Runtime Behavior Research Articles

Automatic retrieval and analysis of high availability scenarios from system execution traces: A case study on hot standby router protocol

High availability (HA) is becoming an increasingly important requirement in a growing number of domains. It is even mandatory for critical systems, such as networking and communications, that cannot afford downtime. Such systems often monitor the state of crucial services and produce huge amounts of execution trace data, where functional and non-functional log entries are intertwined; hence they are hard to dissociate and analyze. Dynamic analysis aims at capturing and analyzing run-time behavior of a system based on its execution traces. In this paper, we apply dynamic analysis to retrieve and analyze HA scenarios from system execution traces. Our proposed approach aims to help analysts understand and report on how a highly available system detects and recovers from failures. As a proof of concept, we have selected the Hot Standby Router Protocol (HSRP) in order to demonstrate the applicability of our approach. We have evaluated empirically the effectiveness of our technique using four real-world case studies of IP networks running HSRP. Results have shown that high availability scenarios were successfully retrieved and analyzed. Moreover, results have shown that our prototype tool HAAnalyzer was able to effectively unveil high availability behavioral and temporal errors, that were seeded in the execution traces.

An Enhanced Hybrid Battery Model

A high-fidelity battery model capable of accurately predicting real-time battery behavior for various operating conditions is crucial for the design and operation of battery-powered systems. Based upon a prior work of the authors, this paper proposes an enhanced hybrid battery model to provide accurate predictions for the runtime behaviors of rechargeable electrochemical battery cells under various ambient temperatures and charge/discharge current conditions. The proposed battery model is validated by simulation and experimental studies for lithium-ion battery cells in various current and temperature conditions. The proposed battery model is computationally effective for design, simulation, condition monitoring, and power management of various battery systems.

FlowSpec: A declarative specification language for intra-procedural flow-Sensitive data-flow analysis

Abstract Data-flow analysis is the static analysis of programs to estimate their approximate run-time behavior or approximate intermediate run-time values. It is an integral part of modern language specifications and compilers. In the specification of static semantics of programming languages, the concept of data-flow allows the description of well-formedness such as definite assignment of a local variable before its first use. In the implementation of compiler back-ends, data-flow analyses inform optimizations. Data-flow analysis has an established theoretical foundation. What lags behind is implementations of data-flow analysis in compilers, which are usually ad-hoc. This makes such implementations difficult to extend and maintain. In previous work researchers have proposed higher-level formalisms suitable for whole-program analysis in a separate tool, incremental analysis within editors, or bound to a specific intermediate representation. In this paper, we present FlowSpec , an executable formalism for specification of data-flow analysis. FlowSpec is a domain-specific language that enables direct and concise specification of data-flow analysis for programming languages, designed to express flow-sensitive, intra-procedural analyses. We define the formal semantics of FlowSpec in terms of monotone frameworks. We describe the design of FlowSpec using examples of standard analyses. We also include a description of our implementation of FlowSpec . In a case study we evaluate FlowSpec with the static analyses for Green-Marl , a domain-specific programming language for graph analytics.

AndroShield: Automated Android Applications Vulnerability Detection, a Hybrid Static and Dynamic Analysis Approach

The security of mobile applications has become a major research field which is associated with a lot of challenges. The high rate of developing mobile applications has resulted in less secure applications. This is due to what is called the “rush to release” as defined by Ponemon Institute. Security testing—which is considered one of the main phases of the development life cycle—is either not performed or given minimal time; hence, there is a need for security testing automation. One of the techniques used is Automated Vulnerability Detection. Vulnerability detection is one of the security tests that aims at pinpointing potential security leaks. Fixing those leaks results in protecting smart-phones and tablet mobile device users against attacks. This paper focuses on building a hybrid approach of static and dynamic analysis for detecting the vulnerabilities of Android applications. This approach is capsuled in a usable platform (web application) to make it easy to use for both public users and professional developers. Static analysis, on one hand, performs code analysis. It does not require running the application to detect vulnerabilities. Dynamic analysis, on the other hand, detects the vulnerabilities that are dependent on the run-time behaviour of the application and cannot be detected using static analysis. The model is evaluated against different applications with different security vulnerabilities. Compared with other detection platforms, our model detects information leaks as well as insecure network requests alongside other commonly detected flaws that harm users’ privacy. The code is available through a GitHub repository for public contribution.

Mining association rules for anomaly detection in dynamic process runtime behavior and explaining the root cause to users

Detecting anomalies in process runtime behavior is crucial: they might reflect, on the one side, security breaches and fraudulent behavior and on the other side desired deviations due to, for example, exceptional conditions. Both scenarios yield valuable insights for process analysts and owners, but happen due to different reasons and require a different treatment. Hence a distinction into malign and benign anomalies is required. Existing anomaly detection approaches typically fall short in supporting experts when in need to take this decision. An additional problem are false positives which could result in selecting incorrect countermeasures. This paper proposes a novel anomaly detection approach based on association rule mining. It fosters the explanation of anomalies and the estimation of their severity. In addition, the approach is able to deal with process change and flexible executions which potentially lead to false positives. This facilitates to take the appropriate countermeasure for a malign anomaly and to avoid the possible termination of benign process executions. The feasibility and result quality of the approach are shown by a prototypical implementation and by analyzing real life logs with injected artificial anomalies. The explanatory power of the presented approach is evaluated through a controlled experiment with users.

Using multi-objective search and machine learning to infer rules constraining product configurations

Modern systems are being developed by integrating multiple products within/across product lines that communicate with each other through information networks. Runtime behaviors of such systems are related to product configurations and information networks. Cost-effectively supporting Product Line Engineering (PLE) of such systems is challenging mainly because of lacking the support of automation of the configuration process. Capturing rules is the key for automating the configuration process in PLE. However, there does not exist explicitly-specified rules constraining configurable parameter values of such products and product lines. Manually specifying such rules is tedious and time-consuming. To address this challenge, in this paper, we present an improved version (named as SBRM+) of our previously proposed Search-based Rule Mining (SBRM) approach. SBRM+ incorporates two machine learning algorithms (i.e., C4.5 and PART) and two multi-objective search algorithms (i.e., NSGA-II and NSGA-III), employs a clustering algorithm (i.e., k means) for classifying rules as high or low confidence rules, which are used for defining three objectives to guide the search. To evaluate SBRM+ (i.e., \( SBRM^{ + }_{NSGA \text{-} II} \)-C45, \( SBRM^{ + }_{NSGA \text{-} III} \)-C45, \( SBRM^{ + }_{NSGA \text{-} II} \)-PART, and \( SBRM^{ + }_{NSGA \text{-} III} \)-PART), we performed two case studies (Cisco and Jitsi) and conducted three types of analyses of results: difference analysis, correlation analysis, and trend analysis. Results of the analyses show that all the SBRM+ approaches performed significantly better than two Random Search-based approaches (RBRM+-C45 and RBRM+-PART) in terms of fitness values, six quality indicators, and 17 machine learning quality measurements (MLQMs). As compared to RBRM+ approaches, SBRM+ approaches have improved the quality of rules based on MLQMs up to 27% for the Cisco case study and 28% for the Jitsi case study.

Dynamic capping of rename registers for SMT processors

Abstract Simultaneous Multithreading improves performance of superscalar CPUs by allowing execution of multiple threads with a shared path. An improved instruction throughput is attained by better utilizing shared resources from exploiting the newly available thread-level parallelism in addition to the intrinsic instruction-level parallelism. Physical Register file is one of the most critical shared resources in SMT systems due to the limited number of rename registers available for renaming. Registers held by long-latency instructions of some threads will block the progress of other faster threads resulting in inefficient resource utilization and performance degradation. In this paper, we present an algorithm with which each thread is allotted a portion of rename registers (i.e. a cap) in real time according to their run-time behaviors, namely the utilization ratio of its allotted quota and the pace of its deallocation. The proposed method differs from the state-of-the-art capping techniques in allowing each thread to adjust its own individual cap value in real time. To preclude over-adjustment, a global lower limit on the cap values is further established also in real time to accommodate potentially drastic variations from different mixes of on-going threads. The proposed method shows a very significant improvement in IPC up to 53.8% in a 4-threaded system, 43.8% and 41.6% in a 6-threaded and an 8-threaded system respectively.

Detecting web attacks with end-to-end deep learning

Web applications are popular targets for cyber-attacks because they are network-accessible and often contain vulnerabilities. An intrusion detection system monitors web applications and issues alerts when an attack attempt is detected. Existing implementations of intrusion detection systems usually extract features from network packets or string characteristics of input that are manually selected as relevant to attack analysis. Manually selecting features, however, is time-consuming and requires in-depth security domain knowledge. Moreover, large amounts of labeled legitimate and attack request data are needed by supervised learning algorithms to classify normal and abnormal behaviors, which is often expensive and impractical to obtain for production web applications.This paper provides three contributions to the study of autonomic intrusion detection systems. First, we evaluate the feasibility of an unsupervised/semi-supervised approach for web attack detection based on the Robust Software Modeling Tool (RSMT), which autonomically monitors and characterizes the runtime behavior of web applications. Second, we describe how RSMT trains a stacked denoising autoencoder to encode and reconstruct the call graph for end-to-end deep learning, where a low-dimensional representation of the raw features with unlabeled request data is used to recognize anomalies by computing the reconstruction error of the request data. Third, we analyze the results of empirically testing RSMT on both synthetic datasets and production applications with intentional vulnerabilities. Our results show that the proposed approach can efficiently and accurately detect attacks, including SQL injection, cross-site scripting, and deserialization, with minimal domain knowledge and little labeled training data.

Mitigating Electrical-level Attacks towards Secure Multi-Tenant FPGAs in the Cloud

A rising trend is the use of multi-tenant FPGAs, particularly in cloud environments, where partial access to the hardware is given to multiple third parties. This leads to new types of attacks in FPGAs, which operate not only on the logic level, but also on the electrical level through the common power delivery network. Since FPGAs are configured from the software-side, attackers are enabled to launch hardware attacks from software, impacting the security of an entire system. In this article, we show the first attempt of a countermeasure against attacks on the electrical level, which is based on a bitstream checking methodology. Bitstreams are translated back into flat technology mapped netlists, which are then checked for properties that indicate potential malicious runtime behavior of FPGA logic. Our approach can provide a metric of potential risk of the FPGA bitstream being used in active fault or passive side-channel attacks against other users of the FPGA fabric or the entire SoC platform.

Android malware detection through generative adversarial networks

AbstractMobile and cell devices have empowered end users to tweak their cell phones more than ever and introduce applications just as we used to with personal computers. Android likewise portrays an uprise in mobile devices and personal digital assistants. It is an open‐source versatile platform fueling incalculable hardware units, tablets, televisions, auto amusement frameworks, digital boxes, and so forth. In a generally shorter life cycle, Android also has additionally experienced a mammoth development in application malware. In this context, a toweringly large measure of strategies has been proposed in theory for the examination and detection of these harmful applications for the Android platform. These strategies attempt to both statically reverse engineer the application and elicit meaningful information as features manually or dynamically endeavor to quantify the runtime behavior of the application to identify malevolence. The overgrowing nature of Android malware has enormously debilitated the support of protective measures, which leaves the platforms such as Android feeble for novel and mysterious malware. Machine learning is being utilized for malware diagnosis in mobile phones as a common practice and in Android distinctively. It is important to specify here that these systems, however, utilize and adapt the learning‐based techniques, yet the overhead of hand‐created features limits ease of use of such methods in reality by an end user. As a solution to this issue, we mean to make utilization of deep learning–based algorithms as the fundamental arrangement for malware examination on Android. Deep learning turns up as another way of research that has bid the scientific community in the fields of vision, speech, and natural language processing. Of late, models set up on deep convolution networks outmatched techniques utilizing handmade descriptive features at various undertakings. Likewise, our proposed technique to cater malware detection is by design a deep learning model making use of generative adversarial networks, which is responsible to detect the Android malware via famous two‐player game theory for a rock‐paper‐scissor problem. We have used three state‐of‐the‐art datasets and augmented a large‐scale dataset of opcodes extracted from the Android Package Kit bytecode and used in our experiments. Our technique achieves F1 score of 99% with a receiver operating characteristic of 99% on the bytecode dataset. This proves the usefulness of our technique and that it can generally be adopted in real life.

An empirical study to estimate the stability of random forest classifier on the hybrid features recommended by filter based feature selection technique

The emergence of advanced malware is a serious threat to information security. A prominent technique that identifies sophisticated malware should consider the runtime behaviour of the source file to detect malicious intent. Although the behaviour-based malware detection technique is a substantial improvement over the traditional signature-based detection technique, current malware employs code obfuscation techniques to elude detection. This paper presents the Hybrid Features-based malware detection system (HFMDS) that integrates static and dynamic features of the portable executable (PE) files to discern malware. The HFMDS is trained with prominent features advised by the filter-based feature selection technique (FST). The detection ability of the proposed HFMDS has evaluated with the random forest (RF) classifier by considering two different datasets that consist of real-world Windows malware samples. In-depth analysis is carried out to determine the optimal number of decision trees (DTs) required by the RF classifier to achieve consistent accuracy. Besides, four popular FSTs performance is also analyzed to determine which FST recommends the best features. From the experimental analysis, we can infer that increasing the number of DTs after 160 within the RF classifier does not make a significant difference in attaining better detection accuracy.

Efficient slicing of Catmull–Clark solids for 3D printed objects with functionally graded material

In the competition for the volumetric representation most suitable for functionally graded materials in additively manufactured (AM) objects, volumetric subdivision schemes, such as Catmull–Clark (CC) solids, are widely neglected. Although they show appealing properties, efficient implementations of some fundamental algorithms are still missing. In this paper, we present a fast algorithm for direct slicing of CC-solids generating bitmaps printable by multi-material AM machines. Our method optimizes runtime by exploiting constant time limit evaluation and other structural characteristics of CC-solids. We compare our algorithm with the state of the art in trivariate trimmed spline representations and show that our algorithm has similar runtime behavior as slicing trivariate splines, fully supporting the benefits of CC-solids.

Modeling trust and reputation systems in hostile environments

Abstract In many modern network environments, agents of the system have to select optimal service providers who in turn decide to provide different quality of services. This is while maximization of their profits is a concern for both agents and service providers. These environments may also include malicious agents who try to illegally raise up their benefits by deception of honest agents and trampling their benefits. Trust and Reputation Systems (TRSs) are used to control the malicious agents’ behavior and to help honest agents improving their decision making quality. Security analysis and robustness evaluation of TRSs in such hostile environments is an important concern and there are a few works to address this problem. However, most of the works in this regard are not based on a proper formal model. Instead, they normally do ad-hoc or intuitive evaluations on specific case studies. There are also a number of works that do model-based analysis and evaluation on TRSs using either simulation or verification methods. However, the proposed models in these works almost suffer from lack of generality, inexpressive formalism, and/or limited applicability. In this paper, we introduce the Trust and Reputation Interaction Model (TRIM) as a comprehensive and expressive model of an interacting agent environment with malicious agents along with an underlying TRS. TRIM has enough expressive power to cover a wide range of TRSs and is able to define advanced complicated attacks. We show that how the runtime behavior of TRIM can be specified as an infinite state homogeneous Markov Decision Process (MDP) tree through the proposed algorithm. To show the applicability of the model, some famous TRSs along with the number of important trust attacks are specified using the proposed formalism. Furthermore, although the focus of this paper is on modeling, we implemented the TRIM-Checker as a preliminary tool for robustness verification of TRSs against trust attacks. The specified TRSs are then experimentally evaluated and compared against potential attacks through a novel proposed robustness criterion which is based on MDP analysis.

Runtime deadlock tracking and prevention of concurrent multithreaded programs: A learning‐based approach

SummaryAllocation of shared resources by multithreaded programs faces problem of deadlock. Many solutions have been presented to resolve this problem. Among others, the deadlock prevention is stressed when the deadlock detection and removal are costly. Removing deadlocks, which is carried out by aborting/recovering deadlocked threads, causes the waste of the resources used by the deadlocked threads. In such case, deadlock prevention can lead to avoiding the waste of resources. To this end, the runtime behavior of threads should be monitored in order to predict possible future deadlocks. In such case, the prediction mechanism becomes significant because a proper prediction helps us deny the allocation request of a resource by a thread if the allocation leads to a potential deadlock. A method to attain to proper prediction is learning the behavior of threads based on runtime monitoring their past behavior. In fact, based on past behavior of threads, potential deadlocks in their future behavior are verified, and current allocation request of a resource is denied if a future deadlock is predicted. The current study is an extension of our previous work where just deadlock tracking was predicted and no adaptation was suggested. In this study, a composite structure of a recurrent Neural Network (NN) called NARX (to track a potential deadlock) and a Multi‐perceptron NN called MLP (to select a suitable action to resolve the potential deadlock) is proposed. Based on the experimental results, the accuracy of the first NN was about 80%, leading to high performance of the second NN, and more than 82% of the real deadlocks were prevented by selecting suitable actions.

State behavior analysis in validating the web service framework

Web service (WS) interactions correspond to states, and they can be modeled based on the type of interactions between the service consumer and the provider. Models like UML, OWL have been designed in the past but not all of them focus on state-based interaction among the requester and the provider. In this paper, we develop a framework that understands interactions between the requester and provider and learns behaviors using FSA. We first propose a model called the state machine representation model for analyzing the behavior of WSs and also supports for modeling the job fair service for identifying the appropriate services for the consumer. Next, we propose an implementation work which gives us the run time behavior of the Job Search Engine (JSE) in network and cloud environment. Finally, we conclude this paper by interpreting and analyzing the performance of the JSE with respect to the standard parameters such as access time for invoked state, discovered state, running state, halt state, disconnected state and show that the model framework designed and developed in this paper works for the JSE. In future the framework can be extended for other applications at the generic set of states analyzed in this paper.

MalDy: Portable, data-driven malware detection using natural language processing and machine learning techniques on behavioral analysis reports

In response to the volume and sophistication of malicious software or malware, security investigators rely on dynamic analysis for malware detection to thwart obfuscation and packing issues. Dynamic analysis is the process of executing binary samples to produce reports that summarise their runtime behaviors. The investigator uses these reports to detect malware and attribute threat types leveraging manually chosen features. However, the diversity of malware and the execution environments make manual approaches not scalable because the investigator needs to manually engineer fingerprinting features for new environments. In this paper, we propose, MalDy (mal die), a portable (plug and play) malware detection and family threat attribution framework using supervised machine learning techniques. The key idea of MalDy portability is the modeling of the behavioral reports into a sequence of words, along with advanced natural language processing (NLP) and machine learning (ML) techniques for automatic engineering of relevant security features to detect and attribute malware without the investigator intervention. More precisely, we propose to use bag-of-words (BoW) NLP model to formulate the behavioral reports. Afterward, we build ML ensembles on top of BoW features. We extensively evaluate MalDy on various datasets from different platforms (Android and Win32) and execution environments. The evaluation shows the effectiveness and the portability of MalDy across the spectrum of the analyses and settings.

HLMD: a signature-based approach to hardware-level behavioral malware detection and classification

Malicious programs, or malware, often use code obfuscation techniques to make static analysis difficult. To deal with this problem, various behavioral detection techniques have been proposed that focus on runtime behavior to distinguish between benign and malicious programs. The majority of them are based on the analysis and modeling of system call traces, which are a common type of audit data often used to describe the interaction between programs and the operating system. However, the techniques are not widely used in practice because of high performance overheads. An alternative approach is to perform behavioral detection at the hardware level. The basic idea is to use information that is accessible through hardware performance counters, which are a set of special purpose registers built into modern processors providing detailed information about hardware and software events. In this paper, we pursue this line of research by presenting HLMD, a novel approach that uses behavioral signatures generated from hardware performance counter traces to instantly detect and disable malicious programs at the beginning of their execution. HLMD is especially suitable for independent malicious programs that can be run standalone without having to be attached to a host program. Each behavioral signature is composed of some number of singular values and singular vectors, obtained by applying the singular value decomposition to the hardware performance counter traces of a known malware family. HLMD follows a two-stage heuristic matching strategy to increase the detection performance to an acceptable level while reducing the detection complexity to linear time. The results of our experiments performed on a dataset of benign and malicious programs show that HLMD can achieve an average precision, recall, and F-measure of 95.19%, 89.96%, and 92.50%, respectively.

EdSketch: execution-driven sketching for Java

Sketching is a synthesis approach that allows users to provide high-level insights into a synthesis problem and let synthesis tools complete low-level details. Users write sketches—partial programs that have “holes” and provide test assertions as the correctness criteria. The sketching techniques fill the holes with code fragments such that the complete program satisfies all test assertions. Traditional techniques translate the sketching problem to propositional satisfiability formulas and leverage SAT solvers to generate programs with the desired functionality. While effective for a range of small well-defined domains, such translation-based approaches have a key limitation when applying to real applications: They require either translating all relevant libraries that are invoked directly or indirectly by the given sketch or creating models of those libraries, which requires much manual effort. This paper introduces execution-driven sketching, a novel approach for synthesizing Java programs with on-demand candidate generation. The key novelty of our work is to leverage runtime behavior to prune a large amount of search space. EdSketch explores the actual program behaviors in the presence of libraries and sketches small parts of real-world applications, which may use complex constructs of modern languages, such as reflection, native calls and File I/O. We further leverage a set of pruning strategies based on Java syntax to expedite the synthesis process. EdSketch embodies our approach in two forms: a stateful search based on the Java PathFinder model checker; and a stateless search based on re-execution inspired by the VeriSoft model checker. Experimental results show that EdSketch can complete some sketches that contain complex constructs in the presence of libraries, recursive procedures and advanced features like reflection. Without translating to SAT, EdSketch ’s performance compares well with the SAT-based Sketch system for a range of small but complex data structure subjects.

Synthesizing tradeoff spaces with quantitative guarantees for families of software systems

Designing software in a way that guarantees run-time behavior while achieving an acceptable balance among multiple quality attributes is an open problem. Providing guarantees about the satisfaction of the same requirements under uncertain environments is even more challenging. Tools and techniques to inform engineers about poorly-understood design spaces in the presence of uncertainty are needed, so that engineers can explore the design space, especially when tradeoffs are crucial. To tackle this problem, we describe an approach that combines synthesis of spaces of system design alternatives from formal specifications of architectural styles with probabilistic formal verification. The main contribution of this paper is a formal framework for specification-driven synthesis and analysis of design spaces that provides formal guarantees about the correctness of system behaviors and satisfies quantitative properties (e.g., defined over system qualities) subject to uncertainty, which is treated as a first-class entity. We illustrate our approach in two case studies: a service-based adaptive system and a mobile robotics architecture. Our results show how the framework can provide useful insights into how average case probabilistic guarantees can differ from worst case guarantees, emphasizing the relevance of combining quantitative formal verification methods with structural synthesis, in contrast with techniques based on simulation and dynamic analysis that can only provide estimates about average case probabilistic properties.

Δ elta

The continuously increasing degree of automation in many areas (e.g. manufacturing engineering, public infrastructure) lead to the construction of cyber-physical systems and cyber-physical networks. To both, time and energy are the most critical operating resources. Considering for instance the Tactile Internet specification, end-to-end latencies in these systems must be below 1ms, which means that both communication and system latencies are in the same order of magnitude and must be predictably low. As control loops are commonly handled over different variants of network infrastructure (e.g. mobile and fibre links) particular attention must be payed to the design of reliable, yet fast and energy-efficient data-transmission channels that are robust towards unexpected transmission failures. As design goals are often conflicting (e.g. high performance vs. low energy), it is necessary to analyze and investigate trade-offs with regards to design decisions during the construction of cyber-physical networks. In this paper, we present Δelta, an approach towards a tool-supported construction process for cyber-physical networks. Δelta extends the previously presented X-L AP tool by new analysis features, but keeps the original measurements facilities unchanged. Δelta jointly analyzes and correlates the runtime behavior (i.e. performance, latency) and energy demand of individual system components. It provides an automated analysis with precise thread-local time interpolation, control-flow extraction, and examination of latency criticality. We further demonstrate the applicability of Δelta with an evaluation of a prototypical implementation.