近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数...近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标(IOC,indicators of compromise)提取系统XLMRevealer;在此基础上,根据XLM代码特点提取Word和Token特征,通过特征融合能够捕获多层次细粒度特征,并在XLMRevealer中构造CNN-BiLSTM(convolution neural network-bidirectional long short term memory)模型,从不同维度挖掘家族样本的关联性和完成家族分类。最后,从5个来源构建包含2346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明,XLMRevealer的反混淆成功率达到71.3%,相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%;反混淆效率稳定,平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%,效果优于所有基线模型,有效体现Word和Token特征融合的优势。此外,为探索反混淆对家族分类的影响,并考虑不同家族使用的混淆技术可能有所不同,模型会识别到混淆技术的特征,分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验,家族分类准确率为89.58%、53.61%,证明模型能够学习混淆技术特征,更验证了反混淆对家族分类极大的促进作用。展开更多
Agricultural flash droughts are high-impact phenomena, characterized by rapid soil moisture dry down. The ensuing dry conditions can persist for weeks to months, with detrimental effects on natural ecosystems and crop...Agricultural flash droughts are high-impact phenomena, characterized by rapid soil moisture dry down. The ensuing dry conditions can persist for weeks to months, with detrimental effects on natural ecosystems and crop cultivation. Increases in the frequency of these rare events in a future warmer climate would have significant societal impact. This study uses an ensemble of 10 Coupled Model Intercomparison Project(CMIP) models to investigate the projected change in agricultural flash drought during the 21st century. Comparison across geographical regions and climatic zones indicates that individual events are preceded by anomalously low relative humidity and precipitation, with long-term trends governed by changes in temperature, relative humidity, and soil moisture. As a result of these processes, the frequency of both upperlevel and root-zone flash drought is projected to more than double in the mid-and high latitudes over the 21st century, with hot spots developing in the temperate regions of Europe, and humid regions of South America, Europe, and southern Africa.展开更多
This study employs a quantitative approach to comprehensively investigate the full propagation process of agricultural drought, focusing on pigeon peas (the most grown crop in the AGS Basin) planting seasonal variatio...This study employs a quantitative approach to comprehensively investigate the full propagation process of agricultural drought, focusing on pigeon peas (the most grown crop in the AGS Basin) planting seasonal variations. The study modelled seasonal variabilities in the seasonal Standardized Precipitation Index (SPI) and Standardized Agricultural Drought Index (SADI). To necessitate comparison, SADI and SPI were Normalized (from −1 to 1) as they had different ranges and hence could not be compared. From the seasonal indices, the pigeon peas planting season (July to September) was singled out as the most important season to study agricultural droughts. The planting season analysis selected all years with severe conditions (2008, 2009, 2010, 2011, 2017 and 2022) for spatial analysis. Spatial analysis revealed that most areas in the upstream part of the Basin and Coastal region in the lowlands experienced severe to extreme agricultural droughts in highlighted drought years. The modelled agricultural drought results were validated using yield data from two stations in the Basin. The results show that the model performed well with a Pearson Coefficient of 0.87 and a Root Mean Square Error of 0.29. This proactive approach aims to ensure food security, especially in scenarios where the Basin anticipates significantly reduced precipitation affecting water available for agriculture, enabling policymakers, water resource managers and agricultural sector stakeholders to equitably allocate resources and mitigate the effects of droughts in the most affected areas to significantly reduce the socioeconomic drought that is amplified by agricultural drought in rainfed agriculture river basins.展开更多
文摘近年来,使用恶意Excel 4.0宏(XLM)文档的攻击迎来了爆发,而XLM代码往往经过复杂的混淆,现有方法或检测系统难以分析海量样本的真实功能。因此,针对恶意样本中使用的各类混淆技术,基于抽象语法树和模拟执行,设计和实现了包含138个宏函数处理程序的自动化XLM反混淆与关键威胁指标(IOC,indicators of compromise)提取系统XLMRevealer;在此基础上,根据XLM代码特点提取Word和Token特征,通过特征融合能够捕获多层次细粒度特征,并在XLMRevealer中构造CNN-BiLSTM(convolution neural network-bidirectional long short term memory)模型,从不同维度挖掘家族样本的关联性和完成家族分类。最后,从5个来源构建包含2346个样本的数据集并用于反混淆实验和家族分类实验。实验结果表明,XLMRevealer的反混淆成功率达到71.3%,相比XLMMacroDeobfuscator和SYMBEXCEL工具分别提高了20.8%和15.8%;反混淆效率稳定,平均耗时仅为0.512 s。XLMRevealer对去混淆XLM代码的家族分类准确率高达94.88%,效果优于所有基线模型,有效体现Word和Token特征融合的优势。此外,为探索反混淆对家族分类的影响,并考虑不同家族使用的混淆技术可能有所不同,模型会识别到混淆技术的特征,分别对反混淆前和反混淆后再统一混淆的XLM代码进行实验,家族分类准确率为89.58%、53.61%,证明模型能够学习混淆技术特征,更验证了反混淆对家族分类极大的促进作用。
基金supported by the National Centre for Atmospheric Science through the NERC National Capability International Programmes Award (NE/ X006263/1)the Global Challenges Research Fund, via Atmospheric hazard in developing Countries: Risk assessment and Early Warning (ACREW) (NE/R000034/1)the Natural Environmental Research Council and the Department for Foreign International Development through the Sat WIN-ALERT project (NE/ R014116/1)。
文摘Agricultural flash droughts are high-impact phenomena, characterized by rapid soil moisture dry down. The ensuing dry conditions can persist for weeks to months, with detrimental effects on natural ecosystems and crop cultivation. Increases in the frequency of these rare events in a future warmer climate would have significant societal impact. This study uses an ensemble of 10 Coupled Model Intercomparison Project(CMIP) models to investigate the projected change in agricultural flash drought during the 21st century. Comparison across geographical regions and climatic zones indicates that individual events are preceded by anomalously low relative humidity and precipitation, with long-term trends governed by changes in temperature, relative humidity, and soil moisture. As a result of these processes, the frequency of both upperlevel and root-zone flash drought is projected to more than double in the mid-and high latitudes over the 21st century, with hot spots developing in the temperate regions of Europe, and humid regions of South America, Europe, and southern Africa.
文摘This study employs a quantitative approach to comprehensively investigate the full propagation process of agricultural drought, focusing on pigeon peas (the most grown crop in the AGS Basin) planting seasonal variations. The study modelled seasonal variabilities in the seasonal Standardized Precipitation Index (SPI) and Standardized Agricultural Drought Index (SADI). To necessitate comparison, SADI and SPI were Normalized (from −1 to 1) as they had different ranges and hence could not be compared. From the seasonal indices, the pigeon peas planting season (July to September) was singled out as the most important season to study agricultural droughts. The planting season analysis selected all years with severe conditions (2008, 2009, 2010, 2011, 2017 and 2022) for spatial analysis. Spatial analysis revealed that most areas in the upstream part of the Basin and Coastal region in the lowlands experienced severe to extreme agricultural droughts in highlighted drought years. The modelled agricultural drought results were validated using yield data from two stations in the Basin. The results show that the model performed well with a Pearson Coefficient of 0.87 and a Root Mean Square Error of 0.29. This proactive approach aims to ensure food security, especially in scenarios where the Basin anticipates significantly reduced precipitation affecting water available for agriculture, enabling policymakers, water resource managers and agricultural sector stakeholders to equitably allocate resources and mitigate the effects of droughts in the most affected areas to significantly reduce the socioeconomic drought that is amplified by agricultural drought in rainfed agriculture river basins.
