were used for extracting semantic signatures, and rest of them were used for assessing detection accuracy. Finally, only 32 subgraphs were selected as the semantic signatures. BinGraph discovered malware variants with 98% of detection accuracy.

Use Case (UC) quality impacts the overall quality and defect rate of a system, as they specify the expected behavior of an implementation. In a previous work, we have defined an approach for a step-by-step translation from UCs written in natural language to a formal description in terms of Graph Transformation (GT), where each step of the UC was translated to a transformation rule. This UC formalization enables the detection of several specification problems even before an actual implementation is produced, thus reducing development costs. In this paper, we extend our approach to handle UC evolution by defining evolution rules , which are described as higher-order rules, simultaneously changing the behavior of a set of transformation rules. We also support the use of negative application conditions (NAC) associated both to the transformation and evolution rules. Analysis of the interplay between the evolution rules and the rules describing UC steps shows the effects of an evolution and serves to identify potential impacts, even before the changes are actually carried out. Besides defining the theoretical foundations of UC evolution with NACs, we have implemented the evolution analysis technique in the Verigraph tool and used it to verify impacts in 3 different case studies. The results demonstrate the applicability and usefulness of our approach to help developers in the evolution process based on UCs.

A syntactic approach based on distortion-tolerant Adjacency Grammars and a spatial-directed parser to interpret sketched diagrams

Ontology is the fundamental part of Semantic Web. The goal of W3C is to bring the web into (its full potential) a semantic web with reusing previous systems and artifacts. Most legacy systems have been documented in structural analysis and structured design (SASD), especially in simple or Extended ER Diagram (ERD). Such systems need up-gradation to become the part of semantic web. In this paper, we present ERD to OWL-DL ontology transformation rules at concrete level. These rules facilitate an easy and understandable transformation from ERD to OWL. The set of rules for transformation is tested on a structured analysis and design example. The framework provides OWL ontology for semantic web fundamental. This framework helps software engineers in upgrading the structured analysis and design artifact ERD, to components of semantic web. Moreover our transformation tool, ER2OWL, reduces the cost and time for building OWL ontologies with the reuse of existing entity relationship models.

The main key in MDA is the models transformation. There are two kinds of transformations into MDA: CIM to PIM and PIM to PSM. Most researchers focused on the transformation from PIM to PSM, because there are several points in common between these two levels. But Transforming CIM to PIM is rarely discussed in research subjects because they are two different levels. This paper presents a methodology to master transformation of models from CIM level to PIM level respecting the MDA approach. Our proposal results from an analytical survey. From the beginning, in the CIM level, we take into consideration that we are into a process of creating business models that will be automatically transformed to PIM models. Our methodology is founded on creating a good CIM level, through well-chosen rules, to facilitate transformation to the PIM level. However, we establish a rich PIM level, respecting the three classic modeling views: functional, dynamic and static. Use case model presents functional view, state diagram model interprets the dynamic view, class and package models show the static view. Next, a set of transformation rules are implemented by ATL language to ensure a semi-automatic transformation from the CIM level to the PIM level. Our method conforms to MDA recommendations by considering the business dimension in the CIM level, and by modeling this latter level using BPMN notation which is the OMG standard for modeling business process. Nevertheless, we used UML models into the PIM level, because UML is recommended by MDA in this level.

PurposeWeb applications are subject to continuous changes and rapid evolution triggered by increasing competition, especially in commercial domains such as electronic commerce. Unfortunately, usually they are implemented without producing any useful documentation for subsequent maintenance and evolution. Thereof, the maintenance of such systems becomes a challenging problem as the complexity of the web application grows. Reverse engineering has been heralded as one of the most promising technologies to support effective web application maintenance. This paper aims to present a reverse engineering approach that helps understanding existing undocumented web applications to be maintained or evolved.Design/methodology/approachThe proposed approach provides reverse engineering rules to generate a conceptual schema from a given domain ontology by using a set of transformation rules. The reverse engineering process consists of four phases: extracting useful information; identifying a set of ontological constructs representing the concepts of interest; enriching the identified set by additional constructs; and finally deriving a conceptual schema.FindingsThe advantage of using ontology for conceptual data modeling is the reusability of domain knowledge. As a result, the conceptual data model will be made faster, easier and with fewer errors than creating it in usual way. Designers can use the extracted conceptual schema to gain a better understanding of web applications and to assist in their maintenance.Originality/valueThe strong point of this approach is that it relies on a very rich semantic reference that is domain ontology. However, it is not possible to make a straightforward transformation of all elements from a domain ontology into a conceptual data model because ontology is semantically richer than data conceptual models.

Although natural language processing (NLP) is now a popular area of research and development, less-resourced languages are not receiving much attention from developers. One of such under-resourced languages is Kafi-noonoo which is spoken in the south-western regions of Ethiopia. This paper presents the development of part-of-speech tagger for Kafi-noonoo. In order to develop the tagger, we employed a hybrid of two systems: statistical and rule-based taggers. The lexical and transitional probabilities of word classes are modeled using HMM. However, due to the limitation of corpus for the language, a set of transformation rules are applied to improve the result. The system was tested with test corpus and, with 90% of the corpus used for training, the hybrid tagger yielded an accuracy of 80.47%.KeywordsKafi-noonoo NLPPart-of-Speech TaggingHybrid Systems

This paper presents a refinement calculus for object systems with visibility, dynamic binding and mutual dependency. The intention is to support effective use of a relational model for specifying and reasoning in activities of an object system development process. The semantics framework will define the meaning of the combinators in the exactly same way as their counterparts in the imperative programming languages. This makes the approach more accessible to the users who are already familiar with the algebraic laws and the verification tools developed for these languages. The paper also provides a set of transformation rules in support of object system refinement.

Based on the in-depth analysis of the structure of DXF, STL files, there is lots of code information in entities of the 3D entity information-stored DXF files, which isn’t good for the use of the valuable information, ASCII format of STL files store the normal vector and vertex coordinates as 3D graphics data for storage in a cramped construction, easy for reading. While binary format of STL files store the information in bytes by rules. Take box as an example, and VC++6.0 programming language is used to program the data information, so as to read and display DXF file information, conduct data transformation according to the set of transformation rules, finally realizing the DXF and STL’s file transformation and displaying content, providing convenience for the file data reading of different platforms.

Data Warehouses (DWs) are currently considered to be the cornerstone of Business Intelligence (BI) systems. Security is a key issue in DWs since the business information that they manage is crucial and highly sensitive, and should be carefully protected. However, the increasing amount of data available on the Web signifies that more and more DW systems are considering the Web as the primary data source through which to populate their DWs. XML is therefore widely accepted as being the principal means through which to provide easier data and metadata interchange among heterogeneous data sources from the Web and the DW systems.Although security issues have been considered during the whole development process of traditional DWs, current research lacks approaches with which to consider security when the target platform is based on the Web and XML technologies. The idiosyncrasy of the unstructured and semi-structured data available on the Web definitely requires particular security rules that are specifically tailored to these systems in order to permit their particularities to be captured correctly.In order to tackle this situation, in this paper, we propose a methodological approach based on the Model Driven Architecture (MDA) for the development of Secure XML DWs. We therefore specify a set of transformation rules that are able to automatically generate not only the corresponding XML structure of the DW from secure conceptual DW models, but also the security rules specified within the DW XML structure, thus allowing us to implement both aspects simultaneously. A case study is provided at the end of the paper to show the benefits of our approach.