Runtime Values Research Articles

Dynamic VSA: a framework for malware detection based on register contents

The number of malware files increases every day because of existing obfuscation techniques. Researchers recently pursued dynamic analysis to extract runtime behavior of programs to detect new malware variants.A method is proposed to find similarities of run-time behaviors based on the assumption that binary behaviors affect registers values differently. The idea has been explored in static settings known as VSA, where run-time values were estimated statically. VSA is extended into a dynamic setting in this research where actual run-time values are used to approximate all the possible values. Due to large number of values obtained for each binary in every register at run-time, a small representative set, a.k.a. prototypes, is extracted. Unknown files are classified based on comparison to these prototypes only. Experimental results showed that proposed method outperformed commercial Anti-Virus applications on the dataset used and reached a classification accuracy of 95.9% with 4.5% false positive. List of execution traces and dataset can be found at: http://home.shirazu.ac.ir/~sami/malware.

Algorithmic debugging of real-world haskell programs: deriving dependencies from the cost centre stack

Existing algorithmic debuggers for Haskell require a transformation of all modules in a program, even libraries that the user does not want to debug and which may use language features not supported by the debugger. This is a pity, because a promising approach to debugging is therefore not applicable to many real-world programs. We use the cost centre stack from the Glasgow Haskell Compiler profiling environment together with runtime value observations as provided by the Haskell Object Observation Debugger (HOOD) to collect enough information for algorithmic debugging. Program annotations are in suspected modules only. With this technique algorithmic debugging is applicable to a much larger set of Haskell programs. This demonstrates that for functional languages in general a simple stack trace extension is useful to support tasks such as profiling and debugging.

WAVE: Interactive Wave-based Sound Propagation for Virtual Environments.

We present an interactive wave-based sound propagation system that generates accurate, realistic sound in virtual environments for dynamic (moving) sources and listeners. We propose a novel algorithm to accurately solve the wave equation for dynamic sources and listeners using a combination of precomputation techniques and GPU-based runtime evaluation. Our system can handle large environments typically used in VR applications, compute spatial sound corresponding to listener's motion (including head tracking) and handle both omnidirectional and directional sources, all at interactive rates. As compared to prior wave-based techniques applied to large scenes with moving sources, we observe significant improvement in runtime memory. The overall sound-propagation and rendering system has been integrated with the Half-Life 2 game engine, Oculus-Rift head-mounted display, and the Xbox game controller to enable users to experience high-quality acoustic effects (e.g., amplification, diffraction low-passing, high-order scattering) and spatial audio, based on their interactions in the VR application. We provide the results of preliminary user evaluations, conducted to study the impact of wave-based acoustic effects and spatial audio on users' navigation performance in virtual environments.

Kinetic Dependence Graphs

Task graphs or dependence graphs are used in runtime systems to schedule tasks for parallel execution. In problem domains such as dense linear algebra and signal processing, dependence graphs can be generated from a program by static analysis. However, in emerging problem domains such as graph analytics, the set of tasks and dependences between tasks in a program are complex functions of runtime values and cannot be determined statically. In this paper, we introduce a novel approach for exploiting parallelism in such programs. This approach is based on a data structure called the kinetic dependence graph (KDG), which consists of a dependence graph together with update rules that incrementally update the graph to reflect changes in the dependence structure whenever a task is completed. We have implemented a simple programming model that allows programmers to write these applications at a high level of abstraction, and a runtime within the Galois system [15] that builds the KDG automatically and executes the program in parallel. On a suite of programs that are difficult to parallelize otherwise, we have obtained speedups of up to 33 on 40 cores, out-performing third-party implementations in many cases.

Kinetic Dependence Graphs

Task graphs or dependence graphs are used in runtime systems to schedule tasks for parallel execution. In problem domains such as dense linear algebra and signal processing, dependence graphs can be generated from a program by static analysis. However, in emerging problem domains such as graph analytics, the set of tasks and dependences between tasks in a program are complex functions of runtime values and cannot be determined statically. In this paper, we introduce a novel approach for exploiting parallelism in such programs. This approach is based on a data structure called the kinetic dependence graph (KDG), which consists of a dependence graph together with update rules that incrementally update the graph to reflect changes in the dependence structure whenever a task is completed. We have implemented a simple programming model that allows programmers to write these applications at a high level of abstraction, and a runtime within the Galois system [15] that builds the KDG automatically and executes the program in parallel. On a suite of programs that are difficult to parallelize otherwise, we have obtained speedups of up to 33 on 40 cores, out-performing third-party implementations in many cases.

Wavelet-Based Trace Alignment Algorithms for Heterogeneous Architectures

Heterogeneous architectures with single-instruction set architecture (ISA) asymmetric cores can improve both the performance and energy efficiency of software execution by dynamically selecting the most appropriate core type to run each execution thread. In this paper, we propose a trace-based methodology to explore power and performance benefits of single-ISA heterogeneous core architectures. The basic idea is to collect multiple traces by running a workload on different homogeneous platforms, and to align these traces for offline analysis. For this, we propose a wavelet-based similarity metric, which captures both fine-grain and coarse-grain software phases across different traces. Then, we propose a scalable dynamic programming algorithm to optimize this metric to align the traces. Our experiments show that the runtime and energy values predicted by our offline methodology have good accuracy with respect to the real measurements from a prototype heterogeneous system.

Dependent Information Flow Types

In this paper, we develop a novel notion of dependent information flow types. Dependent information flow types fit within the standard framework of dependent type theory, but, unlike usual dependent types, crucially allow the security level of a type, rather than just the structural data type itself, to depend on runtime values. Our dependent function and dependent sum information flow types provide a direct, natural and elegant way to express and enforce fine grained security policies on programs, including programs that manipulate structured data types in which the security level of a structure field may depend on values dynamically stored in other fields, still considered a challenge to security enforcement in software systems such as data-centric web-based applications. We base our development on the very general setting of a minimal lambda-calculus with references and collections. We illustrate its expressiveness, showing how secure operations on relevant scenarios can be modelled and analysed using our dependent information flow type system, which is also shown to be amenable to algorithmic type checking. Our main results include type-safety and non-interference theorems ensuring that well-typed programs do not violate prescribed security policies.

Агрессивная инлайн-подстановка функций для VLIW-архитектур

Inline expansion is very important for high performance VLIW, especially for microprocessors with static scheduling. Optimizations in optimizing compilers for VLIW duplicate code aggressively and lead to long compile time. Our inlining algorithm is based on heuristics that takes into account compile time explicitly. This made optimization more balanced and significantly reduced code growth and compile time compared to common inlining approach based on minimization of runtime within constraints. Instead of using hard constraints we are trading run time for compilation time in some proportion. Our heuristics predicts several key optimizations in evaluation of runtime and compile time: code scheduling, global copy propagation, dead code elimination and different loop optimizations. Optimizations prediction reduces the need in profile information which is rarely available in practice. Our implementation of inlining includes cloning, partial inlining and inlining across compilation modules in whole program mode. All this factors make dramatic impact on performance: our inlining implementation in the Elbrus optimizing compiler boost SPEC CPU2006 benchmark performance by factor of 1.41 at the cost of 12% increase of compile time and 7.7% increase of code size on average.

The generic model query language GMQL – Conceptual specification, implementation, and runtime evaluation

The generic model query language GMQL is designed to query collections of conceptual models created in arbitrary graph-based modelling languages. Querying conceptual models means searching for particular model subgraphs that comply with a predefined pattern query. Such a query specifies the structural and semantic properties of the model fragment to be returned. In this paper, we derive requirements for a generic model query language from the literature and formally specify the language’s syntax and semantics. We conduct an analysis of GMQL׳s theoretical and practical runtime performance concluding that it returns query results within satisfactory time. Given its generic nature, GMQL contributes to a broad range of different model analysis scenarios ranging from business process compliance management to model translation and business process weakness detection. As GMQL returns results with acceptable runtime performance, it can be used to query large collections of hundreds or thousands of conceptual models containing not only process models, but also data models or organizational charts. In this paper, we furthermore evaluate GMQL against the backdrop of existing query approaches thereby carving out its advantages and limitations as well as pointing toward future research.

Evaluation of bias, precision, robustness and runtime for estimation methods in NONMEM 7.

NONMEM is the most widely used software for population pharmacokinetic (PK)-pharmacodynamic (PD) analyses. The latest version, NONMEM 7 (NM7), includes several sampling-based estimation methods in addition to the classical methods. In this study, performance of the estimation methods available in NM7 was investigated with respect to bias, precision, robustness and runtime for a diverse set of PD models. Simulations of 500 data sets from each PD model were reanalyzed with the available estimation methods to investigate bias and precision. Simulations of 100 data sets were used to investigate robustness by comparing final estimates obtained after estimations starting from the true parameter values and initial estimates randomly generated using the CHAIN feature in NM7. Average estimation time for each algorithm and each model was calculated from the runtimes reported by NM7. The method giving the lowest bias and highest precision across models was importance sampling, closely followed by FOCE/LAPLACE and stochastic approximation expectation-maximization. The methods relative robustness differed between models and no method showed clear superior performance. FOCE/LAPLACE was the method with the shortest runtime for all models, followed by iterative two-stage. The Bayesian Markov Chain Monte Carlo method, used in this study for point estimation, performed worst in all tested metrics.

Just-in-time value specialization

JavaScript emerges today as one of the most important programming languages for the development of client-side web applications. Therefore, it is essential that browsers be able to execute JavaScript programs efficiently. However, the dynamic nature of this programming language makes it very challenging to achieve this much needed efficiency. In this paper we propose parameter-based value specialization as a way to improve the quality of the code produced by JIT engines. We have empirically observed that almost 60% of the JavaScript functions found in the world's 100 most popular websites are called only once, or are called with the same parameters. Capitalizing on this observation, we adapt a number of classic compiler optimizations to specialize code based on the runtime values of function's actual parameters. We have implemented the techniques proposed in this paper in IonMonkey, an industrial quality JavaScript JIT compiler developed at the Mozilla Foundation. Our experiments, run across three popular JavaScript benchmarks, SunSpider, V8 and Kraken, show that, in spite of its highly speculative nature, our optimization pays for itself. As an example, we have been able to speed up V8 by 4.83%, and to reduce the size of its generated native code by 18.84%.

Research on the Power Prediction of Photovoltaic Power Station Based on LMS Adaptive Filter

Along with continuous increase of capacity of PV(photovoltaic) power station, techniques for power prediction of PV power station play an important role in reducing impact of stochastic fluctuation of PV power stations energy output on power system. The paper proposes a method for power prediction of PV power station based on LMS adaptive filter, a FIR approach model of PV station power prediction model based on LMS adaptive filter is established with history runtime value of PV station as the input value of filter and current value as the expected value. The advantage of using LMS filter to power prediction of PV power station is that a real-time, explicit identification result can be obtained as well as that the algorithm is simple. A test has been made with runtime data of one PV power station and the result showed that the prediction method in the paper has good accuracy in terms of super-short term power prediction.

Double Four-Bar Crank-Slider Mechanism Dynamic Balancing by Meta-Heuristic Algorithms

In this paper, a new method for dynamic balancing of double four-bar crank slider mechanism by meta- heuristic-based optimization algorithms is proposed. For this purpose, a proper objective function which is necessary for balancing of this mechanism and corresponding constraints has been obtained by dynamic modeling of the mechanism. Then PSO, ABC, BGA and HGAPSO algorithms have been applied for minimizing the defined cost function in optimization step. The optimization results have been studied completely by extracting the cost function, fitness, convergence speed and runtime values of applied algorithms. It has been shown that PSO and ABC are more efficient than BGA and HGAPSO in terms of convergence speed and result quality. Also, a laboratory scale experimental doublefour-bar crank-slider mechanism was provided for validating the proposed balancing method practically.

Interactive programming with dependent types

In dependently typed languages run-time values can appear in types, making it possible to give programs more precise types than in languages without dependent types. This can range from keeping track of simple invariants like the length of a list, to full functional correctness. In addition to having some correctness guarantees on the final program, assigning more precise types to programs means that you can get more assistance from the type checker while writing them. This is what I focus on here, demonstrating how the programming environment of Agda can help you when developing dependently typed programs.

Progress in the development of an implicit steady state solution in the coupled code TRACE/PARCS

This paper describes the implementation of an implicit steady state solution method in the TRAC/RELAP Advanced Computational Engine (TRACE) thermal-hydraulics system code and Purdue Advanced Reactor Core Simulator (PARCS) code with the goal of improving solution stability and efficiency. The implicit steady state solution method has been implemented within the framework of the existing psuedo-transient solution method in TRACE and includes time-dependent thermal-hydraulic and heat transfer equations and time-independent neutron diffusion equations. The implicit solution method uses Newton's method to solve the thermal-hydraulic, heat transfer, and neutron diffusion equations during each psuedo-time step with an analytic construction of the Jacobian matrix. The linear system associated with each iteration of Newton's method is solved using a preexisting LU decomposition algorithm in TRACE. The implicit steady state solution was evaluated using two different meshes overlaid on a two-phase pipe model closely matching a boiling water reactor hydraulic channel. The implicit solution method reproduces the correct steady state solution for varying time step sizes for each mesh. An evaluation of the CPU runtime required to complete a steady state calculation using the implicit method shows that the well-developed and optimized explicit solution method currently requires less CPU runtime than the implicit solution method which has yet to be optimized. These results direct future development of the implicit solution method towards optimization strategies to reduce CPU runtime.

Software effort models should be assessed via leave-one-out validation

ContextMore than half the literature on software effort estimation (SEE) focuses on model comparisons. Each of those requires a sampling method (SM) to generate the train and test sets. Different authors use different SMs such as leave-one-out (LOO), 3Way and 10Way cross-validation. While LOO is a deterministic algorithm, the N-way methods use random selection to build their train and test sets. This introduces the problem of conclusion instability where different authors rank effort estimators in different ways. ObjectiveTo reduce conclusion instability by removing the effects of a sampling method's random test case generation. MethodCalculate bias and variance (B&V) values following the assumption that a learner trained on the whole dataset is taken as the true model; then demonstrate that the B&V and runtime values for LOO are similar to N-way by running 90 different algorithms on 20 different SEE datasets. For each algorithm, collect runtimes, B&V values under LOO, 3Way and 10Way. ResultsWe observed that: (1) the majority of the algorithms have statistically indistinguishable B&V values under different SMs and (2) different SMs have similar run times. ConclusionIn terms of their generated B&V values and runtimes, there is no reason to prefer N-way over LOO. In terms of reproducibility, LOO removes one cause of conclusion instability (the random selection of train and test sets). Therefore, we depreciate N-way and endorse LOO validation for assessing effort models.

The type discipline of behavioral separation

We introduce the concept of behavioral separation as a general principle for disciplining interference in higher-order imperative concurrent programs, and present a type-based approach that systematically develops the concept in the context of an ML-like language extended with concurrency and synchronization primitives. Behavioral separation builds on notions originally introduced for behavioral type systems and separation logics, but shifts the focus from the separation of static program state properties towards the separation of dynamic usage behaviors of runtime values. Behavioral separation types specify how values may be safely used by client code, and can enforce fine-grained interference control disciplines while preserving compositionality, information hiding, and flexibility. We illustrate how our type system, even if based on a small set of general primitives, is already able to tackle fairly challenging program idioms, involving aliasing at various types, concurrency with first-class threads, manipulation of linked data structures, behavioral borrowing, and invariant-based separation.

Evaluation of read count based RNAseq analysis methods

BackgroundRNAseq technology is replacing microarray technology as the tool of choice for gene expression profiling. While providing much richer data than microarray, analysis of RNAseq data has been much more challenging. To date, there has not been a consensus on the best approach for conducting robust RNAseq analysis.ResultsIn this study, we designed a thorough experiment to evaluate six read count-based RNAseq analysis methods (DESeq, DEGseq, edgeR, NBPSeq, TSPM and baySeq) using both real and simulated data. We found the six methods produce similar fold changes and reasonable overlapping of differentially expressed genes based on p-values. However, all six methods suffer from over-sensitivity.ConclusionsBased on the evaluation of runtime using real data and area under the receiver operating characteristic curve (AUC-ROC) using simulated data, we found that edgeR achieves a better balance between speed and accuracy than the other methods.

Improving Bit-Vector Representation of Points-To Sets Using Class Hierarchy

Points-to analysis is the problem of approximating run-time values of pointers statically or at compile-time. Points-to sets are used to store the approximated values of pointers during points-to analysis. Memory usage and running time limit the ability of points-to analysis to analyze large programs. To our knowledge, works which have implemented a bit-vector representation of points-to sets so far, allocates bits for each pointer without considering pointer's type. By considering the type, we are able to allocate bits only for a subset of all abstract objects which are of compatible type with the pointer's type and as a consequence improve the memory usage and running time. To achieve this goal, we number abstract objects in a way that all the abstract objects of a type and all of its sub-types be consecutive in order. Our most efficient implementation uses about 2.5 times less memory than hybrid points-to set (default points-to set in Spark) and also improves the analysis time for sufficiently large programs.

Improving Bit-Vector Representation of Points-To Sets Using Class Hierarchy

 Abstract—Points-to analysis is the problem of approximating run-time values of pointers statically or at compile-time. Points-to sets are used to store the approximated values of pointers during points-to analysis. Memory usage and running time limit the ability of points-to analysis to analyze large programs. To our knowledge, works which have implemented a bit-vector representation of points-to sets so far, allocates bits for each pointer without considering pointer's type. By considering the type, we are able to allocate bits only for a subset of all abstract objects which are of compatible type with the pointer's type and as a consequence improve the memory usage and running time. To achieve this goal, we number abstract objects in a way that all the abstract objects of a type and all of its sub-types are consecutive in order. Our most efficient implementation uses about 2.5× less memory than hybrid points-to set (default points-to set in Spark) and also improves the analysis time for sufficiently large programs.