Information Flow Analysis Research Articles

Permissive runtime information flow control in the presence of exceptions

Information flow control (IFC) has been extensively studied as an approach to mitigate information leaks in applications. A vast majority of existing work in this area is based on static analysis. However, some applications, especially on the Web, are developed using dynamic languages like JavaScript where static analyses for IFC do not scale well. As a result, there has been a growing interest in recent years to develop dynamic or runtime information flow analysis techniques. In spite of the advances in the field, runtime information flow analysis has not been at the helm of information flow security, one of the reasons being that the analysis techniques and the security property related to them (non-interference) over-approximate information flows (particularly implicit flows), generating many false positives. In this paper, we present a sound and precise approach for handling implicit leaks at runtime. In particular, we present an improvement and enhancement of the so-called permissive-upgrade strategy, which is widely used to tackle implicit leaks in dynamic information flow control. We improve the strategy’s permissiveness and generalize it. Building on top of it, we present an approach to handle implicit leaks when dealing with complex features like unstructured control flow and exceptions in higher-order languages. We explain how we address the challenge of handling unstructured control flow using immediate post-dominator analysis. We prove that our approach is sound and precise.

Panel Data Causal Inference Using a Rigorous Information Flow Analysis for Homogeneous, Independent and Identically Distributed Datasets

Panel data, which consist of observations on many individual units over two or more instances of time, have gradually become an important type of scientific data. Subsequently causal inference for panel data has attracted enormous interest from many fields as well as statistics. In this study, the rigorously formulated information flow analysis for time series, which is very concise in form and has been successfully applied in different disciplines, is generalized to identify the causality from homogeneous and independent identically distributed panel data. The resulting formula bears the same form as that for the former, though the meanings of the symbols differ. An algorithm is then proposed for panel data causality analysis, which has been validated with both linear and nonlinear problems. It has also been put to application to examine the causal relations among economic growth, energy consumption, trade openness, and energy price based on 15 Asian countries. Clearly identified are a strong bidirectional causality between economic growth and energy consumption, and a strong causality from import and export trade to economic growth. Energy price has no direct impact on energy consumption; it, instead, exerts a weak effect on the latter through influencing economic growth.

Analyzing information flow collected across planning and execution stages of machine tools operations

Analyzing information flow collected across planning and execution stages of machine tools operations

From structure to concepts: The two stages of facial expression recognition

Facial expressions are the dominant way of human emotional and social communications. However, it remains unclear that how can perceivers extract emotion from the face. In the present study, we adopted a repetition-priming paradigm in combine with event-related potentials (ERP) to examine neurocognitive processing stages of facial expression perception. Results showed that emotional words were recognized faster than emotional faces, when both of which were primed by emotional faces, indicating the involvement of concepts processes in facial expression recognition. ERP results showed that all emotional faces could evoke responses of N170, while there was no significant difference between positive and negative emotional faces, suggesting that geometrical configurations of faces rather than emotional concepts of faces are processed at the stage of N170. In contrast, both emotional words and faces showed larger P2 in response to anger than happiness, which suggests that emotional concepts are extracted from faces at the stage of P2. To examine the underlying dynamic causal connectivity between facial structure and emotional conception, we conducted information flow analysis, which showed significant decreases of information flow from the fusiform gyrus to dorsal anterior cingulate cortex/dorsal medial prefrontal cortex and increases of information flow from the fusiform gyrus to posterior insula. These results revealed neural mechanisms underlying processes from physical structure to emotional concepts. Our findings suggest that facial expression recognition consists of two stages from geometrical structure of faces to emotional concepts of facial expressions, which provides evidence for facial expression processing and has important implications in the diagnosis and treatment of emotion recognition related disorders.

Concept of transferring control to a driver in highly automated cars

From an interdisciplinary point of view, on the basis of a systematic approach, the concept of transferring control to a driver in highly automated vehicles was first formulated, which allows one to determine the potential possibility of regaining control of a highly automated car based on its awareness of the situational situation along the route of movement and monitoring of the current functional state, including readiness for emergency actions, and individual features of the driver. The classification of cross-modal information flows in highly automated and autonomous cars is presented. The definition of cross-modal interaction in highly automated vehicles is given, and the goal of analyzing heterogeneous information flows in on-board vehicle systems is formulated, where automatic analysis of heterogeneous information flows gives a synergistic effect. Examples of relevant driver information are provided.

Efficient Interactive Global Cellular Signal Strength Visualization

Cellular Signal Strength (CSS), defined as the signal power received by mobile phones, is an important aspect of geographic information flow analysis, because the density of such information can reflect the urbanization variables such as population, gross domestic product, built-up area, electric power consumption, etc. Despite the importance, the real-time analysis of global CSS distribution remains a challenging problem due to the large data scale. In this article, a Display-driven Computing (DisDC) technique is designed and applied to provide efficient large scale interactive CSS visualization, generating results by calculating the value of each pixel that directly for display. Specifically, we present an efficient CSS measurement algorithm, which introduces spatial indexes and a corresponding query strategy; besides, an optimized parallel computing architecture is proposed to ensure the ability of real-time visualization. Experiments show that our approach obviously outperforms traditional methods and is capable of handling more than 40 million base stations in real-time. Moreover, an online demonstration is provided at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/MemoryMmy/CSSMap</uri> .

The analysis of information flow interdependencies within projects

Information flow exchange within highly distributed, co-located, self-organising and networked projects is critical for successful planning, and ultimately, for successful infrastructure project delivery. While conventional project scheduling methods are still widely used as project support tools, most lack capacity for harnessing and exploiting both direct and indirect forms of information flow interdependency between activities in these project types. The present study sets out to develop and present a practical method for modelling and analysing information flow interdependencies in infrastructure projects. We propose and apply a five-stage approach, using an integrated form of Network Analysis augmented with fuzzy Cross-impact Matrix Multiplication Analysis. The findings classify project activities based on their dependency levels with other directly and indirectly related project activities. The novel contribution to project management practice is that key information flow interdependencies can thus be identified and then more effectively harnessed due to an enhanced ability to interpret the information with a clearer understanding of originating communication context.

Agda Formalization of a Security-preserving Translation from Flow-sensitive to Flow-insensitive Security Types

The analysis of information flow is a popular technique for ensuring the confidentiality of data. It is in this context that confidentiality policies arise for giving guarantees that private data cannot be inferred by the inspection of public data. One of those policies is non-interference, a semantic condition that ensures the absence of illicit information flow during program execution by not allowing to distinguish the results of two computations when they only vary in their confidential inputs. A remarkable feature of non-interference is that it can be enforced statically by the definition of information flow type systems. In those type systems, if a program type-checks, then it means that it meets the security policy.In this paper we focus on the preservation of non-interference through program translation. Concretely, we formalize the proof of security preservation of Hunt and Sands' translation that transforms high-level While programs typable in a flow-sensitive type system into equivalent high-level programs typable in a flow-insensitive type system. Our formalization is performed in the dependently-typed language Agda. We use the expressive power of Agda's type system to encode the security type systems at the type level. A particular aspect of our formalization is that it follows a fully internalist approach where we decorate the type of the abstract syntax with security type information in order to obtain the representation of well-typed (i.e secure) programs. A benefit of this approach is that it allows us to directly express the property of security preservation in the type of the translation relation. In this manner, apart from inherently expressing the transformation of programs, the translation relation also stands for an inductive proof of security preservation.

Multiresolution analysis of information flows from international carbon trading market to the clean energy stock market

This paper introduced a novel method to investigate the information flows from the international carbon trading market to the market for renewable energy stocks. The method combined the advantages of wavelet decomposition, transfer entropy, and complex network, which defined multiscale, directional, and dynamic flows of information. This analysis selected the daily futures prices of the EUA futures and the daily spot prices of the S&amp;P Global Clean Energy Index (S&amp;P GCE) as sample data and decomposed the bivariate time series into seven sequences for various time–frequency domains by maximal overlap discrete wavelet transform. Transfer entropy has been used to measure the process of transmission of information from the carbon trading market to the renewable energy stock market. The transfer entropies were transformed into four symbols and constructed directed and weighted complex networks of the transfer entropy fluctuation mode sequence in different time–frequency domains according to the concept of coarse graining. The findings showed that the carbon market information flows to the renewable energy stock market varied at different scales. In the short to medium term (2–16 days), there were a lot of information flows from EUA to S&amp;P GCE. The information flow of EUA to S&amp;P GCE is the most stable at scale d2 (4–8 days), but the volatility of the carbon market has not affected the clean energy market at scales d5–d6 (32–128 days). These findings provided the requisite reference for investors in carbon finance and policy-makers who support clean energy production.

Potential of using burning equipment in the engineering company and metallurgy

Currently, companies have been trying to make the use of their technology, manufacturing capabilities and experienced workforce to respond flexibly to market demands. Collecting and processing of all relevant data in the company is one of the key points to which increased attention should be paid so as to maximize the efficient use of own resources and consequently ensure a continuous reduction of pro-duction costs. The article deals with the use of burning machines in engineering company. The product range involves the production of burnouts from standard and special materials as well as welded steel parts of structures. The company has long struggled to optimize the material and information flow between particular production operations. This paper was focused on information flow logistics, which proved to be the biggest weakness of the central material preparation department during the bottleneck analysis. The scientific contribution of the resolved issue can be seen mainly in the possibility of inter-connecting process analysis and optimization of material and information flows.

As Dinâmicas Informacionais do conteúdo publicado pelos Governos do Ceará, do Maranhão e de Pernambuco e as relações com as estatísticas por coronavírus

Buscou-se identificar a dinâmica informacional dos perfis oficiais de governos dos estados do Nordeste do Brasil – Ceará, Maranhão e Pernambuco – quanto à disseminação de informações durante a pandemia mundial da Covid-19. Para tanto, foi realizada uma categorização das informações veiculadas para refletir quanto ao volume das informações e avaliar as dinâmicas dos conteúdos e suas relações com os dados estatísticos de infectados e mortos nesses estados. Metodologicamente, realizou-se uma categorização das publicações do Instagram oficial de cada governo e usou-se a Análise de Redes Sociais (ARS), que possui uma abordagem quali-quantitativa, para mapear as interações e a análise de padrões de relacionamento e fluxo informacional com os dados coletados. Isso permitiu compreender a comunicação no contexto das organizações a partir do viés relacional e processual. A partir disso, concluiu-se que a maioria das publicações é de conteúdo relacionado a medidas de enfrentamento à Covid-19, o que denota uma preocupação dos governos dos estados em demonstrar à população suas ações formais para minimizar os impactos causados pelo novo coronavírus. Além disso, o resultado ratificou Pernambuco como o estado mais transparente em relação à divulgação de dados e informações acerca dos casos da doença no estado.

System for analysing of big data on cybersecurity issues from social media

The paper proposes and substantiates approaches to building a corporate system for monitoring and analyzing social media on cybersecurity issues, which are based on the concept Big Data, Data/Text Mining, Information Extraction, Complex Networks, and Cloud Computing. The components of Elastic Stack technology, Sphinx information retrieval system, Graph Data Base Management System Neo4j, and Gephi graph analysis system are examined in detail. The main idea of a system for analyzing large amounts of data on cybersecurity issues from social media is the simultaneous application of methods and means of information retrieval, data analysis, and aggregation of information flows. The system should ensure the implementation of the following functions: the formation of databases by collecting information from certain information resources; settings for automatic scanning and primary processing of information from websites and social networks; maintaining full-text information databases; identifying duplicates similar in content to informational messages; full-text search; analysis of text messages, determination of tonality, the formation of analytical reports; integration with geographic information system; data analysis and visualization; study of the dynamics of thematic information flows; predicting developments based on the analysis of the dynamics of the publication in social media; providing access for many users to the functional components of the system. The practical significance of the results is to create a working layout of the content monitoring and analysis system of social media on cybersecurity issues, ready to be used as a component in information and cybersecurity decision support systems. The interface of the system layout is considered, in which the functions of search, analysis, and forecasting of information appearance in social media are available. Central to the interface is a digest of the most relevant user needs. In the analytical mode, a number of tools are implemented for graphical presentation of the analyzed data, which are displayed as a time series of the number of relevant queries per day, as well as viewing the main topics, clusters grouped by predefined reference words. The system provides modes for forming networks of concepts that correspond to individual messages (persons, brands) and information sources that allow you to rank the concepts and explore the relationships between them.

АЙЫЛ-ЧАРБА ИШКАНАЛАРЫН БАШКАРУУ МЕХАНИЗМИНИН НАТЫЙЖАЛУУ ИШТӨӨСҮНҮН ИЛИМИЙ НЕГИЗДЕРИ

The article explores the scientific foundations of the effective operation of the management mechanism of agricultural enterprises of the Kyrgyz Republic (KR), clarifies their theoretical and methodological provisions. The subject of the research is agricultural enterprises, and the purpose of the research is to study the effective operation of the management mechanism of agricultural enterprises. According to the results of the study, the significance and role of scientific and technological progress in the agricultural sector, the ways of using mathematical methods and models in the management of agricultural production, analysis and projection of information flows into the agricultural management system are clarified, information systems are proposed that ensure the effectiveness of management in agricultural production.

Information Flow Analysis between EPU and Other Financial Time Series.

We investigate the strength and direction of information flow among economic policy uncertainty (EPU), US imports and exports to China, and the CNY/US exchange rate by using the novel concept of effective transfer entropy (ETE) with a sliding window methodology. We verify that this new method can capture dynamic orders effectively by validating them with the linear transfer entropy (TE) and Granger causality methods. Analysis shows that since 2016, US economic policy has contributed substantially to China-US bilateral trade and that China is making passive adjustments based on this trade volume. Unlike trade market conditions, China’s economic policy has significantly influenced the exchange rate fluctuation since 2016, which has, in turn, affected US economic policy.

Effective Transfer Entropy Approach to Information Flow Among EPU, Investor Sentiment and Stock Market

Although transfer entropy can test the nonlinear causal relationship between sequences, it is mainly used for stationary data. For nonstationary sequences with large fluctuations, the traditional transfer entropy method has obvious defects. Based on traditional transfer entropy, this paper proposes a transfer entropy method with rolling windows. We verify that this new method can capture the dynamic order between sequences and better reveal the nonlinear causality between nonstationary time series. Furthermore, we construct an investor sentiment index based on principal component analysis, and based on the proposed dynamic transfer entropy model, we analyze the information transfer relationship among economic policy uncertainty (EPU), investor sentiment and stock markets. The results of the information flow analysis of EPU and investor sentiment show that EPU influenced investor sentiment mainly from August 2015 to June 2016. Among different policies, China’s exchange rate reform policy and ‘circuit-breaker’ policy in the stock market have played an important role. The analysis of the information flow between sentiment and stock price returns shows that investor sentiment is more a reflection of changes in stock price returns with a 1-month lag order and that the stock market has a significant bargainer effect and a weaker bandwagon effect. There is no significant information flow transmission relationship between EPU and stock market volatility, which indicates that stock market fluctuations are basically not affected by national policy fluctuations. Although investor sentiment is affected by changes such as exchange rate reform and stock market policies, many investors do not form consensus expectations.

Evaluation of Fingerprint Selection Algorithms for Local Text Reuse Detection

Abstract Detection of local text reuse is central to a variety of applications, including plagiarism detection, origin detection, and information flow analysis. This paper evaluates and compares effectiveness of fingerprint selection algorithms for the source retrieval stage of local text reuse detection. In total, six algorithms are compared – Every p-th, 0 mod p, Winnowing, Hailstorm, Frequency-biased Winnowing (FBW), as well as the proposed modified version of FBW (MFBW). Most of the previously published studies in local text reuse detection are based on datasets having either artificially generated, long-sized, or unobfuscated text reuse. In this study, to evaluate performance of the algorithms, a new dataset has been built containing real text reuse cases from Bachelor and Master Theses (written in English in the field of computer science) where about half of the cases involve less than 1 % of document text while about two-thirds of the cases involve paraphrasing. In the performed experiments, the overall best detection quality is reached by Winnowing, 0 mod p, and MFBW. The proposed MFBW algorithm is a considerable improvement over FBW and becomes one of the best performing algorithms. The software developed for this study is freely available at the author’s website http://www.cs.rtu.lv/jekabsons/.

Information Flow Between Bitcoin and Other Financial Assets

Since the cryptocurrency, bitcoin, was launched in 2009, trading of bitcoin has been booming, and bitcoin is now increasingly recognized as an investment asset. However, concerns have arisen about the stability of this form of currency due to its volatility. Evaluation is necessary of bitcoin as an asset compared to other financial assets. In this study, we analyze information flows between bitcoin and other financial assets in 27 countries, demonstrating that bitcoin has a high correlation with other financial assets in many countries. Further, we observe a directional pattern in information flows according to the economic conditions in each country (i.e., developed and emerging markets). Our research shows that bitcoin is proactively influenced by changes in exchange rates and stocks in developed markets compared to emerging markets, and that changes in the price of bitcoin have no prior effect on indexes of financial assets in most countries.

FloVasion: Towards Detection of non-sensitive Variable Based Evasive Information-Flow in Android Apps

ABSTRACT Smartphones are enriched by applications (apps) available through the mobile ecosystem. Various studies have reported that apps leaking sensitive user and device information are the primary target of cyber criminals. Existing program analysis tools can detect such information leakage flows. Reverse engineering tools are deployed to determine app information-flow via control and data-flow analysis. Malware authors employ information-flow based evasion techniques while leaking privacy sensitive data. In this paper, we discuss five novel app attacks that evade information flow analysis and leak sensitive device and user information (e.g. IMEI, SIM details, Location details, and user contacts). These attacks circumvent state-of-the-art analysis tools. We show that sensitive information can be leaked via non-sensitive variables, or by performing runtime inspection of classes and fields. We analyzed the proposed novel attack apps against some of the most promising state-of-the-art static analysis tools such as FlowDroid, DroidSafe, and dynamic analysis tools such as TaintDroid. Furthermore, we evaluated Play-Protect i.e. default on-device anti-malware, AVL Antivirus, and some other top commercial products against proposed novel app attacks. We demonstrate that existing tools are vulnerable to proposed attacks. Finally, this paper proposes AspectJ based runtime monitor as a possible solution that can be incorporated in the state-of-the-art app analysis techniques to detect information flow misuse.

Теоретичні засади впровадження та використання сучасних технологій інтелектуального аналізу даних в економіці

Abstract. The aim of the article is to study the theoretical foundations of the introduction and use of modern technologies of data mining in the economy of Ukraine. Research methodology. The theoretical and methodological basis of the article were the works of leading foreign and domestic scientists on the evaluation of the effectiveness of the implementation and use of data mining technologies. Achieving this goal was carried out using the following scientific techniques and research methods: monographic (in reviewing and studying the literature on evaluating the effectiveness of data mining technologies), analysis and synthesis (for research and generalization of research results); logical-theoretical and dialectical (to form the conclusions of the study). In the process of research, the substantiation of theoretical calculations and conclusions was carried out on the basis of system-functional and structural approaches to the analysis of information flows and control systems of data mining technologies. The information base of the study is articles and monographs, including those posted on web pages. Results of the research. The theoretical bases of functioning of modern technologies of data mining in the information economy are systematized, and also questions of the basic directions of application of the Data Mining system are analyzed, namely as a mass product for business applications and as a tool for unique researches. Scientific novelty of research results. It consists in the theoretical substantiation of possibilities of introduction and application of modern technologies of intellectual analysis, in various branches of economy, as effective tools of providing the timely information for the management of business entities on the basis of which it is possible to make qualitative administrative decisions. The practical significance of the research results. The obtained results can be used for further prospective research of information systems of economic entities, which are created on the basis of modern data mining systems, as well as in the implementation of computerization tools for analytical and synthetic data processing of information systems in the enterprise. Keywords: information system; data mining; information technology; data mining.

System-Level Non-interference of Constant-Time Cryptography. Part II: Verified Static Analysis and Stealth Memory

This paper constitutes the second part of a paper published in Barthe et al. (J Autom Reason, 2017. https://doi.org/10.1007/s10817-017-9441-5 ). Cache-based attacks are a class of side-channel attacks that are particularly effective in virtualized or cloud-based environments, where they have been used to recover secret keys from cryptographic implementations. One common approach to thwart cache-based attacks is to use constant-time implementations, i.e. those which do not branch on secrets and do not perform memory accesses that depend on secrets. However, there is no rigorous proof that constant-time implementations are protected against concurrent cache-attacks in virtualization platforms with shared cache. We propose a new information-flow analysis that checks if an x86 application executes in constant-time, and show that constant-time programs do not leak confidential information through the cache to other operating systems executing concurrently on virtualization platforms. Our static analysis targets the pre-assembly language of the CompCert verified compiler. Its soundness proof is based on a connection between CompCert semantics and our idealized model of virtualization, and uses isolation theorems presented in Part I. We then extend our model of virtualization platform and our static analysis to accommodate stealth memory, a countermeasure which provisions a small amount of private cache for programs to carry potentially leaking computations securely. Stealth memory induces a weak form of constant-time, called S-constant-time, which encompasses some widely used cryptographic implementations. Our results provide the first rigorous analysis of stealth memory and S-constant-time, and the first tool support for checking if applications are S-constant-time. We formalize our results using the Coq proof assistant and we demonstrate the effectiveness of our analyses on cryptographic implementations, including PolarSSL AES, DES and RC4, SHA256 and Salsa20.