Information Flow Analysis Research Articles

Generating optimized gate level information flow tracking logic for enforcing multilevel security

Vulnerabilities such as design flaws, malicious codes and covert channels residing in hardware design are known to expose hard-to-detect security holes. However, security hole detection methods based on functional testing and verification cannot guarantee test coverage or identify malicious code triggered under specific conditions and hardware-specific covert channels. As a complement approach to cipher algorithms and access control, information flow analysis techniques have been proved to be effective in detecting security vulnerabilities and preventing attacks through side channels. Recently, gate level information flow tracking (GLIFT) has been proposed to enforce bittight information flow security from the level of Boolean gates, which allows detection of hardware-specific security vulnerabilities. However, the inherent high complexity of GLIFT logic causes significant overheads in verification time for static analysis or area and performance for physical implementation, especially under multilevel security lattices. This paper proposes to reduce the complexity of GLIFT logic through state encoding and logic optimization techniques. Experimental results show that our methods can reduce the complexity of GLIFT logic significantly, which will allow the application of GLIFT for proving multilevel information flow security.

Analysis of information flows among individual companies in the KOSDAQ market

In this paper, we employ the variance decomposition method to measure the strength and the direction of interconnections among companies in the KOSDAQ (Korean Securities Dealers Automated Quotation) stock market. We analyze the 200 companies listed on the KOSDAQ market from January 2001 to December 2015. We find that the systemic risk, measured by using the interconnections, increases substantially during periods of financial crisis such as the bankruptcy of Lehman brothers and the European financial crisis. In particular, we find that the increases in the aggregated information flows can be used to predict the increment of the market volatility that may occur during a sub-prime financial crisis period.

Hybrid Information Flow Analysis for Programs with Arrays

Information flow analysis checks whether certain pieces of (confidential) data may affect the results of computations in unwanted ways and thus leak information. Dynamic information flow analysis adds instrumentation code to the target software to track flows at run time and raise alarms if a flow policy is violated; hybrid analyses combine this with preliminary static analysis. Using a subset of C as the target language, we extend previous work on hybrid information flow analysis that handled pointers to scalars. Our extended formulation handles arrays, pointers to array elements, and pointer arithmetic. Information flow through arrays of pointers is tracked precisely while arrays of non-pointer types are summarized efficiently. A prototype of our approach is implemented using the Frama-C program analysis and transformation framework. Work on a full machine-checked proof of the correctness of our approach using Isabelle/HOL is well underway; we present the existing parts and sketch the rest of the correctness argument.

ИСПОЛЬЗОВАНИЕ НЕЧЕТКОГО КОГНИТИВНОГО МОДЕЛИРОВАНИЯ ДЛЯ ПРОВЕДЕНИЯ АУДИТА ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ИНФОРМАЦИОННЫХ ПОРТАЛОВ РЕГИОНАЛЬНЫХ ОРГАНОВ ИСПОЛНИТЕЛЬНОЙ ВЛАСТИ

At the present moment the internal policy is formed under complicated conditions of foreign situation. The regional policy is formed on the basis of index leveling in socio-economic development. The support of vital functions in social and economic systems of regions plays a role of no small importance in the system of executive power authority (EPA) including regional one. In the interests of assurance of public administration realization it is necessary to have at the disposal a condition for the existence of the vital functions process in social and economic systems. The in-formation portals which perform a role of information and management systems (IMS) have a significant element in the management of social and economic systems of a region. These systems allow performing online information gathering, storage, transfer, analysis and processing regarding a situation changing for deci-sion making. The IMS development makes new re-quirements to the realization of the methodology of process management, taking into account situation changes. The analysis of information flows of regional EPA witnesses of that for management decision making only 10-15% of available information is used to-day.

SAT를 이용한 정보흐름의 안전성 분석

As many people use internet through the various programs of PC and mobile devices, the possibility of private data leak is increasing. A program should be used after checking security of information flow. Security analysis of information flow is a method that analyzes security of information flow in program. If the information flow is secure, there is no leakage of personal information. If the information flow not secure, there may be a leakage of personal information. This paper proposes a method of analyzing information flow that facilitates SAT solver. The method translates a program that includes variables where security level is set into propositional formula representing control and information flow. The satisfiability of the formula translated is determined by using SAT solver. The security of program is represented through the result. Counter-example is generated if the program is not secure.

Exchange Rate Forecasting with Information Flow Approach

The purpose of this article is to assess exchange rate forecasting possibilities with an information flow approach model. In the model the three types of information flows are distinguished: fundamental analysis information flow through particular macroeconomic determinants, microstructure approach information flow through dealer clients’ positioning data, technical analysis information flow through technical indicators. By using regression analysis it is shown that the composed model can forecast the exchange rate, the most significant information flows are distinguished. The results lead to further development of the information flow approach as a tool to forecast exchange rate fluctuations.

Neuronal networks in epileptic encephalopathies with CSWS.

The aim of our study was to investigate the neuronal networks underlying background oscillations of epileptic encephalopathy with continuous spikes and waves during slow sleep (CSWS). Sleep electroencephalography (EEG) studies before and after the treatment were investigated in 15 patients with CSWS. To investigate functional and effective connectivity within the network generating the delta activity in the background sleep EEG, the methods of dynamic imaging of coherent sources (DICS) and renormalized partial directed coherence (RPDC) were applied. Independent of etiology and severity of epilepsy, background EEG pattern in patients with CSWS before treatment is associated with the complex network of coherent sources in medial prefrontal cortex, somatosensory association cortex/posterior cingulate cortex, medial prefrontal cortex, middle temporal gyrus/parahippocampal gyrus/insular cortex, thalamus, and cerebellum. The analysis of information flow within this network revealed that the medial parietal cortex, the precuneus, and the thalamus act as central hubs, driving the information flow to other areas, especially to the temporal and frontal cortex. The described CSWS-specific pattern was no longer observed in patients with normalized sleep EEG. In addition, frequency of spiking showed a strong linear correlations with absolute source power, source coherence strength, and source RPDC strength at both time points: (1) Spike and wave index (SWI) versus absolute source power at EEG1 (r = 0.56; p = 0.008) and at EEG2 (r = 0.45; p = 0.009); (2) SWI versus source coherence strength at EEG1 (r = 0.71; p = 0.005) and at EEG2 (r = 0.52; p = 0.006); and (3) SWI versus source RPDC strength at EEG1 (r = 0.65; p = 0.003) and at EEG2 (r = 0.47; p = 0.009). The leading role of the precuneus and thalamus in the hierarchical organization of the network underlying the background EEG points toward the significance of fluctuations of vigilance in the generation of CSWS. This hierarchical network organization appears to be specific for CSWS as it is resolved after successful treatment.

Taint Inference for Cross-Site Scripting in Context of URL Rewriting and HTML Sanitization

Currently, web applications are gaining in prevalence. In a web application, an input may not be appropriately validated, making the web application susceptible to cross-site scripting (XSS), which poses serious security problems for Internet users and websites to whom such trusted web pages belong. A taint inference is a type of information flow analysis technique that is useful in detecting XSS on the client side. However, in existing techniques, two current practical issues have yet to be handled properly. One is URL rewriting, which transforms a standard URL into a clearer and more manageable form. Another is HTML sanitization, which filters an input against blacklists or whitelists of HTML tags or attributes. In this paper, we make an analogy between the taint inference problem and the molecule sequence alignment problem in bioinformatics, and transfer two techniques related to the latter over to the former to solve the aforementioned yet-to-be-handled-properly practical issues. In particular, in our method, URL rewriting is addressed using local sequence alignment and HTML sanitization is modeled by introducing a removal gap penalty. Empirical results demonstrate the effectiveness and efficiency of our method.

Towards a comprehensive model of scientific research and professional practice in psychology

In this article I present a model of associations between two social domains: the scientific research domain (here psychology) and the professional practice domain. In the former case, its quality is determined by social and individual methodological awareness (MA). I introduce my own definition of MA. What determines the validity and usefulness of practical actions undertaken by professionals (e.g., assessment, therapy) in the practice domain is the accurately constructed empirical theory high in descriptive power, explanatory power and predictive power. I propose a model (my own conceptualization) in which I analyze information flow between the domains of scientific research (psychology as a science) and professional practice (psychology as a profession). In the subsequent and final part I discuss my own model which links theory and practice: Scientific Research and Professional Practice in Psychology (SRPPP). The article ends with a presentation of three contexts in which the interrelationship between theory and practice is immersed: the ethical, psychological and cultural contexts.

Method and Application of Operational Architecture Modeling Based on Information Flow Analysis

Abstract To strengthen operational process analysis and normalize information requirements description in systemic operations based on information systems, a new operational architecture modeling method is proposed from the perspective of information flow analysis. An operational architecture modeling framework based on information flow analysis is established by referring to American department of defense architecture framework (DoDAF V2.0). Concepts of entities, relationships, attributes and mapping rules are defined. Operational activity model, operational nod model and information alternation model are constructed. Finally, aerial assault operation is taken as an example to demonstrate the modeling process. Simulation results show that operational process analysis is more refined and information requirement descriptions are more visible, normal and clear, which validate the feasibility and validity of the method and models.

Information flow principles for plasticity in foraging robot swarms

An important characteristic of a robot swarm that must operate in the real world is the ability to cope with changeable environments by exhibiting behavioural plasticity at the collective level. For example, a swarm of foraging robots should be able to repeatedly reorganise in order to exploit resource deposits that appear intermittently in different locations throughout their environment. In this paper, we report on simulation experiments with homogeneous foraging robot teams and show that analysing swarm behaviour in terms of information flow can help us to identify whether a particular behavioural strategy is likely to exhibit useful swarm plasticity in response to dynamic environments. While it is beneficial to maximise the rate at which robots share information when they make collective decisions in a static environment, plastic swarm behaviour in changeable environments requires regulated information transfer in order to achieve a balance between the exploitation of existing information and exploration leading to acquisition of new information. We give examples of how information flow analysis can help designers to decide on robot control strategies with relevance to a number of applications explored in the swarm robotics literature.

Extending the dynamic range of transcription factor action by translational regulation.

A crucial step in the regulation of gene expression is binding of transcription factor (TF) proteins to regulatory sites along the DNA. But transcription factors act at nanomolar concentrations, and noise due to random arrival of these molecules at their binding sites can severely limit the precision of regulation. Recent work on the optimization of information flow through regulatory networks indicates that the lower end of the dynamic range of concentrations is simply inaccessible, overwhelmed by the impact of this noise. Motivated by the behavior of homeodomain proteins, such as the maternal morphogen Bicoid in the fruit fly embryo, we suggest a scheme in which transcription factors also act as indirect translational regulators, binding to the mRNA of other regulatory proteins. Intuitively, each mRNA molecule acts as an independent sensor of the input concentration, and averaging over these multiple sensors reduces the noise. We analyze information flow through this scheme and identify conditions under which it outperforms direct transcriptional regulation. Our results suggest that the dual role of homeodomain proteins is not just a historical accident, but a solution to a crucial physics problem in the regulation of gene expression.

Information Processing in the Mental Workspace Is Fundamentally Distributed.

The brain is a complex, interconnected information processing network. In humans, this network supports a mental workspace that enables high-level abilities such as scientific and artistic creativity. Do the component processes underlying these abilities occur in discrete anatomical modules, or are they distributed widely throughout the brain? How does the flow of information within this network support specific cognitive functions? Current approaches have limited ability to answer such questions. Here, we report novel multivariate methods to analyze information flow within the mental workspace during visual imagery manipulation. We find that mental imagery entails distributed information flow and shared representations throughout the cortex. These findings challenge existing, anatomically modular models of the neural basis of higher-order mental functions, suggesting that such processes may occur at least in part at a fundamentally distributed level of organization. The novel methods we report may be useful in studying other similarly complex, high-level informational processes.

The impact of IFRS goodwill reporting on financial analysts' equity valuation judgements: some experimental evidence

AbstractThis article uses an experiment to investigate how professional financial analysts evaluate a corporate acquisition announced by an IFRS preparer. The findings suggest that professional analysts are affected by preparers' acquisition premium allocations in a potentially misleading way as the participants considered the acquisition to be value‐enhancing when the premium was allocated to goodwill, but value‐reducing when allocated to identifiable intangible assets. These effects were mitigated at the aggregate level when additional discounted cash flow analysis information was provided; however, there were significant differences in information search behaviour as quite many participants focused primarily on the exploitation of earnings information.

Refining dependencies for information flow analysis of database applications

Preserving confidentiality of sensitive information in any computing system always remains a challenging issue. One such reason is improper coding of softwares which may lead to the disclosure of sensitive information to unauthorised users while propagating along the code during execution. Language-based information flow security analysis has emerged as a promising technique to prove that program's executions do not leak sensitive information to untrusted users. In this paper, we propose information flow analysis of database applications. The main contributions of the paper are: 1) refinement of dependence graphs for database applications by removing false dependencies; 2) information-flow analysis of database applications using refined dependence graph. Our approach covers a more generic scenario where attackers are able to view only a part of the attribute-values according to the policy, and leads to a more precise semantic-based analysis which reduces false positives with respect to the literature.

Influence of Shifts in Production Programs on the Resilience of Production Systems

The aspiration of resilient systems is to cope with all kinds of changes. Therefore it combines both agile or flexible and robust properties. In order to access the resilience of production systems, the determination of its sensitive parameters is imperative. For this purpose, this paper ascertains main levers influencing the productivity of manufacturing and assembly systems. Basis for all production processes is the production program representing the customer demand. The production program in terms of the list of actual orders defines the capacity demand. In this context, production control represents an important decision process affecting the degree of achieving objectives. Through intervening in case of any kind of dissipation and disturbances it adjusts the resource supply. It is assumed that the factors characterizing the production program exhibit varying impact on the production processes. Thus individual tasks of production planning and control are investigated in order to reveal interactions related to sensitive and robust parameters. These factors are characterized by means of regression analysis. Subsequently, requirements regarding the decision making process and decision support systems are determined. An adequate information flow analysis as regards the tasks of production planning and control reveals the dependencies of the current configuration of a production system. For this purpose, a sensitivity analysis distinguishes sensitive from robust aspects and estimates the quantity of their impact.

Refining dependencies for information flow analysis of database applications

Refining dependencies for information flow analysis of database applications

Information Flow Through Stages of Complex Engineering Design Projects: A Dynamic Network Analysis Approach

The pattern of information flow through the network of interdependent design activities is thought to be an important determinant of engineering design process results. A previously unexplored aspect of such patterns relates to the temporal dynamics of information transfer between activities as those activities are implemented through the network of people executing the project. To address this gap, we develop a dynamic modeling method that integrates both the network of people and the network of activities in the project. We then employ a large dataset collected from an industrial setting, consisting of project-related e-mails and activity records from the design and development of a renewable energy plant over the course of more than three years. Using network metrics for centrality and clustering, we make three important contributions: 1) We demonstrate a novel method for analyzing information flows between activities in complex engineering design projects; 2) we show how the network of information flows in a large-scale engineering project evolved over time and how network analysis yields several managerial insights; and 3) we provide a useful new representation of the engineering design process and thus support theory-building toward the evolution of information flows through systems engineering stages. Implications include guidance on how to analyze and predict information flows as well as better planning of information flows in engineering design projects according to their individual stage and activity characteristics.

Study on the contagion among American industries

Using a sliding window to scan through every industry index from 2 Jan 2003 to 26 Dec 2013 and transfer entropy to investigate information flow among sectors, we figure out corresponding industry’s transfer entropy matrix in every given window. Next, a further analysis of information flow’s variations between industries is carried out. Finally, we also use daily trading volumes of each group to carefully analyze trading volume correlation between sectors. The obtained facts are as follows. First, as crisis intensified, the amount of information flow between industries continues to grow and finally reaches a peak over full-outbreak periods. Second, Financial sector always has large output transfer entropy, and before January 2007, the main information flow is from Financial sector to Non-Daily consumption, Energy, Raw material and Industrial sectors while around 12 April 2007, it has changed from Energy, Raw material and Industrial groups to Telecom, Daily consumption, Public utilities and Health care industries. Thus, Financial industry is the arch-criminal and it seriously affects Non-Daily consumption, Energy, Raw material and Industrial groups. Later, Telecom, Daily consumption, Health care and Public utilities industries are all plunged into the crisis, and financial crisis sweeps all the industries eventually. Besides, we also find that trading volume correlation is the fundamental reason of crisis propagation.

Interactively verifying absence of explicit information flows in Android apps

App stores are increasingly the preferred mechanism for distributing software, including mobile apps (Google Play), desktop apps (Mac App Store and Ubuntu Software Center), computer games (the Steam Store), and browser extensions (Chrome Web Store). The centralized nature of these stores has important implications for security. While app stores have unprecedented ability to audit apps, users now trust hosted apps, making them more vulnerable to malware that evades detection and finds its way onto the app store. Sound static explicit information flow analysis has the potential to significantly aid human auditors, but it is handicapped by high false positive rates. Instead, auditors currently rely on a combination of dynamic analysis (which is unsound) and lightweight static analysis (which cannot identify information flows) to help detect malicious behaviors. We propose a process for producing apps certified to be free of malicious explicit information flows. In practice, imprecision in the reachability analysis is a major source of false positive information flows that are difficult to understand and discharge. In our approach, the developer provides tests that specify what code is reachable, allowing the static analysis to restrict its search to tested code. The app hosted on the store is instrumented to enforce the provided specification (i.e., executing untested code terminates the app). We use abductive inference to minimize the necessary instrumentation, and then interact with the developer to ensure that the instrumentation only cuts unreachable code. We demonstrate the effectiveness of our approach in verifying a corpus of 77 Android apps—our interactive verification process successfully discharges 11 out of the 12 false positives.