Polygraph: Automatically generating signatures for polymorphic worms

It is widely believed that content-signature-based intrusion detection systems (IDSes) are easily evaded by polymorphic worms, which vary their payload on every infection attempt. In this paper, we present Polygraph, a signature generation system that successfully produces signatures that match polymorphic worms. Polygraph generates signatures that consist of multiple disjoint content sub-strings. In doing so, Polygraph leverages our insight that for a real-world exploit to function properly, multiple invariant substrings must often be present in all variants of a payload; these substrings typically correspond to protocol framing, return addresses, and in some cases, poorly obfuscated code. We contribute a definition of the polymorphic signature generation problem; propose classes of signature suited for matching polymorphic worm payloads; and present algorithms for automatic generation of signatures in these classes. Our evaluation of these algorithms on a range of polymorphic worms demonstrates that Polygraph produces signatures for polymorphic worms that exhibit low false negatives and false positives. © 2005 IEEE

Equivalence-based Security for Querying Encrypted Databases: Theory and Application to Privacy Policy Audits

Motivated by the problem of simultaneously preserving confidentiality and usability of data outsourced to third-party clouds, we present two different database encryption schemes that largely hide data but reveal enough information to support a wide-range of relational queries. We provide a security definition for database encryption that captures confidentiality based on a notion of equivalence of databases from the adversary's perspective. As a specific application, we adapt an existing algorithm for finding violations of privacy policies to run on logs encrypted under our schemes and observe low to moderate overheads.Comment: CCS 2015 paper technical report, in progres

On Horizontal and Vertical Separation in Hierarchical Text Classification

Hierarchy is a common and effective way of organizing data and representing their relationships at different levels of abstraction. However, hierarchical data dependencies cause difficulties in the estimation of "separable" models that can distinguish between the entities in the hierarchy. Extracting separable models of hierarchical entities requires us to take their relative position into account and to consider the different types of dependencies in the hierarchy. In this paper, we present an investigation of the effect of separability in text-based entity classification and argue that in hierarchical classification, a separation property should be established between entities not only in the same layer, but also in different layers. Our main findings are the followings. First, we analyse the importance of separability on the data representation in the task of classification and based on that, we introduce a "Strong Separation Principle" for optimizing expected effectiveness of classifiers decision based on separation property. Second, we present Hierarchical Significant Words Language Models (HSWLM) which capture all, and only, the essential features of hierarchical entities according to their relative position in the hierarchy resulting in horizontally and vertically separable models. Third, we validate our claims on real-world data and demonstrate that how HSWLM improves the accuracy of classification and how it provides transferable models over time. Although discussions in this paper focus on the classification problem, the models are applicable to any information access tasks on data that has, or can be mapped to, a hierarchical structure.Comment: Full paper (10 pages) accepted for publication in proceedings of ACM SIGIR International Conference on the Theory of Information Retrieval (ICTIR'16

On the predominant mechanisms active during the high power diode laser modification of the wettability characteristics of an SiO2/Al2O3-based ceramic material

The mechanisms responsible for modifications to the wettability characteristics of a SiO2/Al2O3-based ceramic material in terms of a test liquid set comprising of human blood, human blood plasma, glycerol and 4-octonol after high power diode laser (HPDL) treatment have been elucidated. Changes in the contact angle, , and hence the wettability characteristics of the SiO2/Al2O3-based ceramic were attributed primarily to: modifications to the surface roughness of the ceramic resulting from HPDL interaction which accordingly effected reductions in ; the increase in the surface O2 content of the ceramic after HPDL treatment; since an increase in surface O2 content intrinsically brings about a decrease in , and vice versa and the increase in the polar component of the surface energy, due to the HPDL induced surface melting and resolidification which consequently created a partially vitrified microstructure that was seen to augment the wetting action. However, the degree of influence exerted by each mechanism was found to differ markedly. Isolation of each of these mechanisms permitted the magnitude of their influence to be qualitatively determined. Surface energy, by way of microstructural changes, was found to be by far the most predominant element governing the wetting characteristics of the SiO2/Al2O3-based ceramic. To a much lesser extent, surface O2 content, by way of process gas, was also seen to influence to a changes in the wettability characteristics of the SiO2/Al2O3-based ceramic, whilst surface roughness was found to play a minor role in inducing changes in the wettability characteristics

Geometric Phase, Hannay's Angle, and an Exact Action Variable

Canonical structure of a generalized time-periodic harmonic oscillator is studied by finding the exact action variable (invariant). Hannay's angle is defined if closed curves of constant action variables return to the same curves in phase space after a time evolution. The condition for the existence of Hannay's angle turns out to be identical to that for the existence of a complete set of (quasi)periodic wave functions. Hannay's angle is calculated, and it is shown that Berry's relation of semiclassical origin on geometric phase and Hannay's angle is exact for the cases considered.Comment: Submitted to Phys. Rev. Lett. (revised version

Direct Imaging of Multiple Planets Orbiting the Star HR 8799

Direct imaging of exoplanetary systems is a powerful technique that can reveal Jupiter-like planets in wide orbits, can enable detailed characterization of planetary atmospheres, and is a key step towards imaging Earth-like planets. Imaging detections are challenging due to the combined effect of small angular separation and large luminosity contrast between a planet and its host star. High-contrast observations with the Keck and Gemini telescopes have revealed three planets orbiting the star HR 8799, with projected separations of 24, 38, and 68 astronomical units. Multi-epoch data show counter-clockwise orbital motion for all three imaged planets. The low luminosity of the companions and the estimated age of the system imply planetary masses between 5 and 13 times that of Jupiter. This system resembles a scaled-up version of the outer portion of our Solar System.Comment: 30 pages, 5 figures, Research Article published online in Science Express Nov 13th, 200

Quark deconfinement phase transition for improved quark mass density-dependent model

By using the finite temperature quantum field theory, we calculate the finite temperature effective potential and extend the improved quark mass density-dependent model to finite temperature. It is shown that this model can not only describe the saturation properties of nuclear matter, but also explain the quark deconfinement phase transition successfully. The critical temperature is given and the effect of $\omega$- meson is addressed.Comment: 18 pages, 7 figure

Robust Preparation of GHZ and W States of Three Distant Atoms

Schemes to generate Greenberger-Horne-Zeilinger(GHZ) and W states of three distant atoms are proposed in this paper. The schemes use the effects of quantum statistics of indistinguishable photons emitted by the atoms inside optical cavities. The advantages of the schemes are their robustness against detection inefficiency and asynchronous emission of the photons. Moreover, in Lamb-Dicke limit, the schemes do not require simultaneous click of the detectors, this makes the schemes more realizable in experiments.Comment: 5 pages, 1 fiure. Phys. Rev. A 75, 044301 (2007

Bunching Transitions on Vicinal Surfaces and Quantum N-mers

We study vicinal crystal surfaces with the terrace-step-kink model on a discrete lattice. Including both a short-ranged attractive interaction and a long-ranged repulsive interaction arising from elastic forces, we discover a series of phases in which steps coalesce into bunches of n steps each. The value of n varies with temperature and the ratio of short to long range interaction strengths. We propose that the bunch phases have been observed in very recent experiments on Si surfaces. Within the context of a mapping of the model to a system of bosons on a 1D lattice, the bunch phases appear as quantum n-mers.Comment: 5 pages, RevTex; to appear in Phys. Rev. Let