Malicious software programs usually bypass the detection of anti-virus software by hiding themselves among apparently legitimate programs.In this work,we propose Windows Virtual Machine Introspection（WVMI）to accurat...Malicious software programs usually bypass the detection of anti-virus software by hiding themselves among apparently legitimate programs.In this work,we propose Windows Virtual Machine Introspection（WVMI）to accurately detect those hidden processes by analyzing memory data.WVMI dumps in-memory data of the target Windows operating systems from hypervisor and retrieves EPROCESS structures’address of process linked list first,and then generates Data Type Confidence Table（DTCT）.Next,it traverses the memory and identifies the similarities between the nodes in process linked list and the corresponding segments in the memory by utilizing DTCT.Finally,it locates the segments of Windows’EPROCESS and identifies the hidden processes by further comparison.Through extensive experiments,our experiment shows that the WVMI detects the hidden process with high identification rate,and it is independent of different versions of Windows operating system.展开更多
This paper investigates the feedback control of hidden Markov process（HMP） in the face of loss of some observation processes.The control action facilitates or impedes some particular transitions from an inferred cur...This paper investigates the feedback control of hidden Markov process（HMP） in the face of loss of some observation processes.The control action facilitates or impedes some particular transitions from an inferred current state in the attempt to maximize the probability that the HMP is driven to a desirable absorbing state.This control problem is motivated by the need for judicious resource allocation to win an air operation involving two opposing forces.The effectiveness of a receding horizon control scheme based on the inferred discrete state is examined.Tolerance to loss of sensors that help determine the state of the air operation is achieved through a decentralized scheme that estimates a continuous state from measurements of linear models with additive noise.The discrete state of the HMP is identified using three well-known detection schemes.The sub-optimal control policy based on the detected state is implemented on-line in a closed-loop,where the air operation is simulated as a stochastic process with SimEvents,and the measurement process is simulated for a range of single sensor loss rates.展开更多
Security tools are rapidly developed as network security threat is becoming more and more serious.To overcome the fundamental limitation of traditional host-based anti-malware system which is likely to be deceived and...Security tools are rapidly developed as network security threat is becoming more and more serious.To overcome the fundamental limitation of traditional host-based anti-malware system which is likely to be deceived and attacked by malicious codes,VMM-based anti-malware systems have recently become a hot research field.In this article,the existing malware hiding technique is analyzed,and a detecting model for hidden process based on "In-VM" idea is also proposed.Based on this detecting model,a hidden process detection technology which is based on HOOK SwapContext on the VMM platform is also implemented successfully.This technology can guarantee the detecting method not to be attacked by malwares and also resist all the current process hiding technologies.In order to detect the malwares which use remote injection method to hide themselves,a method by hijacking sysenter instruction is also proposed.Experiments show that the proposed methods guarantee the isolation of virtual machines,can detect all malware samples,and just bring little performance loss.展开更多
隐蔽火区地表碳通量监测对评估其温室效应及火区范围圈定十分重要。针对碳通量影响因素多、难预测等问题,提出了一种基于灰狼优化算法(Grey Wolf Optimization,GWO)-改进高斯过程回归(Gaussian Process Regression,GPR)-核密度估计(Kern...隐蔽火区地表碳通量监测对评估其温室效应及火区范围圈定十分重要。针对碳通量影响因素多、难预测等问题,提出了一种基于灰狼优化算法(Grey Wolf Optimization,GWO)-改进高斯过程回归(Gaussian Process Regression,GPR)-核密度估计(Kernel Density Estimation,KDE)预测模型。采用格拉布斯检验法剔除异常值,运用GWO优化GPR算法中的超参数,以提高预测精度。使用验证集预测误差并进行KDE建模,得到碳通量的区间预测值,进而针对组合模型的泛化能力及参数敏感性分析进行评估。结果显示:GWO-GPR-KDE模型的平均绝对误差、均方根误差、决定系数、80%置信区间宽度和95%置信区间宽度分别为0.95386、1.2663、0.92656、0.387和0.823,这些评估指标均优于随机森林(Random Forest,RF)、反向传播神经网络(Back Propagation Neural Network,BPNN)、结合多层感知器的支持向量机(Multilayer Perceptron-Support Vector Machine,MLP-SVM)、高斯过程回归(Gaussian Process Regression,GPR)等经典模型。GWO-GPR-KDE模型对隐蔽火区地表碳通量预测具有较好的准确性和泛化性,为煤田火区防控和温室效应评估提供了新思路。展开更多
Aspects of human behavior in cyber security allow more natural security to the user. This research focuses the appearance of anticipating cyber threats and their abstraction hierarchy levels on the mental picture leve...Aspects of human behavior in cyber security allow more natural security to the user. This research focuses the appearance of anticipating cyber threats and their abstraction hierarchy levels on the mental picture levels of human. The study concerns the modeling of the behaviors of mental states of an individual under cyber attacks. The mental state of agents being not observable, we propose a non-stationary hidden Markov chain approach to model the agent mental behaviors. A renewal process based on a nonparametric estimation is also considered to investigate the spending time in a given mental state. In these approaches, the effects of the complexity of the cyber attacks are taken into account in the models.展开更多
Nowadays remote sensing is an important technique for observing Earth surface applied to different areas such as, land use, urban planning, remote monitoring, real time deformation of the soil that can be associated w...Nowadays remote sensing is an important technique for observing Earth surface applied to different areas such as, land use, urban planning, remote monitoring, real time deformation of the soil that can be associated with earthquakes or landslides, the variations in thickness of the glaciers, the measurement of volume changes in the case of volcanic eruptions, deforestation, etc. To follow the evolution of these phenomena and to predict their future states, many approaches have been proposed. However, these approaches do not respond completely to the specialists who process yet more commonly the data extracted from the images in their studies to predict the future. In this paper, we propose an innovative methodology based on hidden Markov models (HMM). Our approach exploits temporal series of satellite images in order to predict spatio-temporal phenomena. It uses HMM for representing and making prediction concerning any objects in a satellite image. The first step builds a set of feature vectors gathering the available information. The next step uses a Baum-Welch learning algorithm on these vectors for detecting state changes. Finally, the system interprets these changes to make predictions. The performance of our approach is evaluated by tests of space-time interpretation of events conducted over two study sites, using different time series of SPOT images and application to the change in vegetation with LANDSAT images.展开更多
基金Supported by the National Natural Science Foundation of China(61170026)
文摘Malicious software programs usually bypass the detection of anti-virus software by hiding themselves among apparently legitimate programs.In this work,we propose Windows Virtual Machine Introspection（WVMI）to accurately detect those hidden processes by analyzing memory data.WVMI dumps in-memory data of the target Windows operating systems from hypervisor and retrieves EPROCESS structures’address of process linked list first,and then generates Data Type Confidence Table（DTCT）.Next,it traverses the memory and identifies the similarities between the nodes in process linked list and the corresponding segments in the memory by utilizing DTCT.Finally,it locates the segments of Windows’EPROCESS and identifies the hidden processes by further comparison.Through extensive experiments,our experiment shows that the WVMI detects the hidden process with high identification rate,and it is independent of different versions of Windows operating system.
文摘This paper investigates the feedback control of hidden Markov process（HMP） in the face of loss of some observation processes.The control action facilitates or impedes some particular transitions from an inferred current state in the attempt to maximize the probability that the HMP is driven to a desirable absorbing state.This control problem is motivated by the need for judicious resource allocation to win an air operation involving two opposing forces.The effectiveness of a receding horizon control scheme based on the inferred discrete state is examined.Tolerance to loss of sensors that help determine the state of the air operation is achieved through a decentralized scheme that estimates a continuous state from measurements of linear models with additive noise.The discrete state of the HMP is identified using three well-known detection schemes.The sub-optimal control policy based on the detected state is implemented on-line in a closed-loop,where the air operation is simulated as a stochastic process with SimEvents,and the measurement process is simulated for a range of single sensor loss rates.
基金National High Technical Research and Development Program of China(863 Program)under Grant No. 2008AA01Z414
文摘Security tools are rapidly developed as network security threat is becoming more and more serious.To overcome the fundamental limitation of traditional host-based anti-malware system which is likely to be deceived and attacked by malicious codes,VMM-based anti-malware systems have recently become a hot research field.In this article,the existing malware hiding technique is analyzed,and a detecting model for hidden process based on "In-VM" idea is also proposed.Based on this detecting model,a hidden process detection technology which is based on HOOK SwapContext on the VMM platform is also implemented successfully.This technology can guarantee the detecting method not to be attacked by malwares and also resist all the current process hiding technologies.In order to detect the malwares which use remote injection method to hide themselves,a method by hijacking sysenter instruction is also proposed.Experiments show that the proposed methods guarantee the isolation of virtual machines,can detect all malware samples,and just bring little performance loss.
文摘隐蔽火区地表碳通量监测对评估其温室效应及火区范围圈定十分重要。针对碳通量影响因素多、难预测等问题,提出了一种基于灰狼优化算法(Grey Wolf Optimization,GWO)-改进高斯过程回归(Gaussian Process Regression,GPR)-核密度估计(Kernel Density Estimation,KDE)预测模型。采用格拉布斯检验法剔除异常值,运用GWO优化GPR算法中的超参数,以提高预测精度。使用验证集预测误差并进行KDE建模,得到碳通量的区间预测值,进而针对组合模型的泛化能力及参数敏感性分析进行评估。结果显示:GWO-GPR-KDE模型的平均绝对误差、均方根误差、决定系数、80%置信区间宽度和95%置信区间宽度分别为0.95386、1.2663、0.92656、0.387和0.823,这些评估指标均优于随机森林(Random Forest,RF)、反向传播神经网络(Back Propagation Neural Network,BPNN)、结合多层感知器的支持向量机(Multilayer Perceptron-Support Vector Machine,MLP-SVM)、高斯过程回归(Gaussian Process Regression,GPR)等经典模型。GWO-GPR-KDE模型对隐蔽火区地表碳通量预测具有较好的准确性和泛化性,为煤田火区防控和温室效应评估提供了新思路。
文摘Aspects of human behavior in cyber security allow more natural security to the user. This research focuses the appearance of anticipating cyber threats and their abstraction hierarchy levels on the mental picture levels of human. The study concerns the modeling of the behaviors of mental states of an individual under cyber attacks. The mental state of agents being not observable, we propose a non-stationary hidden Markov chain approach to model the agent mental behaviors. A renewal process based on a nonparametric estimation is also considered to investigate the spending time in a given mental state. In these approaches, the effects of the complexity of the cyber attacks are taken into account in the models.
文摘Nowadays remote sensing is an important technique for observing Earth surface applied to different areas such as, land use, urban planning, remote monitoring, real time deformation of the soil that can be associated with earthquakes or landslides, the variations in thickness of the glaciers, the measurement of volume changes in the case of volcanic eruptions, deforestation, etc. To follow the evolution of these phenomena and to predict their future states, many approaches have been proposed. However, these approaches do not respond completely to the specialists who process yet more commonly the data extracted from the images in their studies to predict the future. In this paper, we propose an innovative methodology based on hidden Markov models (HMM). Our approach exploits temporal series of satellite images in order to predict spatio-temporal phenomena. It uses HMM for representing and making prediction concerning any objects in a satellite image. The first step builds a set of feature vectors gathering the available information. The next step uses a Baum-Welch learning algorithm on these vectors for detecting state changes. Finally, the system interprets these changes to make predictions. The performance of our approach is evaluated by tests of space-time interpretation of events conducted over two study sites, using different time series of SPOT images and application to the change in vegetation with LANDSAT images.
