Static Detection Method Research Articles

Enhanced fault detection in energy systems using individual contextual forgetting factors in recursive principal component analysis

Improving maintenance strategies is an important component in reducing wastes of energy in industrial systems and especially energy systems, as they represent a large proportion of our total energy use. The use of fault detection methods can help transition to proactive maintenance methods and automate the detection of faults using data from the systems themselves. However, the presence of normal operational changes must be accounted for to avoid false alarms, as static fault detection methods cannot handle them. A recursive fault detection method, specifically recursive principal component analysis (RPCA), is applied to real building data in this paper to aid in addressing this challenge. Additionally, improvements to the aspect of updating forgetting factors, which are integral to RPCA's functionality, is also proposed which allows for enhanced adaptability. The results show that the improvement increases adaptability when setpoints are changed and provides similar performance otherwise. Lastly, the application of this was shown to significantly reduce false alarms in the building application, while still detecting the known faults.

A dual graph neural networks model using sequence embedding as graph nodes for vulnerability detection

Context:Detecting critical to ensure software system security. The traditional static vulnerability detection methods are limited by staff expertise and perform poorly with today’s increasingly complex software systems. Researchers have successfully applied the techniques used in NLP to vulnerability detection as deep learning has developed. The existing deep learning-based vulnerability detection models can be divided into sequence-based and graph-based categories. Sequence-based embedding models cannot use structured information embedded in the code, and graph-based embedding models lack effective node representations. Objective:To solve these problems, we propose a deep learning-based method, DGVD (Double Graph Neural Network for Vulnerability Detection). Methods:We use the sequential neural network approach to extract local semantic features of the code as nodes embedded in the control flow graph. First, we propose a dual graph neural network module (DualGNN) that consists of GCN and GAT. The altered module utilizes two different graph neural networks to obtain the global structural information of the control flow and the relationship between the nodes and fuses the two. Second, we propose a convolution-based feature enhancement module (TC-FE) that uses different convolution kernels of different sizes to capture information at different scales so that subsequent readout layers can better aggregate node information. Results:Experiments demonstrate that DGVD outperforms existing models, obtaining 64.23% vulnerability detection accuracy on CodeXGLUE’s real benchmark dataset. Conclusion:The proposed DGVD achieves better performance than the state-of-the-art DGVD has a more effective source code feature extraction capability on real-world datasets.

Accelerometer static state detection (SSD)-assisted GNSS/accelerometer bridge monitoring algorithm

Abstract In the field of structural health monitoring (SHM), a loosely coupled (LC) Kalman filtering algorithm that accounts for baseline drift errors is commonly used to integrate GNSS data with accelerometer data. In the LC algorithm, the baseline drift errors are considered unknown parameters that need to be estimated. In scenario of continuous float solutions, the estimation of baseline drift error is often inaccurate, leading to the divergence of monitoring results. Theoretically, as a type of motion sensor, accelerometers are expected to qualitatively determine the priori state of bridges, whether dynamic or static. Utilizing the inherent characteristics of accelerometers and the principle of zero-velocity detection in integrated navigation, we originally propose a bridge static state detection (SSD) method based on low-cost accelerometer, and introduces this prior SSD information as a constraint in GNSS/accelerometer LC algorithm, called SSD-LC bridge monitoring algorithm. Through a simulation platform and real-world bridge monitored tests, the effectiveness of our proposed SSD method has been verified. Furthermore, our proposed SSD-LC bridge monitoring algorithm can effectively mitigate the divergence problem in baseline drift estimation that occurs with continuous GNSS float solutions in traditional algorithms, which can effectively avoid misjudgments and false alarms in bridge monitoring during GNSS anomalies.

A novel multi-modal incremental tensor decomposition for anomaly detection in large-scale networks

Network traffic anomaly detection is a crucial task for today's network monitoring and maintenance. However, with the rapid growth of network data volume, the data structure has become more and more complex, showing multi-modal characteristics, which makes traffic anomaly detection face a great challenge. The earlier proposed anomaly detection methods have the following deficiencies, i) Most of them are static or dynamic detection methods that only grow along the temporal modality. ii) Lower detection rate or higher computational cost. To address these deficiencies, this article proposes a traffic anomaly detection framework based on multi-modal incremental tensor decomposition, which has the following three highlights, i) Constructing traffic data as a tensor model to fully mine the correlation between data, and the proposed framework is applicable to the situation where traffic data grows dynamically along multiple modes. ii) Using the multi-modal incremental tensor decomposition method to process dynamically growing data without decomposing all the data, greatly reducing computational cost and improving data quality. iii) Using the XGBoost classification algorithm for anomaly detection to improve detection accuracy. Finally, the results of experiments on two real network traffic datasets NSL-KDD and CICDDOS 2019 show that the proposed framework can achieve a high detection rate of 99.21%, and has the characteristics of good scalability and fast detection speed.

MALWARE IMAGE PREDICTION AND CLASSIFICATION USING CONVOLUTIONAL NEURAL NETWORK

Without users' permission, malware software can infect computers or other devices. Through these loopholes, criminals commit a range of illegal and criminal offences that violate the legitimate rights and interests of the nation. Traditional malware categorization techniques fall into two categories: static analysis and dynamic analysis. It is usually not necessary to execute malware binary samples in order to perform static analysis techniques, and disassembly makes it simple to recover important data such as text lists, routines, and hash values. The static analysis methods offer a high accuracy rate and a simple operation with a low consumption time. Static analysis tools, however, are limited to analyzing malware binary samples at the surface level, where they are readily influenced by deformation and other means of confusion. Furthermore, it is challenging to identify and categorize unknown malware. Methods of dynamic analysis are not impacted by obfuscation and can operate in a virtual environment. It has the ability to recognize newly discovered malware samples and track the dynamic alterations of malware binary samples over time. Nevertheless, it's an extremely intricate and time-consuming process. Malware has become one of the largest security threats in recent years due to its rapid growth. But feature engineering makes it difficult to handle large amounts of malware and readily limits the use of standard machine learning methods for malware categorization. However, dynamic analysis methodologies are not appropriate for efficiently categorizing large amounts of malware due to their complexity and high cost. In light of this, we propose a novel static malware detection method based on the convolutional neural network (CNN) employed in this work. Unlike existing methods, we use the data enhancement method to fix the unbalanced datasets, turn every viral byte into a colour image, and provide a better design.

Enhancement Network Security Features Through Intrusion Detection Systems

Abstract: In pursuit of its objectives, the project "Enhancement Network Security features through Intrusion Detection Systems" undertakes a comprehensive exploration of the intricacies surrounding network security, delving into the nuances of intrusion detection methodologies. By dissecting the mechanisms behind both anomaly- and signature-based IDS, the initiative aims not only to implement these systems but also to grasp their underlying principles deeply. Through rigorous experimentation and analysis, the project endeavours to uncover the strengths and limitations of each approach, thereby paving the way for the development of a hybrid system that leverages the best of both worlds. This meticulous approach ensures that the resulting IDS is not only robust but also finely tuned to adapt to the ever-evolving landscape of cyber threats. Furthermore, the integration of machine learning techniques represents a pivotal advancement in the realm of intrusion detection. By harnessing the power of algorithms capable of autonomously learning from data, the IDS transcends static rule-based detection methods, ushering in a new era of adaptive security measures. Through continuous training on vast datasets comprising diverse threat scenarios, the machine learning-enabled IDS hones its ability to discern subtle patterns indicative of malicious activity, thus bolstering its efficacy in safeguarding network assets. Moreover, the implementation of machine learning algorithms fosters a proactive stance against emerging threats, enabling the system to anticipate and mitigate potential breaches before they materialize into fullfledged attacks. This proactive approach not only enhances the overall security posture of organizations but also instils confidence in their ability to stay ahead of the curve in an increasingly hostile digital landscape. The project's goal is to provide companies with a stronger protection against cyberattacks by guaranteeing the availability, confidentiality, and integrity of their networked systems.

TridentShell: An enhanced covert and scalable backdoor injection attack on web applications

Web backdoor attack is an increasingly prevalent network attack that can result in substantial losses for webmasters. During a cyber-attack, system vulnerabilities and web application flaws are usually used to implant a web shell inside victim servers. To mitigate these threats posed by web shells, research has focused on static feature detection, which has been evolved rapidly in recent years. However, static feature detection has inherent limitations and security risks. In this paper, we present TridentShell, a novel web backdoor attack that can inject an invisible backdoor into a victim server without leaving any traces of the attack. Furthermore, TridentShell can circumvent almost all static detection methods. Unlike existing approaches, which leverage traditional encryption and obfuscation technologies to avoid detection, our proposed attack is intended to blend into the web application server naturally. In this work, we introduce enhancements to the original TridentShell, which is not traceable – in theory – since it uses a blockchain-based decentralized C&C server with better presentation capability. The experimental results show that our TridentShell can effectively compromise five different types of Java application servers (covering around 87% Java application servers in the market), and can scrub any attack traces from the server, making it especially difficult to detect.

A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation

Static analysis is popular for detecting SQL injection vulnerabilities. However, due to the lack of accurate modeling of object-oriented database extensions, current methods fail to accurately detect SQL injection vulnerabilities in applications that use object-oriented database extensions. We propose a program transformation-based SQL injection vulnerability detection method to address this issue. This method consists of two stages: program transformation and vulnerability detection. In the first stage, object-oriented database extensions are automatically transformed into semantically equivalent procedural database extensions through the identification of key statements, call relation verification, and program transformation. In the second stage, application programs are automatically scanned using a combination of control flow graph construction and taint analysis techniques to detect SQL injection vulnerabilities. Based on the proposed method, we have implemented the OODBE-SCAN prototype system and performed experimental analysis on eight modern PHP applications. We compare OODBE-SCAN with two related static analysis tools, RIPS and Seay. The results show that OODBE-SCAN can detect more real-world vulnerabilities and has higher accuracy than existing methods.

A vulnerability detection algorithm based on residual graph attention networks for source code imbalance (RGAN)

It is essential to detect potential vulnerabilities in software to ensure its safety. As software systems become more complex, traditional static vulnerability detection methods perform poorly. Currently, deep learning-based vulnerability detection models only extract source code vulnerability features using sequences or graphs. Sequential neural networks ignore structural information in the code, such as control flow diagrams and data flow diagrams. Additionally, graph neural networks cannot accurately extract features due to the lack of effective methods for extracting nodes’ features and aggregating global information. To address the above issue, we propose a vulnerability detection algorithm based on residual graph attention networks for source code imbalance (RGAN). Firstly, a local feature extraction module (PE-BL-A module) is designed. Using the sequence neural network, the module extracts various useful features, including node features in a control flow diagram based on local semantic features. Secondly, we present the Residual Graph Attention Network module (RGAT). To learn and update node features along the control flow direction, the module uses a graph attention network with residual connections. In this module, a mean biaffine attention pooling mechanism is proposed that can extract total graph vulnerability features more effectively. Thirdly, a dynamic cross-entropy loss function is designed. Using this function, it can handle sample imbalances during training. Finally, experiments conducted on several benchmark datasets demonstrate that the proposed model achieves state-of-the-art results.

Static vulnerability detection based on class separation

Software vulnerability detection is a key step to prevent the system from being attacked. However, tens of thousands of codes have brought great challenges to engineers, so we urgently need an automatic and intelligent vulnerability detection method. The existing vulnerability detection model based on deep learning has the problem that it is difficult to separate the features of vulnerable and neutral code. Based on the code data drive, this paper proposes a static vulnerability detection method SDV(Statically Detecting Vulnerability) for C∖C++ programs. SDV is a function-level vulnerability code detection method. This paper uses a code property graph to represent the code and decouples the feature extractor and the classifier. In the graph feature extraction stage, we use Jump Graph Attention Network layers and convolutional pooling layers. Their combination can not only prevent the over-smoothing problem but also separate the sample classes deeply. Finally, on the chrdeb dataset, SDV outperforms state-of-the-art function-level vulnerability detection methods by 52.3%, 15.9%, and 39.6% in Precision, Recall, and F1-Score, respectively. On the real project sard, the number of vulnerabilities detected by SDV is 10.7 times more than Reveal.

Double-Layer Detection Model of Malicious PDF Documents Based on Entropy Method with Multiple Features.

Traditional PDF document detection technology usually builds a rule or feature library for specific vulnerabilities and therefore is only fit for single detection targets and lacks anti-detection ability. To address these shortcomings, we build a double-layer detection model for malicious PDF documents based on an entropy method with multiple features. First, we address the single detection target problem with the fusion of 222 multiple features, including 130 basic features (such as objects, structure, content stream, metadata, etc.) and 82 dangerous features (such as suspicious and encoding function, etc.), which can effectively resist obfuscation and encryption. Second, we generate the best set of features (a total of 153) by creatively applying an entropy method based on RReliefF and MIC (EMBORAM) to PDF samples with 37 typical document vulnerabilities, which can effectively resist anti-detection methods, such as filling data and imitation attacks. Finally, we build a double-layer processing framework to detect samples efficiently through the AdaBoost-optimized random forest algorithm and the robustness-optimized support vector machine algorithm. Compared to the traditional static detection method, this model performs better for various evaluation criteria. The average time of document detection is 1.3 ms, while the accuracy rate reaches 95.9%.

Detection of Vulnerabilities of Blockchain Smart Contracts

With the wide application of IoT and blockchain, research on smart contracts has received increased attention, and security threat detection for smart contracts is one of the main focuses. This paper first introduces the common security vulnerabilities in blockchain smart contracts, and then classifies the vulnerabilities detection tools for smart contracts into six categories according to the different detection methods: formal verification method, symbol execution method, fuzzy testing method, intermediate representation method, stain analysis method and deep learning method. We test 27 detection tools, and analyze them from several perspectives, including the capability of detecting a smart contract version. Finally, it is concluded that most of the current vulnerability detection tools can only detect vulnerabilities in a single and old version of smart contracts. Although the deep learning method detects fewer types of smart contract vulnerabilities, it has higher detection accuracy and efficiency. Therefore, the combination of static detection methods such as deep learning method and dynamic detection methods including the fuzzy testing method to detect more types of vulnerabilities in multi-version smart contracts to achieve higher accuracy is a direction worthy of research in the future.

An Android Malware Detection Method Using Multi-Feature and MobileNet

Most of the existing static analysis-based detection methods adopt one or few types of typical static features for avoiding the problem of dimensionality and computational resource consumption. In order to further improve detecting accuracy with reasonable resource consumption, in this paper, a new Android malware detection model based on multiple features with feature selection method and feature vectorization method are proposed. Feature selection method for each type of features reduces the dimensionality of feature set. Weight-based feature vectorization method for API calls, intent and permission is designed to construct feature vector. Co-occurrence matrix-based vectorization method is proposed to vectorize opcode sequence. To demonstrate the effectiveness of our method, we conducted comprehensive experiments with a total of 30,000 samples. Experimental results show that our method outperforms state-of-the-art methods.

Image-Based Malware Classification Method with the AlexNet Convolutional Neural Network Model

In recent years, malware has experienced explosive growth and has become one of the most severe security threats. However, feature engineering easily restricts the traditional machine learning methods-based malware classification and is hard to deal with massive malware. At the same time, the dynamic analysis methods have the problems of complex operation and high cost, which are not suitable for efficiently classifying large quantities of malware. Therefore, we propose a novel static malware detection method based on this study’s AlexNet convolutional neural network (CNN). Unlike existing solutions, we convert all malware bytes into color images, propose an improved AlexNet architecture, and solve the unbalanced datasets with the data enhancement method. Extensive experiments are performed using the Microsoft malware dataset and the Google Code Jam (GCJ) dataset. The experimental results show that the accuracy of the Microsoft malware dataset reaches 99.99%, and the GCJ dataset reaches 99.38%. We also verify that our method can better extract the texture features of malware and improve the accuracy and detection efficiency.

CSGVD: A deep learning approach combining sequence and graph embedding for source code vulnerability detection

In order to secure software, it is critical to detect potential vulnerabilities. The performance of traditional static vulnerability detection methods is limited by predefined rules, which rely heavily on the expertise of developers. Existing deep learning-based vulnerability detection models usually use only a single sequence or graph embedding approach to extract vulnerability features. Sequence embedding-based models ignore the structured information inherent in the code, and graph embedding-based models lack effective node and graph embedding methods. As a result, we propose a novel deep learning-based approach, CSGVD (Combining Sequence and Graph embedding for Vulnerability Detection), which considers function-level vulnerability detection as a graph binary classification task. Firstly, we propose a PE-BL module, which inherits and enhances the knowledge from the pre-trained language model. It extracts the code’s local semantic features as node embedding in the control flow graph by using sequence embedding. Secondly, CSGVD uses graph neural networks to extract the structured information of the graph. Finally, we propose a mean biaffine attention pooling, M-BFA, to better aggregate node information as a graph’s feature representation. The experimental results show that CSGVD outperforms the existing state-of-the-art models and obtains 64.46% accuracy on the real-world benchmark dataset from CodeXGLUE for vulnerability detection.

Imaging and detection method for static interferometric high-temperature temperature field

Imaging and detection method for static interferometric high-temperature temperature field

Mechanical Detection of Magnetic Phase Transition in Suspended CrOCl Heterostructures

With their outstanding mechanical and magnetic characteristics, two-dimensional magnetic materials have attracted wide attentions in the field of nanoelectromechanics and spintronics. By tuning the mechanical resonance with external knobs, such as strain, electric and magnetic control, nanoelectromechanical sensors with novel functionalities have been successfully demonstrated. Here, we investigate the mechanical properties of the suspended membranes with few-layered antiferromagnetic material CrOCl. The results show that the Young’s modulus of CrOCl resonators is ~137.29 GPa by using a static detection method. Below the transition temperature TN, the mechanical resonance is found to strongly depend on the magnetic fields with an enormous blueshift of ~3.1% in the magnetic-field-induced phase transition. In addition, we also found that the variation of strain of system ∆ϵ was about 1.5 × 10−3 during the transition. Our study shows the great potential of two-dimensional magnetic materials in future nanoelectronic applications.

AI-enhanced Defense Against Ransomware Within the Organization’s Architecture

Ransomware is a type of revenue-generating tactic that cybercriminals utilize to improve their income. Businesses have spent billions of dollars recovering control of their resources, which may include confidential data, operational applications and models, financial transactions, and other information, as a result of malicious software. Ransomware can infiltrate a resource or device and restrict the owner from accessing or utilizing it. There are various obstacles that a business must overcome in order to avoid ransomware attacks. Traditional ransomware detection systems employ a static detection method in which a finite dataset is provided into the system and a logical check is performed to prevent ransomware attacks against the system. This was effective in the early stages of the internet, but the scenario of recent times is far more advanced, and as more and more cyber world contrivances have been analyzed, multiple gaps have been identified, to the benefit of ransomware attackers, who use these gaps to generate astronomically large sums of money. As a result, the suggested methodology aims to efficiently detect diverse patterns associated with various file formats by starting with their sources, data collecting, probabilistic identification of target devices, and deep learning classifier with intelligent detection. An organization can use the recommended approach to safeguard its data and prepare for future ransomware attacks by using it as a roadmap to lead them through their security efforts.

Research on construction method and validity mechanism of robust analysis model in snow peach quality detection based on visible-near infrared spectroscopy.

Visible-near infrared (Vis-NIR) spectra analysis method is widely used in the quality grading of bulk fruits with its rapid, non-destructive, diverse detection modes and flexible modular integration scheme. However, during the online grading of fruits, the random mechanized way of dropping fruit onto the conveyor belt method and the open detection environment led to more spectral abnormal samples, which affect the accuracy of the detection. In this paper, the soluble solids content (SSC) of snow peach is quantitatively analyzed by static and online detection methods. Several spectral preprocessing methods including Norris-Williams Smoothing (NWS), Savitzky-Golay Smoothing (SGS), Continuous Wavelet Derivative (CWD), Multivariate Scattering Correction (MSC), and Variable Sorting for Normalization (VSN) are adopted to eliminate spectral rotation and translation errors and improve the signal-to-noise ratio. Monte Carlo Uninformative Variable Elimination (MCUVE) method is used for the selection of optimal characteristic modeling variables. Partial Least Squares Regression (PLSR) is used to model and analyze the preprocessed spectra and the spectral variables optimized by MCUVE, and the effectiveness of the method is evaluated. Sparse Partial Least Squares Regression (SPLSR) and Sparse Partial Robust M Regression (SPRMR) are used for the construction of robust models. The results showed that the SGS preprocessing method can effectively improve the analysis accuracy of static and online models. The MCUVE method can realize the extraction of stable characteristic variables. The SPRMR model based on SGS preprocessing method and the effective variables has the optimal analysis results. The analysis accuracy of snow peach static model is slightly better than that of online analytical model. Through the test results of the PLSR, SPLSR and SPRMR models by the artificially adding noise test method, it can be seen that the SPRMR method eliminates the influence of abnormal samples on the model during the modeling process, which can effectively improve the anti-noise ability and detection reliability.

Distinguishing Multispin Interactions from Lower-Order Effects

Multispin interactions can be engineered with artificial quantum spins. However, it is challenging to verify such interactions experimentally. Here, we describe two methods to characterize the $n$-local coupling of $n$ spins. First, we analyze the variation of the transition energy of the static system as a function of local spin fields. Standard measurement techniques are employed to distinguish $n$-local interactions between up to five spins from lower-order contributions in the presence of noise and spurious fields and couplings. Second, we show a detection technique that relies on time-dependent driving of the coupling term. Generalizations to larger system sizes are analyzed for both static and dynamic detection methods and we find that the dynamic method is asymptotically optimal when increasing the system size. The proposed methods enable robust exploration of multispin interactions across a broad range of both coupling strengths and qubit modalities.