Flow Graph Research Articles

DeepCatra: Learning flow‐ and graph‐based behaviours for Android malware detection

As Android malware grows and evolves, deep learning has been introduced into malware detection, resulting in great effectiveness. Recent work is considering hybrid models and multi-view learning. However, they use only simple features, limiting the accuracy of these approaches in practice. This study proposes DeepCatra, a multi-view learning approach for Android malware detection, whose model consists of a bidirectional LSTM (BiLSTM) and a graph neural network (GNN) as subnets. The two subnets rely on features extracted from statically computed call traces leading to critical APIs derived from public vulnerabilities. For each Android app, DeepCatra first constructs its call graph and computes call traces reaching critical APIs. Then, temporal opcode features used by the BiLSTM subnet are extracted from the call traces, while flow graph features used by the GNN subnet are constructed from all call traces and inter-component communications. We evaluate the effectiveness of DeepCatra by comparing it with several state-of-the-art detection approaches. Experimental results on over 18,000 real-world apps and prevalent malware show that DeepCatra achieves considerable improvement, for example, 2.7%–14.6% on the F1 measure, which demonstrates the feasibility of DeepCatra in practice.

Z-number-based AQI in rough set theoretic framework for interpretation of air quality for different thresholds of PM2.5 and PM10.

Kolkata has a reputation for being one of the world’s most polluted cities, particularly in the post-monsoon months of October, November, and December. Diwali, a Hindu festival, coincides with these months where a large number of firecrackers are set off followed by high emissions of air pollutants. As a result, the air quality index (AQI) deteriorates to “very poor” (301 ≤ AQI ≤ 400) and “poor” (201 ≤ AQI ≤ 300) categories. This situation stays for several days to a month. The present study aims to identify the thresholds for PM2.5 and PM10 that cause the AQI of Kolkata to deteriorate to “very poor” and “poor.” For this purpose, we have used a rough set theory-based condition-decision support system to predict the aforementioned categories of AQI. We have developed a Z-number-based novel quantification measure of semantic information of AQI to assess the reliability of the outcomes, as generated from the condition-decision-based decision rules, during post-monsoon season. The result reveals the best possible forecast of AQI with linguistic summarization of the reliability or confidence for different threshold ranges of PM10 and PM2.5. Inverse-decision rules based on rough set theory are utilized to justify and validate the forecasts. The explainability of the condition-decision support system is demonstrated/visualized using a flow graph that maps rough-rule-based different decision paths between input and output with strength, certainty, and coverage. The investigation resulted in an advanced intelligent environmental decision support system (IEDSS) for air-quality prediction.

Position Distribution Matters: A Graph-Based Binary Function Similarity Analysis Method

Binary function similarity analysis evaluates the similarity of functions at the binary level to aid program analysis, which is popular in many fields, such as vulnerability detection, binary clone detection, and malware detection. Graph-based methods have relatively good performance in practice, but currently, they cannot capture similarity in the aspect of the graph position distribution and lose information in graph processing, which leads to low accuracy. This paper presents PDM, a graph-based method to increase the accuracy of binary function similarity detection, by considering position distribution information. First, an enhanced Attributed Control Flow Graph (ACFG+) of a function is constructed based on a control flow graph, assisted by the instruction embedding technique and data flow analysis. Then, ACFG+ is fed to a graph embedding model using the CapsGNN and DiffPool mechanisms, to enrich information in graph processing by considering the position distribution. The model outputs the corresponding embedding vector, and we can calculate the similarity between different function embeddings using the cosine distance. Similarity detection is completed in the Siamese network. Experiments show that compared with VulSeeker and PalmTree+VulSeeker, PDM can stably obtain three-times and two-times higher accuracy, respectively, in binary function similarity detection and can detect up to six-times more results in vulnerability detection. When comparing with some state-of-the-art tools, PDM has comparable Top-5, Top-10, and Top-20 ranking results with respect to BinDiff, Diaphora, and Kam1n0 and significant advantages in the Top-50, Top-100, and Top-200 detection results.

Holistic Combination of Structural and Textual Code Information for Context Based API Recommendation

Context based API recommendation is an important way to help developers find the needed APIs effectively and efficiently. For effective API recommendation, we need not only a joint view of both structural and textual code information, but also a holistic view of correlated API usage in control and data flow graph as a whole. Unfortunately, existing API recommendation methods exploit structural or textual code information separately. In this work, we propose a novel API recommendation approach called APIRec-CST (API Recommendation by Combining Structural and Textual code information). APIRec-CST is a deep learning model that combines the API usage with the text information in the source code based on an API Context Graph Network and a Code Token Network that simultaneously learn structural and textual features for API recommendation. We apply APIRec-CST to train a model for JDK library based on 1,914 open-source Java projects and evaluate the accuracy and MRR (Mean Reciprocal Rank) of API recommendation with another 6 open-source projects. The results show that our approach achieves respectively a top-1, top-5, top-10 accuracy and MRR of 60.3, 81.5, 87.7 and 69.4 percent, and significantly outperforms an existing graph-based statistical approach and a tree-based deep learning approach for API recommendation. A further analysis shows that textual code information makes sense and improves the accuracy and MRR. The sensitivity analysis shows that the top-k accuracy and MRR of APIRec-CST are insensitive to the number of APIs to be recommended in a hole. We also conduct a user study in which two groups of students are asked to finish 6 programming tasks with or without our APIRec-CST plugin. The results show that APIRec-CST can help the students to finish the tasks faster and more accurately and the feedback on the usability is overwhelmingly positive.

Disassemble Byte Sequence Using Graph Attention Network

Disassembly is the basis of static analysis of binary code and is used in malicious code detection, vulnerability mining, software optimization, etc. Disassembly of arbitrary suspicious code blocks (e.g., for suspicious traffic packets intercepted by the network) is a difficult task. Traditional disassembly methods require manual specification of the starting address and cannot automate the disassembly of arbitrary code blocks. In this paper, we propose a disassembly method based on code extension selection network by combining traditional linear sweep and recursive traversal methods. First, each byte of a code block is used as the disassembly start address, and all disassembly results (control flow graphs) are combined into a single flow graph. Then a graph attention network is trained to pick the correct subgraph (control flow graph) as the final result. In the experiment, the compiler-generated executable file, as well as the executable file generated by hand-written assembly code, the data file and the byte sequence intercepted by the code segment were tested, and the disassembly accuracy was 93%, which can effectively distinguish the code from the data.

Recurrent deep neural learning classification algorithm based high level synthesis in VLSI circuit with runtime adaptability

Electronics industry has attained huge development in last few decades due to the rapid increase in system design applications. With the growth of very large scale integration (VLSI) design, integrated circuits (ICs) are employed in many applications. VLSI design comprises many steps like system-level design, high-level synthesis (HLS), logic design, test generation, and physical design. HLS interprets behavior description and create digital hardware that executes the behavior. But, the power-process-voltage-temperature (PPVT) variation can causee many issues and reduce the performance of VLSI design circuits. In order to address these problems, Recurrent Deep Neural Learning Classification based High Level Synthesis (RDNLC-HLS) Model is designed for better runtime adaptability with minimal time consumption. VLSI circuits are designed with the behavioral input and the output performance is measured at runtime. The behavioral description of the circuit is taken as input. Then, source code compilation process translates high level specification into Intermediate Representation (IR) and converts to control/data flow graph (CDFG). CDFG reveals data and control dependencies between operations. The proposed Recurrent Deep Neural Learning Classification based High Level Synthesis (RDNLC-HLS) Model is designed for providing better runtime adaptability with minimal time consumption. Finally, Register Transfer Level Generation is carried out to yield better runtime adaptability with minimal time. Simulation results on ISCAS’89 Benchmark Dataset, shows that the RDNLC-HLS model increases the FUSA with minimal error rate and CAT.

Identification of malware families using stacking of textural features and machine learning

The growing rate of malware and its complexity demands a new approach to detecting evolving malware instead of relying only on high-level features such as opcodes, API calls, control flow graphs, etc. Moreover, extracting these features is an expensive and time-consuming because it requires disassembling or code execution. This paper presents a new malware detection architecture using image analysis & machine learning, requiring significantly fewer resources and does not depend upon code disassembling or execution. The collected binary samples are systematically labeled using the AVClass tool and clustering method based on similar characteristics of them. The labeled malicious program is visualized into grayscale images to extract the local and global textural features. The local textural features are extracted using SIFT, KAZE, and ORB descriptors, and global features are extracted using GIST, Hu Moments, and HOG. A bag of visual words (BoVW) algorithm is designed to select low-dimensional features and construct a local feature map of malware grayscale images. The feature maps from different image descriptors are stacked and used to train five machine learning algorithms, namely, k-Nearest Neighbor (k-NN), Support Vector Machine(SVM), Random Forest (RF), Naive Bayes(NB), and ExtraTree classifier. Two datasets are used for evaluations — the public MalImg dataset of 9339 samples of 25 different families and 690 real-world malware of 22 families collected on honeypots in the wild. Intensive experiments are performed for image descriptors, image ratios, vocabulary size, and computational time as a mean time to detection(MTTD) to devise the best detector. The proposed method obtained test accuracy of 98.34% with stacked global features and 98.23% with stacked local features. Test accuracy of 92.75% with low false-positive rates is obtained for real-world recent malware datasets. Experiment results reveal the efficacy of the proposed method in detecting polymorphic obfuscated malware. Finally, a comparison with other similar malware detection systems is presented.

Many-objective test case generation for graphical user interface applications via search-based and model-based testing

The majority of the studies that generate test cases for graphical user interface (GUI) applications are based on or address functional requirements only. In spite of the fact that interesting approaches have been proposed, they do not address functional and non-functional requirements of the GUI systems, and non-functional properties of the created test suites altogether to generate test cases. This is called a many-objective perspective where several desirable and different characteristics are considered together to generate the test cases. In this study, we show how to combine search-based (optimisation) with model-based testing to generate test cases for GUI applications taking into account the many-objective perspective. We rely on meta and hyper-heuristics and we address two particular issues (problems) considering code-driven and use case-driven GUI testing. As for the code-driven testing, we target desktop applications and automatically read the C++ source code of the system, translate it into an event flow graph (EFG), and use objective functions that are graph-based measures. As for the use case-driven testing, EFGs are created directly via use cases. A rigorous evaluation was performed using 32 problem instances where we considered three multi-objective evolutionary algorithms and six selection hyper-heuristics using those algorithms as low-level (meta)heuristics. The performance of the algorithms was compared based on five different indicators, and also a new Multi-Metric Indicator (MMI) utilising multiple indicators and providing a unique measure for all algorithms. Results show that the metaheuristics obtained better performances overall, particularly NSGA-II, while Choice Function was the most outstanding hyper-heuristic approach.

Generating Customised Control Flow Graphs for Legacy Languages with Semi-Parsing

Generating Customised Control Flow Graphs for Legacy Languages with Semi-Parsing

An Efficient Method of Deadlock Detection and Recovery for Flexible Manufacturing Systems by Resource Flow Graphs

Deadlocks are a highly undesirable situation in flexible manufacturing systems (FMSs). This article presents a direct and novel method to detect such markings by constructing the resource flow graph of a Petri net that models an FMS and to recover such markings by adding a set of recovery transitions. First, an algorithm is developed to build a new kind of directed graph called the resource flow graph of a Petri net. Resource flow graphs can well represent the competition for shared resources by different processes. Second, based on the resource flow graph, loop graphs can be found. Furthermore, partial deadlock markings can be easily detected due to their relationship with loop graphs. Then, we propose an algorithm to design a set of recovery transitions for loop graphs that are enabled at partial deadlock markings. The proposed approach can detect partial deadlock markings without generating a complete reachability graph of a Petri net and the resulting net is deadlock-free with all reachable markings by adding the obtained recovery transitions. Finally, some widely used examples are provided to demonstrate the proposed approach. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —The occurrence of deadlocks in an FMS tends to cause unnecessary productivity costs and even catastrophic results. In the framework of Petri nets, reachability graph analysis can usually obtain a maximally permissive supervisor of a plant. However, it is rather inefficient since it suffers from the state explosion problem. In this particular research, we develop an off-line deadlock detection and recovery policy by setting a group of virtual events that are not present in a physical model. The proposed approach is computationally efficient since it does not require to generate a reachability graph. It guarantees that the resulted system is deadlock-free with its all original reachable markings.

A Nonisolated Three-Port DC–DC Converter With Two Bidirectional Ports and Fewer Components

This article presents a new nonisolated three-port converter with reduced component count compared with existing reported topologies. This is achieved by developing different power flow graphs and selecting the most appropriate converters arrangement. In addition, as compared to only one bidirectional port in most reported studies, this article considers two bidirectional ports to accommodate applications requiring bidirectional power flow, such as dc microgrid and regenerative braking. The proposed converter is able to work in seven different modes of operation, which cover all possible combinations of power flow among the three ports. Furthermore, seamless and smooth transition, maximum power point tracking, battery protection and output voltage regulation are achieved. Experimental waveforms, particularly for transient responses during mode transition, are reported to verify the proposed TPC.

Application of Model-Based Software Testing in the Health Care Domain

The human body’s reaction to various therapeutic medications is critical to comprehend since it aids in the appropriate construction of automated decision support systems for healthcare. Healthcare Internet of Things (IoT) solutions are becoming more accessible and trusted, necessitating more testing before they are standardized for commercial usage. We have developed an activity diagram based on the Unified Modeling Language (UML) to represent acceptability testing in IoT systems. The activity flow graph is used to extract all of the necessary information by traversing the activity flow diagram from start to finish, displaying all its properties. In this paper, a test case is generated to compute the type of diabetes using blood sugar test results, estimate the kind of diabetes, and the probability that a person would get diabetes in the future. We have demonstrated how these test cases can function using a telehealth care case study. First, we offer a high-level overview of the topic as well as a design model working diagram. The test case creation method is then outlined using the activity diagram as a guide.

Improving the efficiency of intrusion detection in information systems

Abstract Policy Interaction Graph Analysis is a Host-based Intrusion Detection tool that uses Linux MAC Mandatory access control policy to build the licit information flow graph and uses a detection policy defined by the administrator to extract illicit behaviour from the graph. The main limitation of this tool is the generation of a huge signature base of illicit behaviours; hence, this leads to the use of huge memory space to store it. Our primary goal in this article is to reduce this memory space while keeping the tool’s efficiency in terms of intrusion detection rate and false generated alarms. First, the interactions between the two nodes of the graph were grouped into a single interaction. The notion of equivalence class was used to classify the paths in the graph and was compressed by using a genetic algorithm. Such an approach showed its efficiency compared to the approach proposed by Pierre Clairet, by which the detection rate obtained was 99.9%, and no false-positive with a compression rate of illicit behaviour signature database reached 99.44%. Having these results is one of the critical aspects of realizing successful host-based intrusion detection systems.

Identifying ATT&amp;CK Tactics in Android Malware Control Flow Graph through Graph Representation Learning and Interpretability (Student Abstract)

To mitigate a malware threat it is important to understand the malware’s behavior. The MITRE ATT&amp;ACK ontology specifies an enumeration of tactics, techniques, and procedures (TTP) that characterize malware. However, absent are automated procedures that would characterize, given the malware executable, which part of the execution flow is connected with a specific TTP. This paper provides an automation methodology to locate TTP in a sub-part of the control flow graph that describes the execution flow of a malware executable. This methodology merges graph representation learning and tools for machine learning explanation.

Vulnerability Digging for Software-Defined Network Controller Using Event Flow Graph Analysis

Software-defined network (SDN) controllers, the core of SDN network architecture, need to deal with network events of the whole network, which has huge program state space and complex logic dependency, with security issues related. Vulnerabilities in the SDN controller can paralyze the whole network. Existing controller testing methods are difficult to dig into the hidden logic vulnerability for their ignorance of the complex events interactions among controllers, apps, and data plane inputs. Different from file processing software, network software is driven by events, and the event flow can more accurately and comprehensively reflect the execution process. In this work, we propose an SDN controller vulnerability digging method based on event flow graph analysis. The proposed method consists of three main steps: first, we execute the instrumented controller in a normal environment and generate event flow graphs and then extract their features as reference. Second, we generate and execute test cases using the fuzzing method and dig the newly built event flow graphs with potential vulnerabilities. Finally, we manually examine and validate the potential vulnerabilities. To accurately discover abnormal subgraphs, we utilize graph feature extraction and analysis technologies, such as graph mining and clustering, to distinguish the normal graph and abnormal graph. We implement our method on the Ryu controller and compare it with other SDN testing methods, such as BEADS and Delta. The evaluation indicates that our method uncovered three new vulnerabilities that other methods failed to find.

Recovering Latent Data Flow from Business Process Model Automatically

Process-driven applications evolve rapidly through the interaction between executable BPMN (Business Process Modeling and Notation) models, business tasks, and external services. Given these components operate on some shared process data, it is imperative to recover the latent data by visiting relation, which is known as data flow among these tasks. Data flow will benefit some typical applications including data flow anomaly checking and data privacy protection. However, in most cases, the complete data flow in a business process is not explicitly defined but hidden in model elements such as form declarations, variable declarations, and program code. Some methods to recovering data flow based on process model analysis of source code have some drawbacks; i.e., for security reasons, users do not want to provide source code but only encapsulated methods; therefore, data flows are difficult to analyze. We propose a method to generate running logs that are used to produce a complete data flow picture combined with the static code analysis method. This method combines the simple and easy-to-use characteristics of static code analysis methods and makes up for the shortcomings of static code analysis methods that cannot adapt to complex business processes, and as a result, the analyzed data flow is inaccurate. Moreover, a holistic framework is proposed to generate the data flow graph. The prototype system designed on Camunda and Flowable BPM (business process management) engine proves the applicability of the solution. The effectiveness of our method is validated on the prototype system.

Guest Editorial Special Issue on Graph-Powered Machine Learning for Internet of Things

Internet of Things (IoT) refers to an ecosystem where applications and services are driven by data collected from devices interacting with each other and the physical world. Although IoT has already brought spectacular benefits to human society, the progress is actually not as fast as expected. From network structures to control flow graphs, IoT naturally generates an unprecedented volume of graph data continuously, which stimulates fertilization and making use of advanced graph-powered methods on the diverse, dynamic, and large-scale graph IoT data.

Метод оценки ресурсов в процессе функционально-потокового высокоуровневого синтеза СБИС

The problems of high-level synthesis of very large integrated circuits (VLSI) are considered. The review of the subject area shows that the use of the imperative model and corresponding programming languages does not provide efficient parallelization of algorithms and the possibility of efficient parallelization of programs. This leads to the impossibility of providing the required technical characteristics. This is due to the specifics of VLSI, which is essentially a scheme of parallel processing of information flows. An original VLSI synthesis method is presented. The method based on the functional-streaming paradigm of parallel computing. This method allows ensuring architectural independence and maximum coverage of implementation options. The route map of VLSI functional-flow method is outlined. The problem of estimating the requested hardware resources and clock frequency, necessary for solving, is formulated. This problem must be solved at the early stages of design. A method for estimating resources in the process of functional-flow synthesis is proposed. The method is based on the use of an additional meta-layer (HDL-graph). Taking into account the polymorphism of the solution of the resource estimation problem, it is proposed to use machine learning technologies in the new method. It is shown that the application of the indicated method in the synthesis process makes it possible to provide the most accurate assessment of resources. This is possible, because the HDL graph is a data flow graph typed and structured in accordance with the functional-flow model of parallel computing. Machine learning allows to most effectively obtain a solution to the problem of optimal selection of the required resources. The classes of resources for which an assessment is required are highlighted. Selected parameters for building a resource assessment model. The software implementation and comparison of the proposed resource estimation method based on linear regression models, neural networks and gradient boosting with known approaches is performed. It is shown that when using the technology of functional-flow synthesis when applying the proposed method for estimating the required resources and performance, an increase in the accuracy of the estimate at the high-level stage.

Apícula: Static detection of API calls in generic streams of bytes

API functions often require the crafting of specific inputs and may return some output that is usually processed by the code that immediately follows their invocation. In this work, we claim that - for some APIs - those two stages are both frequently similar across different binaries and sufficiently unique to be fingerprinted.We build upon this intuition and present Apícula, a static analysis tool for identifying API calls in generic streams of bytes, such as memory dumps, network traffic, or object code files. In a nutshell, Apícula leverages the control flow graph of a binary to generate a set of fingerprints for all basic blocks that end with a call instruction. Those sets are then compared against a database of pre-computed fingerprints to establish whether any known API is being invoked. Due to its applicability to unstructured byte streams, Apícula can complement the reverse engineering process when this is carried out over memory dumps collected after a cyber-incident. Moreover, it can enable behavioral analysis in a fully static way, by identifying sequences of API calls even in non executable binaries.We provide a series of experiments that are instrumental (1) in demonstrating that the same fingerprints computed for specific APIs can be observed across different binaries and (2) in identifying a subset of the Windows APIs whose usage can be detected by Apícula with sufficient precision and sensitivity, focusing in particular on malicious binaries. Furthermore, we illustrate two techniques that can be used to validate different fingerprint databases in case someone wants to detect APIs belonging to libraries different from those that we consider in this work.In particular, we prove that fingerprints associated with different APIs are remarkably dissimilar and therefore can be employed for distinguishing between APIs. More specifically, we find that fingerprint sets associated with different APIs present on average a Jaccard index value of 0.000125; in comparison, the average similarity between fingerprint sets associated with the same API is 0.29 (Jaccard index) for binaries compiled with the same optimization level and 0.07 (Jaccard index) for binaries compiled with different optimization levels. Moreover, we show that we can build databases of fingerprints that are sufficiently comprehensive to identify specific APIs in unseen binaries. More precisely, we identify 228 different APIs among the Windows APIs (including the C run-time libraries) whose usage can be detected by Apículawith sensitivity greater than 80% and a false discovery rate lower than 5%.

Information Fragmentation, Encryption and Information Flow in Complex Biological Networks

Assessing where and how information is stored in biological networks (such as neuronal and genetic networks) is a central task both in neuroscience and in molecular genetics, but most available tools focus on the network’s structure as opposed to its function. Here, we introduce a new information-theoretic tool—information fragmentation analysis—that, given full phenotypic data, allows us to localize information in complex networks, determine how fragmented (across multiple nodes of the network) the information is, and assess the level of encryption of that information. Using information fragmentation matrices we can also create information flow graphs that illustrate how information propagates through these networks. We illustrate the use of this tool by analyzing how artificial brains that evolved in silico solve particular tasks, and show how information fragmentation analysis provides deeper insights into how these brains process information and “think”. The measures of information fragmentation and encryption that result from our methods also quantify complexity of information processing in these networks and how this processing complexity differs between primary exposure to sensory data (early in the lifetime) and later routine processing.