Scalable N-worst algorithms for dynamic timing and activity analysis

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

In light of increasing energy overheads required to guarantee correctness as variations increase with continued technology scaling, better-than-worst-case (BTWC) design has become a hot topic. Several BTWC design techniques utilize dynamic information like path activity when optimizing a design and rely on path-based analysis to determine the dynamic slack distribution of a workload running on a processor and subsequently optimize a design. In this paper, we show that path-based techniques are not scalable, due to the enormous number of paths in modern designs, and can also result in incorrect results. We propose a graph-based technique for performing dynamic timing and activity analysis of a workload on a processor that addresses the limitations of path-based techniques. Our tool has significantly lower runtime and memory requirements than path-based tools. Consequently, we can perform analysis for larger designs over longer time windows in a shorter amount of time. We also propose two optimizations that improve the performance of our tool.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

Dynamic impact analysis based on program executions has shown promise in aiding tasks in the life cycle of large-scale systems. Dynamic impact analysis techniques have shown to produce more precise results than static impact analysis [1]. However, current dynamic impact analysis techniques lack important features such as analysis of dependency among program entities and consideration of object-oriented programs ' features. Thus they may produce imprecise results. In this paper, we present a precise dynamic impact analysis approach for object-oriented programs. This approach considers the characteristics of object- oriented programs and performs dependency analysis which may potentially reduce the impact sets by eliminating elements that do not have dependency on the changed elements. Even though our discussion in this paper is based on Java <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">TM</sup> programming language, this approach can be carried out in a language independent manner for broader applications.

Objectives: 1. To propose a framework for Malware Classification System (MCS) to analyze malware behavior dynamically using a concept of information theory and a machine learning technique. 2. To extract behavioral patterns from execution reports of malware in terms of its features and generates a data repository. 3. To select the most promising features using information theory based concepts. Methods/Statistical Analysis: Today, malware is a major concern of computer security experts. Variety and in- creasing number of malware affects millions of systems in the form of viruses, worms, Trojans etc. Many techniques have been proposed to analyze the malware to its class accurately. Some of analysis techniques analyzed malware based upon its structure, code flow, etc. without executing it (called static analysis), whereas other techniques (termed as dynamic analysis) focused to monitor the behavior of malware by executing it and comparing it with known malware behavior. Dynamic analysis has proved to be effective in malware detection as behavior is more difficult to mask while executing than its underlying code (static analysis). In this study, we propose a framework for Malware Classification System (MCS) to analyze malware behavior dynamically using a concept of information theory and a machine learning technique. The proposed framework extracts behavioral patterns from execution reports of malware in terms of its features and generates a data repository. Further, it selects the most promising features using information theory based concepts. Findings: The proposed framework detects the family of unknown malware samples after training of a classifier from malware data repository. We validated the applicability of the proposed framework by comparing with the other dynamic malware analysis technique on a real malware dataset from Virus Total. Application: The proposed framework is a Malware Classification System (MCS) to analyze malware behavior dynamically using a concept of information theory and a machine learning technique.

Dynamic analysis techniques reason over program executions and deal with data produced at program execution time. Dynamic analysis and static analysis techniques complement each other. Hence, a key focus of the workshop is dynamic analysis of software systems with an emphasis on research that integrates static and dynamic analyses.

During the past several years there have been published a number of excellent papers on dynamic analyses. These papers have dealt largely with the qualitative aspects of the subject in order to point out the significance of the dynamic loads as well as to determine important factors affecting them. However, in the light of current specifications that will require dynamic analyses of a large percentage of future designs, there exists a need for comprehensive quantitative comparisons between theoretical and experimental data in order tha t the dynamics engineer may assess current methods and future analysis needs. This paper presents such a study made for discrete vertical gusts on the B-47. The study was undertaken to determine whether or not realistic loads could be predicted using presently available dynamic analysis techniques. Experimental data were obtained from a B-47 (instrumented to record the time histories of shears and moments at various wing stations, as well as the time history of the e.g. acceleration) flown over a gust course. Theoretical dynamic analyses were made for experimental conditions in which discrete gusts were encountered with a relatively smooth entry. The results of these analyses are compared with the experimental results. The experimental loads are also compared with experimental maneuvering loads in order to evaluate the accuracy of the loads formula used in conjunction with a steady-state analysis. In initial studies the effect of various analysis techniques were investigated. Results are presented which show the effect of including various airplane elastic modes and of computing loads by an approximate method. The equations of motion and the finite difference equations are derived and presented with the load equations in the Appendix. The equations are in a form suitable for the solution of large problems by digital computing techniques. Final results are given in the Conclusions.

Hydropower plants operating in fragile mountainous regions face severe sediment erosion of hydraulic turbines, resulting in decreased efficiency, frequent power interruptions, and downtime for maintenance. The sediment size and shape are detrimental to the hydraulic turbines and influence sediment erosion. Sediment management is a crucial aspect of tackling sediment erosion in hydraulic turbines. The traditional method of measuring particle size and shape is time-consuming, labour-intensive, and usually requires statistical analysis. The present study applies the recent technique of dynamic imaging analysis to determine the particle size distribution and shape of sediment. Five different silt-sand mixtures have been used to check the ability of dynamic imaging analysis. Further, the repeatability and reliability of the results were checked by carrying out five repeated measurements of each sample under the same condition in a short period of time. This study will help the researchers and sedimentologists to adopt the dynamic imaging analysis technique for measuring particle size and shape and help the instrument developer in designing a better future version of the instrument.

Programmers using complex libraries and frameworks are faced with the difficult task of ensuring that their implementations comply with complex and informally described rules for proper sequencing of API calls. Recent advances in static and dynamic techniques for checking explicit specifications of program typestate properties have shown promise in addressing this challenge. Unfortunately, static typestate analyses are limited in their scalability and dynamic analyses can suffer from significant run-time overhead. In this paper, we present an approach that exploits information calculated by flow-sensitive static typestate analyses to reformulate the original analysis problem as a residual dynamic typestate analysis. We demonstrate that residual analyses retain the error reporting of unoptimized dynamic analysis while offering the potential for significantly reducing analysis cost

Dynamic mechanical analysis (DMA) techniques are commonly applied to characterize polymer-based materials - but little if at all to characterize semiconductor thermoelectric (TE) materials. TE materials may be coupled with polymeric materials in advanced thermoelectric devices, and the knowledge of TE material properties will be useful in the choice of materials for future applications. We have obtained DMA results for both n-type and p-type bismuth telluride based TE materials. We find that tan δ values, indicative of viscoelastic energy dissipation modes, approach the values for glassy or semi-crystalline polymers, and are larger by more than a whole order of magnitude than the tan δ of structural metals. DMA thermal scans show clear hysteresis-type effects and a correlation with differential scanning calorimetry thermal transitions. DMA properties as a function of frequency are briefly discussed. Our results show that DMA techniques are useful in the evaluation of thermophysical and thermomechanical properties of these TE materials and of assembled coolers. The viscoelastic effects we report may provide a damping mechanism for severe stresses inherent to service conditions of the TE coolers.

The determination of the mechanical properties of polymers is more complex than that of many other structural materials, because they display time-dependence in their response to load. Generally, dynamic analysis techniques, such as dynamic mechanical thermal analysis (DMTA), are used to characterize the viscoelastic properties of bulk polymers. However, polymers are increasingly being used as thin films, the properties of which are not readily determined using conventional techniques. Nanoindentation offers the possibility of determining the properties of thin films but has generally only been used to measure static properties. Dynamic nanoindentation equipment has recently become available, but its accuracy with soft polymers is unproven. This paper presents results of a comparison between dynamic nanoindentation, DMTA, and differential scanning calorimetry (DSC) for the determination of the thermal response of four different polymers. A favorable comparison is shown, indicating that dynamic nanoindentation is capable of measuring the time-dependent properties of small samples of polymers.

Dynamic analysis extracts information that describes the structure of the runtime behavior of a software system. This information, typically represented in the form of execution traces, is useful in many software modernization activities, such as reverse engineering and program analysis. The Architecture-Driven Modernization initiative has defined standards to support the modernization process in the context of Model-Driven Engineering (MDE). However, to date, there is no standard for representing runtime information that allows the specification of dynamic information independent of any programming language. In light of this, we present TRACEM, a metamodel for representing trace information under a standard representation that would allow traces to become a new domain in software engineering. The purpose of defining TRACEM is to complement an MDE framework for software modernization that aims to integrate static and dynamic analysis techniques during the reverse engineering process. This article contains a description of TRACEM and a case study that illustrates how dynamic information combined with static information allows for improving the whole reverse engineering process.

Malware remains one of the most persistent and evolving threats to cybersecurity, necessitating robust analysis techniques to understand and mitigate its impact. This study presents a comprehensive analysis of selected malware samples using both static and dynamic analysis techniques. In the static phase, file structure, embedded strings, and code signatures were examined, while in the dynamic analysis phase, the malware was executed in a virtual sandbox environment to observe process creation, network communication, and file system changes. By combining these two approaches, various types of malware files could be characterized and have their key elements revealed. This improved the understanding of the code capabilities and evasive behaviors of malicious files. The goal of these analyses was to create a database of malware profiling tools and tools that can be utilized to identify and analyze malware. The results demonstrate that integrating static and dynamic methodologies improves the accuracy of malware profiling and supports more effective threat detection and incident response strategies.

Dynamic analysis techniques have been proposed to detect potential deadlocks. Analyzing and comprehending each potential deadlock to determine whether the deadlock is feasible in a real execution requires significant programmer effort. Moreover, empirical evidence shows that existing analyses are quite imprecise. This imprecision of the analyses further void the manual effort invested in reasoning about non-existent defects.In this paper, we address the problems of imprecision of existing analyses and the subsequent manual effort necessary to reason about deadlocks. We propose a novel approach for deadlock detection by designing a dynamic analysis that intelligently leverages execution traces. To reduce the manual effort, we replay the program by making the execution follow a schedule derived based on the observed trace. For a real deadlock, its feasibility is automatically verified if the replay causes the execution to deadlock.We have implemented our approach as part of WOLF and have analyzed many large (upto 160KLoC) Java programs. Our experimental results show that we are able to identify 74% of the reported defects as true (or false) positives automatically leaving very few defects for manual analysis. The overhead of our approach is negligible making it a compelling tool for practical adoption.