Binary Detection Research Articles

An Early Fault Detection Method for Wind Turbine Main Bearings Based on Self-Attention GRU Network and Binary Segmentation Changepoint Detection Algorithm

The condition monitoring and potential anomaly detection of wind turbines have gained significant attention because of the benefits of reducing the operating and maintenance costs and enhancing the reliability of wind turbines. However, the complex and dynamic operation states of wind turbines still pose tremendous challenges for reliable and timely fault detection. To address such challenges, in this study, a condition monitoring approach was designed to detect early faults of wind turbines. Specifically, based on a GRU network with a self-attention mechanism, a SAGRU normal behavior model for wind turbines was constructed, which can learn temporal features and mine complicated nonlinear correlations within different status parameters. Additionally, based on the residual sequence obtained using a well-trained SAGRU, a binary segmentation changepoint detection algorithm (BinSegCPD) was introduced to automatically identify deterioration conditions in a wind turbine. A case study of a main bearing fault collected from a 50 MW windfarm in southern China was employed to evaluate the proposed method, which validated its effectiveness and superiority. The results showed that the introduction of a self-attention mechanism significantly enhanced the model performance, and the adoption of a changepoint detection algorithm improved detection accuracy. Compared to the actual fault time, the proposed approach could automatically identify the deterioration conditions of main bearings 72.47 h in advance.

Inferring, not just detecting: Metrics for high-redshift sources observed with third-generation gravitational-wave detectors

The detection of black-hole binaries at high redshifts is a cornerstone of the science case of third-generation gravitational-wave interferometers. The star-formation rate peaks at $z\ensuremath{\sim}2$ and decreases by orders of magnitude by $z\ensuremath{\sim}10$. Any confident detection of gravitational waves from such high redshifts would imply either the presence of stars formed from pristine material originating from cosmological nucleosynthesis (the so-called population III stars), or black holes that are the direct relics of quantum fluctuations in the early Universe (the so-called primordial black holes). Crucially, detecting sources at cosmological distances does not imply inferring that sources are located there, with the latter posing more stringent requirements. To this end, we present two figures of merit, which we refer to as ``$z\text{\ensuremath{-}}z$ plot'' and ``inference horizon,'' that quantify the largest redshift one can possibly claim a source to be beyond. We argue that such inference requirements, in addition to detection requirements, should be investigated when quantifying the scientific payoff of future gravitational-wave facilities.

SIGNet: A Siamese Graph Convolutional Network for Multi-Class Urban Change Detection

Detecting changes in urban areas presents many challenges, including complex features, fast-changing rates, and human-induced interference. At present, most of the research on change detection has focused on traditional binary change detection (BCD), which becomes increasingly unsuitable for the diverse urban change detection tasks as cities grow. Previous change detection networks often rely on convolutional operations, which struggle to capture global contextual information and underutilize category semantic information. In this paper, we propose SIGNet, a Siamese graph convolutional network, to solve the above problems and improve the accuracy of urban multi-class change detection (MCD) tasks. After maximizing the fusion of change differences at different scales using joint pyramidal upsampling (JPU), SIGNet uses a graph convolution-based graph reasoning (GR) method to construct static connections of urban features in space and a graph cross-attention method to couple the dynamic connections of different types of features during the change process. Experimental results show that SIGNet achieves state-of-the-art accuracy on different MCD datasets when capturing contextual relationships between different regions and semantic correlations between different categories. There are currently few pixel-level datasets in the MCD domain. We introduce a new well-labeled dataset, CNAM-CD, which is a large MCD dataset containing 2508 pairs of high-resolution images.

A Spatial Detection Method of Underwater Acoustic Target Based on Radiated Noise Features

In order to solve the problem that the traditional sonar detection method based on beam energy is not able to detect weak targets, a feature-based spatial beam target detection method is proposed in this paper. Firstly, the feature is extracted from the pre-formed beams in the whole spatial domain, and then using the relevance vector machine (RVM) for training, the probability output of target detection is obtained. Compared with traditional methods, this method can obtain excellent detection performance under the condition of low signal-to-noise ratio or signal-to-interference ratio. The probability output of this method can better represent the uncertainty of target detection, and it is also convenient for information fusion and other processing, which is different from the output of traditional binary detection. At the end of the paper, simulated data and experimental data both proved that this method is effective.

Binary Vulnerability Similarity Detection Based on Function Parameter Dependency

Many existing works compute the binary vulnerability similarity based on binary procedure, which has coarse detection granularity and cannot locate the vulnerability trigger position accurately, and have a higher false positive rate, so a new binary vulnerability similarity detection method based on function parameter dependency in hazard API is proposed. First, convert the instructions of different architectures into an intermediate language, and use the compiler with a back-end optimizer to optimize and normalize the binary procedure. Then, locate the hazard API that appears in the binary procedure, and perform the function parameters dependency analysis to generate a set of parameter slices on the hazard API. Experiments show that the method has a higher recall rate (up to 14.3% better than the baseline model) in real-world scenarios, and not only locates the triggering position of the vulnerability but also identifies the fixed vulnerability.

VulANalyzeR: Explainable Binary Vulnerability Detection with Multi-task Learning and Attentional Graph Convolution

Software vulnerabilities have been posing tremendous reliability threats to the general public as well as critical infrastructures, and there have been many studies aiming to detect and mitigate software defects at the binary level. Most of the standard practices leverage both static and dynamic analysis, which have several drawbacks like heavy manual workload and high complexity. Existing deep learning-based solutions not only suffer to capture the complex relationships among different variables from raw binary code but also lack the explainability required for humans to verify, evaluate, and patch the detected bugs.We propose VulANalyzeR, a deep learning-based model, for automated binary vulnerability detection, Common Weakness Enumeration-type classification, and root cause analysis to enhance safety and security. VulANalyzeR features sequential and topological learning through recurrent units and graph convolution to simulate how a program is executed. The attention mechanism is integrated throughout the model, which shows how different instructions and the corresponding states contribute to the final classification. It also classifies the specific vulnerability type through multi-task learning as this not only provides further explanation but also allows faster patching for zero-day vulnerabilities. We show that VulANalyzeR achieves better performance for vulnerability detection over the state-of-the-art baselines. Additionally, a Common Vulnerability Exposure dataset is used to evaluate real complex vulnerabilities. We conduct case studies to show that VulANalyzeR is able to accurately identify the instructions and basic blocks that cause the vulnerability even without given any prior knowledge related to the locations during the training phase.

Optimal signal design for coherent detection of binary signals in Gaussian noise under power and secrecy constraints

The problem of optimal signal design for coherent detection of binary signals in Gaussian noise is revisited under power and secrecy constraints. In particular, the aim is to select the binary transmitted signals in an optimal manner so that the probability of error is minimized at an intended receiver while the probability of error at an eavesdropper is maintained above a threshold value and the signal powers are limited. It is shown that an optimal solution exists in the form of antipodal signaling along the eigenvector corresponding to the solution of a maximum (possibly generalized) eigenvalue problem, which is specified explicitly based on the channel coefficient matrices and the noise covariance matrices at the intended receiver and the eavesdropper. Furthermore, optimal signal design can be performed in an efficient manner by solving a semidefinite programming (SDP) relaxation followed by a matrix rank-one decomposition. Numerical examples are provided to illustrate optimal solutions for three different but exhaustive cases.

Codeformer: A GNN-Nested Transformer Model for Binary Code Similarity Detection

Binary code similarity detection is used to calculate the code similarity of a pair of binary functions or files, through a certain calculation method and judgment method. It is a fundamental task in the field of computer binary security. Traditional methods of similarity detection usually use graph matching algorithms, but these methods have poor performance and unsatisfactory effects. Recently, graph neural networks have become an effective method for analyzing graph embeddings in natural language processing. Although these methods are effective, the existing methods still do not sufficiently learn the information of the binary code. To solve this problem, we propose Codeformer, an iterative model of a graph neural network (GNN)-nested Transformer. The model uses a Transformer to obtain an embedding vector of the basic block and uses the GNN to update the embedding vector of each basic block of the control flow graph (CFG). Codeformer iteratively executes basic block embedding to learn abundant global information and finally uses the GNN to aggregate all the basic blocks of a function. We conducted experiments on the OpenSSL, Clamav and Curl datasets. The evaluation results show that our method outperforms the state-of-the-art models.

Quantum Algorithm for Higher-Order Unconstrained Binary Optimization and MIMO Maximum Likelihood Detection

In this paper, we propose a quantum algorithm that supports a real-valued higher-order unconstrained binary optimization (HUBO) problem. This algorithm is based on the Grover adaptive search that originally supported HUBO with integer coefficients. Next, as an application example, we formulate multiple-input multiple-output maximum likelihood detection as a HUBO problem with real-valued coefficients, where we use the Gray-coded bit-to-symbol mapping specified in the 5G standard. The proposed approach allows us to construct an efficient quantum circuit for the detection problem and to analyze specific numbers of required qubits and quantum gates, whereas other conventional studies have assumed that such a circuit is feasible as a quantum oracle. To further accelerate the quantum algorithm, we also derive a probability distribution of the objective function value and determine a unique threshold to sample better states. Assuming a future fault-tolerant quantum computing, our proposed algorithm has the potential for significantly reducing query complexity in the classical domain and providing a quadratic speedup in the quantum domain.

MTSCD-Net: A network based on multi-task learning for semantic change detection of bitemporal remote sensing images

In recent years, change detection has been one of the hot research topics within the field of remote sensing. Previous studies have concentrated on binary change detection (BCD), but it doesn’t meet the current needs. Therefore, semantic change detection (SCD) is also gradually developing, which focuses on determining the specific changed type while obtaining changed areas. In the paper, we propose a multi-task learning method (MTSCD-Net) for SCD task. The SCD task is decoupled into two related subtasks, semantic segmentation (SS) and BCD, then unifies them under the same framework. Multi-scale features are extracted using the Siamese semantic-aware encoder based on Swin Transformer, and the aggregation module is designed to combine features. Then, the change information extraction module is designed to enhance the capacity to express features by fully integrating the two-level difference features that are generated from fused features. Moreover, in the decoder stage, the spatial attention weight map is obtained using the features of the BCD subtask, which provides location prior information for the features of the SS subtask. It helps fully explore the correlation between the two subtasks. The two loss functions of subtasks are weighted to train MTSCD-Net. The comparative experiments results on two typical SCD datasets confirm the advantage of MTSCD-Net for SCD task. For the SeK index, MTSCD-Net achieves 3.96% and 20.57% on HRSCD and SECOND datasets, respectively. This outperforms other comparative methods such as Bi-SRNet (which achieves 4.86% and 1.47% higher on two datasets, respectively). The same is true for the Score metric. Moreover, the ablation experiment results confirm the effectiveness of key modules.

Efficient Driver Anomaly Detection via Conditional Temporal Proposal and Classification Network

Detecting driver inattentive behaviors is crucial for driving safety in a driver monitoring system (DMS). Recent works treat driver distraction detection as a multiclass action recognition problem or a binary anomaly detection problem. The former approach aims to classify a fixed set of action classes. Although specific distraction classes can be predicted, this approach is inflexible to detect unknown driver anomalies. The latter approach mixes all distraction actions into one class: anomalous driving. Because the objective focuses on finding the difference between safe and distracted driving, this approach has better generalization in detecting unknown driver distractions. However, a detailed classification of the distraction is missing from the predictions, meaning that the downstream DMS can only treat all distractions with the same severity. In this work, we propose a two-phase anomaly proposal and classification framework [driver anomaly detection and classification network (DADCNet)] robust for open-set anomalies while maintaining high-level distraction understanding. DADCNet makes efficient allocation of multimodal and multiview inputs. The anomaly proposal network first utilizes a subset of the available modalities and views to suggest suspicious anomalous driving behavior. Then, the classification network employs more features to verify the anomaly proposal and classify the proposed distraction action. Through extensive experiments in two driver distraction datasets, our approach significantly reduces the total amount of computation during inference time while maintaining high anomaly detection sensitivity and robust performance in classifying common driver distractions.

SimCoDe-NET: Similarity Detection in Binary Code using Deep Learning Network

Binary code similarity detection is a fundamental task in the field of computer binary security. However, code similarity is crucial today because of the prevalence of issues like plagiarism, code cloning, and recycling in software due to the ongoing increase of software scale. To resolve these issues, a novel SIMilarity detection in binary COde using DEep learning NETwork (SimCoDe-NET) has been proposed. Initially, op-code features are extracted from the input data by using reverse engineering process and the opcode embedding is generated using N-skip gram method. The extracted features are fed into Bi-GRU neural network for classifying the similarity of the binary codes. The Bi-GRU neural network compares two data samples in feature space to identify whether they belong to similar data or non-similar data. The SimCoDe-NET framework is evaluated by using generated dataset to assess the efficiency of this method. The efficacy of the proposed SimCoDe-NET framework is assessed in terms of precision, accuracy, sensitivity, recall, similarity detection time and similarity detection rate. The accuracy of the proposed method is 99.10% which is relatively high compared to the existing method. The proposed SimCoDe-NET approach improves the accuracy by 84.9%, 88.58%, and 93.9% better than jTrans, UPPC, and HEBCS respectively.

DeepDual-SD: Deep Dual Attribute-Aware Embedding for Binary Code Similarity Detection

Binary code similarity detection (BCSD) is a task of detecting similarity of binary functions which are not available to the corresponding source code. It has been widely utilized to facilitate various kinds of crucial security analysis in software engineering. Because of the complexity of the program compilation process, identifying binary code similarity presents tough challenges. The most sensible binary similarity detector relies on a robust vector representation of binary code. However, few BCSD approaches are suitable to form vector representations for analyzing similarities between binaries, which may not only diverge in semantics but also in structures. And the existing solutions which only depend on hands-on feature engineering to form feature vectors, fail to take into consideration the relationships between instructions. To resolve these problems, we propose a novel and unified approach called DeepDual-SD that aims to combine the dual attributes (semantic and structural attribute). More specifically, DeepDual-SD consists of two branches, in which one text-based feature representation is driven by semantic attribute learning to exploit instruction semantics, another graph-based feature representation for structural attribute learning to investigate structural differences. Meanwhile deep embedding (DE) technology is utilized to map this information into low-dimensional vector representation. In addition, to get together the dual attributes, a fusion mechanism based on gate architecture is designed for learning to pay proper attention between the two attribute-aware embeddings. Experimental verifications are conducted on Openssl and Debian datasets for several tasks, including cross-compiler, cross-architecture and cross-version scenarios. The results demonstrate that our method outperforms the state-of-the-art BCSD methods in different scenarios in terms of detection accuracy.

Properties of Malicious Social Bots

The paper considers the ability to describe malicious bots using their characteristics, which can be the basis for building models for recognising bot parameters and qualitatively analysing attack characteristics in social networks. The following metrics are proposed using the characteristics of VKontakte social network bots as an example: trust, survivability, price, seller type, speed, and expert quality. To extract these metrics, an approach is proposed that is based on the methods of test purchases and the Turing test. The main advantage of this approach is that it proposes to extract features from the data obtained experimentally, thereby obtaining a more reasonable estimation than the expert approach. Also, an experiment on extracting metrics from malicious bots of the VKontakte social network using the proposed approach is described, and an analysis of the metrics' dependence is carried out. The experiment demonstrates the possibility of metrics extracting and analysis. In general, the proposed metrics and the approach to their extraction can become the basis for the transition from binary attack detection in social networks to a qualitative description of the attacker and his capabilities, as well as an analysis of the evolution of bots.

Multi-semantic feature fusion attention network for binary code similarity detection

Binary code similarity detection (BCSD) plays a big role in the process of binary application security test. It can be applied in several fields, such as software plagiarism detection, malware analysis, vulnerability detection. Most research is based on recurrent neural networks, which is difficult to get the overall or long-distance semantic information of functions. Besides, exiting works simply extract high-level semantic features, lacking in-depth investigations on the potential mechanisms for fusing low-level and high-level semantic features. In this paper we propose a multi-semantic feature fusion attention network (MFFA-Net) for BCSD. MFFA-Net contains two critical modules: semantic feature fusion (SFF) and attention feature fusion (AFF). The SFF module concatenates multiple semantic features to represent the semantics of the function, which helps to obtain the overall semantic information of the function. The AFF module is designed to find useful information from various features, which assigns an attention matrix to research the relationship between features. In order to evaluate the proposed method, we made extensive experiments on two datasets. MFFA-Net can achieve a high degree of AUC at 99.6% and 98.3% respectively on the two datasets. The experimental results show that MFFA-Net has better performance for BCSD.

Gravito-optics and intensity correlations for binary inspiral signal detections

In this paper, we examine the correlation functions associated with intensity interferometry and gravito-optics of gravitational wave (GW) signals from compact binary coalescences (CBC). Previous theoretical studies of the gravito-optics of GWs have concentrated on the characterization of both the classical and the nonclassical properties of signals from cosmological sources in the early Universe. These previous works assume a periodic signal similar to the signals studied widely in optics and quantum optics and do not apply to transient signals. We develop the gravito-optics of intensity correlations for descriptions of the detection of transient signals from CBC and apply these methods to calculate the two-point intensity correlations for the GW discovery. We also discuss the necessary theoretical work required for the description of the quantum gravito-optics of intensity correlations in the detection of signals from binary inspirals.

ROMEO: A binary vulnerability detection dataset for exploring Juliet through the lens of assembly language

ContextAutomatic vulnerability detection on C/C++ source code has benefitted from the introduction of machine learning to the field, with many recent publications targeting this combination. In contrast, assembly language or machine code artifacts receive less attention, although there are compelling reasons to study them. They are more representative of what is executed, more easily incorporated in dynamic analysis, and in the case of closed-source code, there is no alternative. ObjectiveWe evaluate the representative capability of assembly language compared to C/C++ source code for vulnerability detection. Furthermore, we investigate the role of call graph context in detecting function-spanning vulnerabilities. Finally, we verify whether compiling a benchmark dataset compromises an experiment’s soundness by inadvertently leaking label information. MethodWe propose ROMEO, a publicly available, reproducible and reusable binary vulnerability detection benchmark dataset derived from the synthetic Juliet test suite. Alongside, we introduce a simple text-based assembly language representation that includes context for function-spanning vulnerability detection and semantics to detect high-level vulnerabilities. It is constructed by disassembling the .text segment of the respective binaries. ResultsWe evaluate an x86 assembly language representation of the compiled dataset, combined with an off-the-shelf classifier. It compares favorably to state-of-the-art methods, including those operating on the full C/C++ code. Including context information using the call graph improves detection of function-spanning vulnerabilities. There is no label information leaked during the compilation process. ConclusionPerforming vulnerability detection on a compiled program instead of the source code is a worthwhile tradeoff. While certain information is lost, e.g., comments and certain identifiers, other valuable information is gained, e.g., about compiler optimizations.

The effects of Galactic model uncertainties on LISA observations of double neutron stars

ABSTRACT Observations of binaries containing pairs of neutron stars using the upcoming space-based gravitational wave observatory, LISA, have the potential to improve our understanding of neutron star physics and binary evolution. In this work, we assess the effect of changing the model of the Milky Way’s kinematics and star formation history on predictions of the population of double neutron stars that will be detected and resolved by LISA. We conclude that the spatial distribution of these binaries is insensitive to the choice of Galactic models, compared to the stochastic variation induced by the small sample size. In particular, the time-consuming computation of the binaries’ Galactic orbits is not necessary. The distributions of eccentricity and gravitational-wave frequency are, however, affected by the choice of star formation history. Binaries with eccentricities e > 0.1, which can be measured by LISA observations, are mostly younger than $100\, {\rm Myr}$. We caution that comparisons between different predictions for LISA observations need to use consistent star formation histories, and that the Galactic star formation history should be taken into account in the analysis of the observations themselves. The lack of strong dependence on Galactic models means that LISA detection of double neutron star binaries may provide a relatively clean probe of massive binary star evolution.

Task Assignment and Capacity Allocation for ML-Based Intrusion Detection as a Service in a Multi-Tier Architecture

Intrusion Detection Systems (IDS) play an important role in detecting network intrusions. Because intrusions have many variants and zero-day attacks, traditional signature- and anomaly-based IDS often fail to detect them. On the other hand, solutions based on Machine Learning (ML), have better capabilities for detecting variants. In this work, we adopt an ML-based IDS which uses three in-sequence tasks, pre-processing, binary detection, and multi-class detection, with a multi-tier architecture with one-, two-, and three-tier architectural configurations. We then mapped three in-sequence tasks into these architectures, resulting in ten task assignments. We evaluated these with queueing theory to determine which tasks assignments were more appropriate for particular service providers. With simulated annealing, we obtained the computation capacity by allocating the total cost appropriate to each tier, based on the fixed parameter set with the objective of minimizing overall delay. These investigations showed that using only the edge and allocating all tasks to it gave the best performance. Furthermore, a two-tier architecture with edge and cloud components was also sufficient for IDS as a Service with the delay that was three times better than for other task assignments. Our results also indicate that more than 85% of the total capacity was allocated and spread across nodes in the lowest tier for pre-processing to reduce delays.

Prospects of probing dark matter condensates with gravitational waves

The Lambda-Cold Dark Matter model explains cosmological observations most accurately till date. However, it is still plagued with various shortcomings at galactic scales. Models of dark matter such as superfluid dark matter, Bose-Einstein Condensate(BEC) dark matter and fuzzy dark matter have been proposed to overcome some of these drawbacks. In this work, we probe these models using the current constraint on the gravitational wave (GW) propagation speed coming from the binary neutron star GW170817 detection by LIGO-Virgo detector network and use it to study the allowed parameter space for these three models for Advanced LIGO+Virgo, LISA, IPTA and SKA detection frequencies. The speed of GW has been shown to depend upon the refractive index of the medium, which in turn, depends on the dark matter model parameters through the density profile of the galactic halo. We constrain the parameter space for these models using the bounds coming from GW speed measurement and the Milky Way radius bound. Our findings suggest that with Advanced LIGO-Virgo detector sensitivity, the three models considered here remain unconstrained. A meaningful constraint can only be obtained for detection frequencies ≤ 10-9 Hz, which falls in the detection range of radio telescopes such as IPTA and SKA. Considering this best possible case, we find that out of the three condensate models, the fuzzy dark matter model is the most feasible scenario to be falsified/validated in near future.