Source Files Research Articles

Session-Based Webshell Detection Using Machine Learning in Web Logs

Attackers upload webshell into a web server to achieve the purpose of stealing data, launching a DDoS attack, modifying files with malicious intentions, etc. Once these objects are accomplished, it will bring huge losses to website managers. With the gradual development of encryption and confusion technology, the most common detection approach using taint analysis and feature matching might become less useful. Instead of applying source file codes, POST contents, or all received traffic, this paper demonstrated an intelligent and efficient framework that employs precise sessions derived from the web logs to detect webshell communication. Features were extracted from the raw sequence data in web logs while a statistical method based on time interval was proposed to identify sessions specifically. Besides, the paper leveraged long short-term memory and hidden Markov model to constitute the framework, respectively. Finally, the framework was evaluated with real data. The experiment shows that the LSTM-based model can achieve a higher accuracy rate of 95.97% with a recall rate of 96.15%, which has a much better performance than the HMM-based model. Moreover, the experiment demonstrated the high efficiency of the proposed approach in terms of the quick detection without source code, especially when it only considers detecting for a period of time, as it takes 98.5% less time than the cited related approach to get the result. As long as the webshell behavior is detected, we can pinpoint the anomaly session and utilize the statistical method to find the webshell file accurately.

Detection of clone scammers in Android markets using IoT‐based edge computing

AbstractPirated application developers find an alternate way to publish pirated versions of the same Android mobile applications (apps) on different Android markets. Therefore, a centralized, automated scrutiny system among multiple app stores is inevitable to prevent publishing pirated or cloned version of these Android applications. In this paper, we proposed an Android clone detection system for Internet of things (IoT) (Droid‐IoT) devices. First, the proposed system receives an original Android application package (APK) file along with possible candidate cloned APKs over the cloud network. The system uses an apkExtractor tool to extract Dalvik Executable (DEX) files for each subject program. The Jdex decompiler is used to extract Java source files from DEXs. Then, the bag‐of‐word model is used to extract tokenized features from source files. Further, the weighting filters are used to zoom the importance of each token. Moreover, Synthetic Minority Oversampling is applied to retrieve balanced features for better training of data. Finally, TensorFlow with Keras deep learning model is designed to predict clones in Android applications. The experimental results have shown that Droid‐IoT can successfully detect cloned apps with an accuracy of up to 96%. The primary purpose of this system is to prevent the publishing of pirated apps among different app stores under different pirated names.

Effective Compatibility and Reduction of Data for Bigdata Applications

The system identifies a duplicate record from the database using the machine learning method. We must pass unstructured data. Data are prepared using any natural language processing technique such as text similarity. This prepared data is then fed into the latest machine learning method called Random Forest. After this data collection, using these files, the target file is compared to the source file. We make input and output files. This is carried out until accurate efficiency is generated.

Sensitivity of Importance Metrics for Critical Digital Services Graph to Service Operators’ Self-Assessment Errors

Interdependency of critical digital services can be modeled in the form of a graph with exactly known structure but with edge weights subject to estimation errors. We use standard and custom centrality indexes to measure each service vulnerability. Vulnerability of all nodes in the graph gets aggregated in a number of ways into a single network vulnerability index for services whose operation is critical for the state. This study compares sensitivity of various centralities combined with various aggregation methods to errors in edge weights reported by service operators. We find that many of those combinations are quite robust and can be used interchangeably to reflect various perceptions of network vulnerability. We use graphs of source files’ dependencies for a number of open-source projects, as a good analogy for real critical services graph, which will remain confidential.

Bathymetry and Geomorphology of Shelikof Strait and the Western Gulf of Alaska

We defined the bathymetry of Shelikof Strait and the western Gulf of Alaska (WGOA) from the edges of the land masses down to about 7000 m deep in the Aleutian Trench. This map was produced by combining soundings from historical National Ocean Service (NOS) smooth sheets (2.7 million soundings); shallow multibeam and LIDAR (light detection and ranging) data sets from the NOS and others (subsampled to 2.6 million soundings); and deep multibeam (subsampled to 3.3 million soundings), single-beam, and underway files from fisheries research cruises (9.1 million soundings). These legacy smooth sheet data, some over a century old, were the best descriptor of much of the shallower and inshore areas, but they are superseded by the newer multibeam and LIDAR, where available. Much of the offshore area is only mapped by non-hydrographic single-beam and underway files. We combined these disparate data sets by proofing them against their source files, where possible, in an attempt to preserve seafloor features for research purposes. We also attempted to minimize bathymetric data errors so that they would not create artificial seafloor features that might impact such analyses. The main result of the bathymetry compilation is that we observe abundant features related to glaciation of the shelf of Alaska during the Last Glacial Maximum including abundant end moraines, some medial moraines, glacial lineations, eskers, iceberg ploughmarks, and two types of pockmarks. We developed an integrated onshore–offshore geomorphic map of the region that includes glacial flow directions, moraines, and iceberg ploughmarks to better define the form and flow of former ice masses.

Stepping stones: Virtual restoration and 3D visualisation of the tessellated 4th century Byzantine synagogue floor at Apamea on Orontes, Syria

This article examines the Digital Apamea Project. Photogrammetry, visual restoration and colourisation are employed to reconstruct the ancient 4th Century synagogue mosaic floor at Apamea, Syria. These practices were applied to a photographic dataset. The source file was rendered in Unity 3D and an App of the reconstructed floor generated. Oculus Go was used to simulate the phenomenon of standing and moving across the floor.This article is restricted to the synagogue's inception circa 391 CE to its demise in early 5th Century and the synagogue's eventual discovery in 1934.Brief discussion of the Digital Apamea Project is provided and historical overview. Inherent problems circumscribe study of the synagogue. A new frame of reference is offered. A theoretical discussion regarding material culture and placement of the mosaics follows. This grounds the methodology to shift attention from the vertical to horizontal axis in the attempt of approximating the historical experience.

VERBAL MODEL OF MANAGEMENT OF A VULNERABLE PROCESS OF DEDICATING THE ACCESS OF USERS TO THE SOFTWARE OF THE ELECTRONIC DOCUMENT SYSTEM

Objectives Traditional methods for solving the problem of protecting the information resource of electronic document management systems based on protective basic functions (identification, authentication and verification of users, etc.) of available tools and information security subsystems have a significant drawback - inefficiency when an attacker masters the password of regular users. In order to eliminate it, it is necessary to develop new methods related to managing the weakly vulnerable process of delimiting user access not only to confidential information, but also to the software of the electronic document management system.Method One way to solve this problem is to use the modified “soft administration” method, which consists in automatically generating lists of allowed source files in the authorization matrix by reducing the lists and comparing file integrity functions with a reference list for an existing software package. This allows you to automate the process of developing access control rules and provide management of the weakly vulnerable process of access control to software tools of the electronic document management system.Result A verbal model is developed for automated control of a weakly vulnerable process of differentiating access to software tools of an electronic document management system, and a system of performance indicators for the functioning of a promising subsystem for protecting confidential information characterizing it as a control object is proposed.Conclusion The presented verbal model provides for the possibility of distributed control, in which the security administrator directly controls the specified process using a remote software tool. The formation (change) of the authority establishment matrix for managing a weakly vulnerable process of access control using a promising subsystem for protecting confidential information and the development of a system of indicators to comprehensively evaluate the effectiveness of its functioning is one of the most important tasks of protecting information from unauthorized access, guaranteeing the implementation of a security policy throughout the entire operation period secure electronic document management system.

Principles of open source bioinstrumentation applied to the poseidon syringe pump system

The poseidon syringe pump and microscope system is an open source alternative to commercial systems. It costs less than $400 and can be assembled in under an hour using the instructions and source files available at https://pachterlab.github.io/poseidon. We describe the poseidon system and use it to illustrate design principles that can facilitate the adoption and development of open source bioinstruments. The principles are functionality, robustness, safety, simplicity, modularity, benchmarking, and documentation.

A born-digital field-to-database solution for collections-based research using collNotes and collBook.

PremiseThe digitization of natural history collections includes transcribing specimen label data into standardized formats. Born‐digital specimen data initially gathered in digital formats do not need to be transcribed, enabling their efficient integration into digitized collections. Modernizing field collection methods for born‐digital workflows requires the development of new tools and processes.Methods and ResultscollNotes, a mobile application, was developed for Android and iOS to supplement traditional field journals. Designed for efficiency in the field, collNotes avoids redundant data entries and does not require cellular service. collBook, a companion desktop application, refines field notes into database‐ready formats and produces specimen labels.ConclusionscollNotes and collBook can be used in combination as a field‐to‐database solution for gathering born‐digital voucher specimen data for plants and fungi. Both programs are open source and use common file types simplifying either program's integration into existing workflows.

Entropy Based Estimation Algorithm using Break-up Images to Decrease Loss Compression Ratio

Raring the source files after divide them into some numbers which may increase loss ratio. Acquired loss ratio which may be improved by raring the individual part of the source with the help of various algorithm because each algorithm which may provides various raring ratio on involution values. In this paper, identical compression results and evaluate involution values of divide source which may obtained, and an evaluate algorithm which may got based on the following results is specified. Our algorithms divide the source into 18 parts, which may raring the individual parts with various algorithm and merge the sources after raring is to be done. Raring output which show case that the acquiring our evaluated algorithm which may use the larger raring ratio over all the source raring techniques with the ratio of 10 % on a average and 30% on larger.

Research On Enterprise Public and Private Cloud Service

In this paper, a generic comparison between the Enterprise Public and Private Cloud is analyzed based on its features and service provided. Cloud computing technology is widely adopted in today's industry where large database applications are deployed. Every organization moving towards cloud will have to consider many factors such as security, portability, database size, platform independence, multi-tenancy, customer requirements and other related resources. The detailed study focuses on essential cloud characteristics, service models, and cloud operation models such as Integrated (Hybrid), Public, Internal (Private) and Community clouds. The outcome is an effective assessment of leading two Enterprise cloud technology service providers – ownCloud© and HP Public Cloud® and its implications on the organizations which used them for cloud based applications. ownCloud© is the preferred open source file system for organizations to access for solutions across the world. HP Cloud offered by Hewlett-Packard (HP) provides public, private, hybrid and community cloud based services for various enterprise and other large-scale business organizations. Both the Private Cloud and Public Cloud can be enhanced to protect the data from intrusion with various security features where multiple users share the same cloud for storing and retrieving data

An efficient algorithm for type-safe structural diffing

Effectively computing the difference between two version of a source file has become an indispensable part of software development. The de facto standard tool used by most version control systems is the UNIX diff utility, that compares two files on a line-by-line basis without any regard for the structure of the data stored in these files. This paper presents an alternative datatype generic algorithm for computing the difference between two values of any algebraic datatype. This algorithm maximizes sharing between the source and target trees, while still running in linear time. Finally, this paper demonstrates that by instantiating this algorithm to the Lua abstract syntax tree and mining the commit history of repositories found on GitHub, the resulting patches can often be merged automatically, even when existing technology has failed.

An empirical study to estimate the stability of random forest classifier on the hybrid features recommended by filter based feature selection technique

The emergence of advanced malware is a serious threat to information security. A prominent technique that identifies sophisticated malware should consider the runtime behaviour of the source file to detect malicious intent. Although the behaviour-based malware detection technique is a substantial improvement over the traditional signature-based detection technique, current malware employs code obfuscation techniques to elude detection. This paper presents the Hybrid Features-based malware detection system (HFMDS) that integrates static and dynamic features of the portable executable (PE) files to discern malware. The HFMDS is trained with prominent features advised by the filter-based feature selection technique (FST). The detection ability of the proposed HFMDS has evaluated with the random forest (RF) classifier by considering two different datasets that consist of real-world Windows malware samples. In-depth analysis is carried out to determine the optimal number of decision trees (DTs) required by the RF classifier to achieve consistent accuracy. Besides, four popular FSTs performance is also analyzed to determine which FST recommends the best features. From the experimental analysis, we can infer that increasing the number of DTs after 160 within the RF classifier does not make a significant difference in attaining better detection accuracy.

FbHash: A New Similarity Hashing Scheme for Digital Forensics

With the rapid growth of the World Wide Web and Internet of Things, a huge amount of digital data is being produced every day. Digital forensics investigators face an uphill task when they have to manually screen through and examine tons of such data during a crime investigation. To expedite this process, several automated techniques have been proposed and are being used in practice. Among which tools based on Approximate Matching algorithms have gained prominence, e.g., ssdeep, sdhash, mvHash etc. These tools produce hash signatures for all the files to be examined, compute a similarity score and then compare it with a known reference set to filter out known good as well as bad files. In this way, exact as well as similar matches can be screened out. However, all of these schemes have been shown to be prone to active adversary attack, whereby an attacker, by making feasible changes in the content of the file, intelligently modifies the final hash signature produced to evade detection. Thus, an alternate hashing scheme is required which can resist this attack. In this work, we propose a new Approximate Matching scheme termed as - FbHash. We show that our scheme is secure against active attacks and detects similarity with 98% accuracy. We also provide a detailed comparative analysis with other existing schemes and show that our scheme has a 28% higher accuracy rate than other schemes for uncompressed file format (e.g., text files) and 50% higher accuracy rate for compressed file format (e.g., docx etc.). Our proposed scheme is able to correlate a fragment as small as 1% to the source file with 100% detection rate and able to detect commonality as small as 1% between two documents with appropriate similarity score. Further, our scheme also produces the least false negatives in comparison to other schemes.

Transfer Convolutional Neural Network for Cross-Project Defect Prediction

Cross-project defect prediction (CPDP) is a practical solution that allows software defect prediction (SDP) to be used earlier in the software lifecycle. With the CPDP technique, the software defect predictor trained by labeled data of mature projects can be applied for the prediction task of a new project. Most previous CPDP approaches ignored the semantic information in the source code, and existing semantic-feature-based SDP methods do not take into account the data distribution divergence between projects. These limitations may weaken defect prediction performance. To solve these problems, we propose a novel approach, the transfer convolutional neural network (TCNN), to mine the transferable semantic (deep-learning (DL)-generated) features for CPDP tasks. Specifically, our approach first parses the source file into integer vectors as the network inputs. Next, to obtain the TCNN model, a matching layer is added into convolutional neural network where the hidden representations of the source and target project-specific data are embedded into a reproducing kernel Hilbert space for distribution matching. By simultaneously minimizing classification error and distribution divergence between projects, the constructed TCNN could extract the transferable DL-generated features. Finally, without losing the information contained in handcrafted features, we combine them with transferable DL-generated features to form the joint features for CPDP performing. Experiments based on 10 benchmark projects (with 90 pairs of CPDP tasks) showed that the proposed TCNN method is superior to the reference methods.

Influence of the three-dimensional printing technique and printing layer thickness on model accuracy.

The accuracies of three-dimensional (3D) printed dental models using various digital light processing (DLP) and stereolithography (SLA) printers at different thicknesses were compared. Based on digital dental models (originally digitized using R700; 3Shape, Copenhagen, Denmark), physical dental models were printed using three types of DLP printers:(1) EvoDent (UnionTec, Shanghai, China) with layer thicknesses of 50 μm and 100 μm; (2) EncaDent (Encashape, WuXi, China) with layer thicknesses of 20, 30, 50 and 100 μm; (3) Vida HD (Envisioned, Dearborn, MI, USA) with layer thicknesses of 50 and 100 μm. Models with the SLA printer Form2 (Formlabs, Somerville, MA, USA) were printed with layer thicknesses of 25, 50 and 100 μm. All 22 printed models were converted to digital dental models using aD2000 model scanner (3Shape, Copenhagen, Denmark) and compared three-dimensionally to the source files using Geomagic Qualify 12.0 (3D Systems, Rock Hill, SC, USA). The printing accuracy of all printers was higher at 50 μm. When the layer thickness was set at 100 μm, the printing speed and printing accuracy of DLP printer were both superior to those of the SLA printer. In all groups, the EvoDent 50 μm group had the highest consistency with the source files (mean absolute deviation of 0.0233 mm in the maxilla and 0.0301 mm in the mandible). While the accuracy of Form 2 100 μm group was the lowest (mean absolute deviation of 0.0511 mm in the maxilla and 0.0570 mm in the mandible). For the 3D printers studied, 50 μm was the optimum layer thickness for DLP technology, and the printing accuracy using SLA technology increased with decreasing layer thickness. The DLP technology also had higher printing accuracy at alayer thickness of 100 μm. EvoDent 50 μm had the highest and Form 2 100 μm the lowest printing accuracy.

GenASiSBasics: Object-oriented utilitarian functionality for large-scale physics simulations (Version 3)

GenASiS Basics provides Fortran 2003 classes furnishing extensible object-oriented utilitarian functionality for large-scale physics simulations on distributed memory supercomputers. This functionality includes physical units and constants; display to the screen or standard output device; message passing; I/O to disk; and runtime parameter management and usage statistics. This revision---Version 3 of Basics---includes a significant name change, some minor additions to functionality, and a major addition to functionality: infrastructure facilitating the offloading of computational kernels to devices such as GPUs.

DFMSPH19: A C-code for the double folding interaction potential of two spherical nuclei

DFMSPH19: A C-code for the double folding interaction potential of two spherical nuclei

FESTR: Finite-Element Spectral Transfer of Radiation spectroscopic modeling and analysis code (New Version Announcement)

We report on the release of a new version of the FESTR (P. Hakel, Comput. Phys. Commun. 207 (2016) 415–425., https://github.com/LANLhakel/FESTR) spectral postprocessor of hydrodynamic simulations of hot, dense plasmas. Based on given time histories of one-, two-, and three-dimensional spatial distributions of materials, and their local temperature and density conditions, spectroscopically-resolved signals are computed. The effects of radiation emission and absorption by the plasma on the emergent spectra are simultaneously taken into account. This program can also be used independently of hydrodynamic calculations to analyze available experimental data with the goal of inferring plasma conditions. NEW VERSION PROGRAM SUMMARYProgram Title: FESTRProgram Files doi:http://dx.doi.org/10.17632/npvtbd7kfg.2Licensing provisions: BSD 3-clause licenseProgramming language: C++Journal reference of previous version: P. Hakel, Comput. Phys. Commun. 207 (2016) 415–425.Does the new version supersede the previous version?: YesReasons for the new version: Parallelization, bug fixes, new features and copyrightSummary of revisions: The copyright notice was changed to reflect the transition of the Los Alamos National Laboratory M&O contract from Los Alamos National Security, LLC, to Triad National Security, LLC. The code was parallelized across time steps using MPI and selected loops were parallelized with OpenMP threading; the makefile now takes additional command-line arguments to invoke these capabilities. The makefile was generalized to use wildcard functionality and placed into the new directory named “common” along with MPI and unit-test relevant source files. Object files are now assembled into library (“*.a”) archive files before linking with the object file containing the “main” function (this change should facilitate the reuse of FESTR functions in other possible future projects.) New “tracking” members were added to classes Detector and Ray to mark whether partial spectral results (along the specified Rays) should also be output (the default is “no” i.e., “false”); relevant unit tests were added or modified accordingly. Several bugs were found and corrected. Additional details and the full history of the development of this program can be found in the “README.md” and “about.txt” files located in the top directory of this package.Nature of problem: Calculation of spectral signals by postprocessing hydrodynamics simulations. Analysis of experimental spectroscopic data to infer plasma temperature and density conditions, and its chemical composition. Simultaneous treatment of spatial non-uniformity (on 3D unstructured meshes) along with spectroscopic-quality radiation transport.Solution method: Rays are cast across a 3D unstructured mesh that characterizes local temperature, density, and chemical composition of the material. Analytic solution to the 1D (along the ray) steady-state, local radiation transport equation is repeatedly used to gradually build a synthetic spectrum for each ray.Restrictions: Steady-state approximation of the radiation transport equation is used. Scattering as a radiation source is not included. Given plasma conditions are considered fixed; potential feedback of computed radiation back into plasma temperature and equation-of-state is neglected. Doppler shifts are not modeled at this time. The quality of the computed results critically depends on the accuracy of external atomic databases used as input by FESTR. Polygon objects are assumed to be convex at present.

A Commit Messages-Based Bug Localization for Android Applications

Recently, there has been consistent growth in Android applications (apps). Under these circumstances, software maintenance for Android apps becomes an essential and important task. The core of software maintenance is to locate bugs in source files. Previous bug localization approaches mainly focus on open-source desktop software (e.g. Eclipse, Mozilla, GCC). Even though a few studies locate the bugs in the Android apps, they are dedicated to a special app named ZXing, without developing a general method to locate the bugs in Android apps by taking into account the unique characteristics of Android apps’ bug reports. Such characteristics include fewer number of historical bug reports, insufficient detailed description, etc. These characteristics hinder existing localization approaches from being directly delivered to Android apps, because lack of enough information degrades the performance of those localization approaches relying on historical bug reports. Commit messages include more informative data which can provide the details of reported bugs. Therefore, in this paper, we propose a novel information retrieval-based approach which utilizes commit messages to locate new bugs in Android apps. This approach not only considers the structured textual similarity between the given bug and the candidate source files, but also computes the unstructured textual similarities between the new bug and the commit messages linked to the corresponding source files. According to the experimental results on 10 popular open-source Android apps managed by GitHub, our approach outperforms the state-of-the-art bug localization methods that include BugLocator, BLUiR, and two-phase model.