Virtual Security Research Articles

VDefender: An explainable and introspection-based approach for identifying emerging malware behaviour at hypervisor-layer in virtualization environment

Virtualization can be defined as the backbone of cloud computing services, which has gathered significant attention from organizations and users. Due to the increasing number of cyberattacks, virtualization security has become a crucial area of study. In this paper, we propose an explainable and introspection-based malware detection approach called vDefender for fine-grain monitoring of virtual machine (VM) processes at the hypervisor to identify the malicious behaviour of 17 different malware families of Windows exhibiting new evolving behaviour. Initially, it performs a basic security check to detect hidden processes and ensures the presence of security-critical processes. Then, deep memory introspection is performed using a software breakpoints injection approach to intercept the execution of processes. Various process activity logs are captured that include process-related, file manipulation, kernel heap object creation, exception-related activities, etc. Hybrid feature vectors are derived from these logs, which are reconstructed using the proposed mechanism to eliminate the redundant behaviour. The features are then learnt using Random Forest (RF) algorithm to classify distinct malware families. The interpretation and analysis of RF results involve the use of explainability techniques. The proposed approach achieves an accuracy of 95.49%, F1-score of 95.82% with 0.05% false alarms when evaluated using an emerging malware dataset. The contribution includes a comprehensive discussion of results, accompanied by a comparative analysis of current approaches that gives readers insight towards future research directions.

AN AI INFLUENCED SOCIAL CONTRACT: AN ILLUSTRATION OF AMERICAN CONSTITUTION

This research was intended to highlight how the latest technologies like social media and virtual reality (VR) have influenced upon basic principles of current democratic political system, which includes individual freedom, freedom of speech and individual privacy. Hence, this research has illustrated few constitutional articles of first formally documented social contract- An American constitution. The research explained the need to change the three articles including the first and fourth amendment of “Bill of rights” and section one of the 14th amendment. By that means, the researcher concluded at the end that, if the concept of social contract has to be relevant then it must include terminologies like virtual life, virtual freedom, virtual property, virtual security and virtual establishment in at least those three mentioned constitutional articles. Moreover, the articles were actually enacted in the era when only physical life and property were needed to be secured form external attacks but, the new technologies have changed that landscape. Hence, it is the need of the time to alter the founding principles of American constitution in order to provide safe, secure and peaceful internal and external environment to the American populace.

Construction and Analysis of Intelligent Analysis and Disposal Model for Internet Security Events in Power System

The reliability of nodes is rugged to determine, and the global accuracy is low in identifying secure access nodes of ubiquitous power network gateways. Therefore, this project intends to establish a universal power grid gateway security access node identification model. Sensor technology collects secure access nodes of IoT gateways and evaluates their reliability. It is integrated with the security level of the network to form a virtual security domain. Then, the access node is searched and controlled twice. The access node identification of the universal power IoT gateway is realized according to the reliability calculation. Simulation results show that under the same parameter conditions, when the node size increases and the number of malicious nodes increases, the proposed method can obtain higher accuracy of secure access to nodes. This proves the advantages of the proposed method.

AI기반 보안산업의 육성과제

Recently, the government's interest in industries utilizing AI has been amplified, with initiatives such as announcing a roadmap aiming to achieve the goal of becoming the world's fifth largest information security industry by 2027, with a market size of 30 trillion won, driven by digitalization and expansion in the security domain. AI represents a paradigm shift demanding innovation across nations, societies, and industries, necessitating proactive preparation and response. In the security sector, the paradigm is shifting from traditional human security to integrated security, convergence security, and AI security. To establish a foothold in the global security market, it is imperative to apply new security systems tailored to the Fourth Industrial Revolution through technological innovation, foster convergence security and physical security industries. Therefore, this study aims to propose the nurturing and development direction of the security industry based on AI, which is the core technology of the Fourth Industrial Revolution, as society evolves into a hyper-intelligent, hyper-connected, and hyper-convergent society. To foster the AI-based security industry, the application and operation of AI-based security systems need to be expanded across the entire security business. These include applying AI virtual security guards, AI-based security robots, AI-based drones, AI-based intelligent video monitoring in security rooms, AI-based autonomous driving technology and smart parking solutions, AI-based security systems in personal protection tasks, AI-based on-site crowd management systems, AI-based IoT integrated security systems, and operation of AI-based machine security systems that can be applied to the six security tasks regulated by security laws and regulations. From a policy perspective, policy support for creating new jobs and ensuring stable employment in AI security-related fields should follow. At the national level, there should be policies to nurture and support the AI-based security industry, along with efforts to address ethical issues related to AI. Furthermore, new education programs related to the Fourth Industrial Revolution and AI need to be introduced according to security laws and regulations. From a technological and academic perspective, it is necessary to enhance the professionalism of security companies to actively respond to the Fourth Industrial Revolution, and continuous development of AI-related security technologies is essential. Academic research should continue, focusing on in-depth research and development of AI security applications in various security sectors.

Network Intrusion Detection System using Machine Learning

The incremental increase in the operation of technology has led to an increase in the quantum of data that's being reused over the Internet significantly over the time period. With the huge quantum of data that's being flown over the Internet, comes the script of furnishing security to the data, and this is where an Intrusion Detection System (IDS) comes into the picture and helps in detecting any virtual security pitfalls. Intrusion Detection System (IDS) is a system that monitors and analyzes data to descry any intrusion in the system or network. Interferers that find different ways to access into a network. The IDS which are being proposed is being enforced using technologies such as Machine Learning Algorithms to classify the attacks and detecting them whenever an attack happens and also to find which machine learning algorithm is suitable for detecting the attack. The Intrusion Detection System (IDS) plays an important part in deterring attacks. Still, arising technologies, like cloud computing, Internet of Things etc., induce a large volume of traffics, which may carry the inapplicable attributes that don't have any impact on discovery of assaults. To overcome these issues, features selection approaches (FSA) have been used to remove non- relevant features and find the important ones

Security and Privacy Issues in Network Function Virtualization: A Review from Architectural Perspective

Security and Privacy Issues in Network Function Virtualization: A Review from Architectural Perspective

Desktop aplikacija za razmenu kriptozaštićenog govora

Introduction/purpose: All data exchanged over the Internet as well as other computer networks should be considered exposed to various types of security threats. In light of this, the transmission of voice over applications that do not use any type of crypto-protection allows anyone to discern the content of communication. Since voice transmission requires as little delay as possible, various protocols are used to enable crypto protected real-time communication. This paper presents one solution in a desktop application variant. Methods: The essence in voice exchange systems as well as in other systems where real-time communication is necessary is the establishment of a crypto-protected session which is a virtual secure channel for communication to which only the communicating parties have access. Voice sessions in the application are established with the SIP (Session Initiation Protocol) protocol. The sessions are further protected using the ZRTP (Zimmerman Real-time Transport Protocol) protocol. FusionPBX was used as the SIP server (registrar) for testing purpouses. The application is developed in C++ language using the Qt framework. Results: The final version of the application demostrates that ZRTP and SIP protocols are well suited for establishing crypto protected voice communications with low delay. Conclusion: This solution provides cryptographic functions for data secrecy and the management of cryptographic keys. Improving the solution with digital signatures and certificates will result in additional cryptographic functions: data integrity and personal identification. With this improvement, this solution will be able to withstand modern security threats with low delay.

A Review of Cloud Security Issues and Challenges

The advancement of information technology today depends on cloud computing. Every cloud consumer continues to search for the best services available, particularly in terms of security. The absence of uniform standards in the security architecture of the cloud, especially within the cloud computing community, has become an ongoing problem. Most cloud service providers automatically follow the best security practises and actively protect the operation of their systems. Enterprises are required to independently judge the security of their data, apps, and the cloud’s workload. The complexity of security concerns is increasing as the digital environment develops. Virtualization, multi-tenancy, security controls, rules, and risk profiling are all concepts in cloud security. DoS, service injection, user-to-root attacks, man-in-the-middle attacks, data loss leakage andloss, identity theft, and backdoor channel attacks are a few of the dangers associated with cloud computing. Cloud platforms, data outsourcing, data storage standardisation and security, data backup, and data recovery are all examples of cloud security services. Data storage, computation, untrusted computing, and virtualization security challenges are all a part of the cloud.

INNV-35. IMPLEMENTATION OF A NATIONAL ADOLESCENT AND YOUNG ADULT MOLECULAR TUMOR BOARD: REPORT FROM THE CANADIAN AYA NEURO-ONCOLOGY NETWORK

Abstract BACKGROUND The adolescent and young adult (AYA) population (15-39 years) is a unique and understudied population and their care requires multidisciplinary expertise. Current challenges in AYA neuro-oncology include fragmented care across pediatric and adult hospitals, low inclusion in clinical trials, unique survivorship considerations and a lack of standard-of-care therapies for this population. METHODS We will report on a two-and-a-half-year national effort from the Canadian AYA Neuro-Oncology Network (CANON) to implement national clinical and molecular AYA rounds. The aims of the rounds are to provide a platform for standardized diagnostics and multidisciplinary recommendations benefiting from the expertise of pediatric and adult providers across several tertiary and community centers. RESULTS Since April 2021, the Canadian national AYA rounds have occurred biweekly on a virtual secure platform. As of April 2023, 132 cases have been discussed from 25 sites; 15 cases (11%) involved pediatric patients and 117 (89%) were patients aged > 18 and treated at adult hospitals. Cases discussed included adult (n =34, 26%) and pediatric type (n = 22, 17%) low-(n=25, 19%) and high-grade (n=30, 23%) glioma, medulloblastoma (n=14, 10.5%), ependymoma (n=6, 5%) and other tumors (glioneuronal tumors, pineal tumors, germinoma). A total of 175 providers and 70 trainees across 32 Canadian institutions have attended the rounds, spanning adult and pediatric neurosurgery, neuropathology, neuro-oncology, radiation oncology and radiology. The updated results of an ongoing prospective database of cases presented at our AYA rounds, outlining themes around molecular characterization, choice of therapies and relevant clinical outcomes will be presented at the meeting. CONCLUSIONS Virtual national AYA-neuro-oncology multi-disciplinary rounds is an effective platform that has raised awareness of current gaps and has facilitated nation-wide solutions to improve the care of AYA brain tumors, leveraging research and clinical collaborations.

Self-Aware Cybersecurity Architecture for Autonomous Vehicles: Security through System-Level Accountability.

The inherent dynamism of recent technological advancements in intelligent vehicles has seen multitudes of noteworthy security concerns regarding interactions and data. As future mobility embraces the concept of vehicles-to-everything, it exacerbates security complexities and challenges concerning dynamism, adaptiveness, and self-awareness. It calls for a transition from security measures relying on static approaches and implementations. Therefore, to address this transition, this work proposes a hierarchical self-aware security architecture that effectively establishes accountability at the system level and further illustrates why such a proposed security architecture is relevant to intelligent vehicles. The article provides (1) a comprehensive understanding of the self-aware security concept, with emphasis on its hierarchical security architecture that enables system-level accountability, and (2) a deep dive into each layer supported by algorithms and a security-specific in-vehicle black box with external virtual security operation center (VSOC) interactions. In contrast to the present in-vehicle security measures, this architecture introduces characteristics and properties that enact self-awareness through system-level accountability. It implements hierarchical layers that enable real-time monitoring, analysis, decision-making, and in-vehicle and remote site integration regarding security-related decisions and activities.

OS12.7.A IMPLEMENTATION OF A NATIONAL AYA MOLECULAR TUMOR BOARD: REPORT FROM THE CANADIAN AYA NEURO-ONCOLOGY NETWORK

Abstract BACKGROUND The adolescent and young adult (AYA) population (15-39 years) is a unique and understudied population within neuro-oncology, and their care requires expertise across pediatric and adult-type brain tumors. Current challenges in AYA neuro-oncology include fragmented care across pediatric and adult hospitals, low inclusion in clinical trials, unique survivorship considerations and a lack of standard-of-care therapies for this population. MATERIAL AND METHODS We report on a two-year national effort from the Canadian AYA Neuro-Oncology Network (CANON) to implement national AYA rounds. The aims of the rounds are to discuss challenging cases, encourage and review the utility standardized molecular testing, and provide point-of-care multidisciplinary recommendations benefiting from the expertise of pediatric and adult providers across several tertiary and community centers. RESULTS Since April 2021, the Canadian national AYA rounds have occurred biweekly on a virtual secure platform. Over 2 years, 138 cases have been discussed; 23% of patients were 15-20 years old, 33% were 21-30 years old and 26% were 31-40 years old. Cases discussed included low grade gliomas (39%), followed by high grade gliomas (33%), ependymomas (6.5%), medulloblastomas (6.5%) and others (9.4%). A total of 240 participants across 25 institutions across Canada have attended the rounds, spanning adult and pediatric neurosurgery, neuro-pathology, neuro-oncology, radiation oncology and radiology. A prospective database of cases presented at our AYA rounds, matching molecular characterization, choice of therapies and relevant clinical outcomes has been initiated and interim data will be presented at the meeting. CONCLUSION Virtual national AYA-neuro-oncology multi-disciplinary rounds have raised awareness of current gaps and possible nation-wide solutions to improve the care of AYA brain tumors. Leveraging this network, our group has published guidelines for molecular testing in AYA brain tumors and is employing this platform for ongoing research and clinical collaborations.

Feature-Fusion-Based Abnormal-Behavior-Detection Method in Virtualization Environment

From general systems to mission-critical systems at financial and government institutions, the application scope of cloud computing services is continuously expanding. Therefore, there is a need for better methods to ensure the stability and security of the cloud data and services. Monitoring the abnormal behavior of virtual machines (VMs) is one of the most-important means to identify the causes of security incidents related to the cloud. However, current traditional abnormal-behavior-detection methods for VMs on cloud platforms face multiple challenges such as privacy protection and the semantic gap. Virtualization technology plays a key role in cloud computing. Meanwhile, virtualization security is the core issue of cloud computing security as well. To address these issues, this paper proposes a feature-fusion-based abnormal-behavior-detection method (FFABD) in a virtualization environment. This method acquires the hardware features and syscalls of the VM at the physical machine level and the virtualization level, respectively. Therefore, this method is not limited by the operating system running on the VM. This makes our method more efficient and universally applicable compared to traditional abnormal-VM-detectionmethods. The ensemble learning model performs the best among all the models, achieving an Accuracy of 99.7%.

Scalable and Secure Virtualization of HSM With ScaleTrust

Hardware security modules (HSMs) have been utilized as a trustworthy foundation for cloud services. Unfortunately, existing systems using HSMs fail to meet multi-tenant scalability arising from the emerging trends such as microservices, which utilize frequent cryptographic operations. As an alternative, cloud vendors provide HSMs as a service. However, such cloud-managed HSM usage models raise security concerns due to their untrusted and shared operating environment. We propose ScaleTrust, a scalable and secure system for key management. ScaleTrust allows us to scale the number of virtual HSM partitions, each of which is isolated with respect to each other and is robust against cloud insider attacks, while preserving physical isolation of the root of trust. To enable this, ScaleTrust uses Intel SGX and multiple HSM features, such as restricting key usage by controlling key attributes of in-HSM keys and establishing a secure channel using only HSM commands. Finally, we apply ScaleTrust to four real-world systems: Keyless SSL for TLS private key offloading, JSON Web Token authentication for microservices, key provisioning, and encryption in database systems. Our evaluation shows that ScaleTrust achieves multi-tenancy in a scalable way by providing multiple virtual HSMs with legacy HSM devices that are designed to support a single tenant. ScaleTrust provides security against insider threats while incurring 11.9% and 39.0% of end-to-end throughput and latency overhead for Keyless SSL compared to stand-alone HSMs.

Static Code Analysis on The Effect of Virtual Secure Mode on Memory Acquisition with IDA

Memory acquisition process is one of digital forensics act. There are several tools that support memory acquisition process. At this time, there is a feature named secure mode that can caused crash or error in memory acquisition tools system and caused the tools to be unusable, also the loss of the computer memory. This research is focusing on analyzing the acquisition tools that has error or crash when the device that is being used for memory acquisition is in secure mode. The analysis is being carried out using static code analysis method, which is one of the techniques of reverse engineering, using IDA. This study aims to find the cause of the crash or error in memory acquisition tools. The purpose of this study is to be useful for digital forensic tester in understanding the potential risk of the secure mode impact in acquisition process. The results of this study indicate that different operating system and different kernel which runs in the device are the reasons that memory acquisition tools cannot run properly on VSM environment being turned on.

ANALYSIS OF THE EFFECT OF VSM ON THE MEMORY ACQUISITION PROCESS USING THE DYNAMIC ANALYSIS METHOD

At first, forensics was restricted to studying data that was stored on a system's hard disk. However, as storage capacity and data encryption increased, applying conventional digital forensic procedures became more challenging. As a result, memory forensics techniques are developed, or are frequently referred to as live forensics, because the process is quicker and more sophisticated. Volatile memory forensics, often known as live forensics, are necessary for this condition. Live forensics has flaws, specifically that some programs can fail when the computer is in active VSM (virtual secure mode). This results in the retrievable evidence being lost. Therefore, determining the cause is essential. The software-based memory acquisition tools Autopsy, Isobuster, DumpIt, and Magnet RAM Capturer are just a few examples. According to the findings of the experiments, the tools that have crashed include DumpIt v1.3.2.20110401. A dynamic code analysis using WindBg as a tool was utilized to study the impact of VSM on the memory acquisition tool. This study's goal is to identify the instances of crashes in various forensic instruments, which will be highly useful for forensic experts performing investigations.

Deep Learning-Based Symptomizing Cyber Threats Using Adaptive 5G Shared Slice Security Approaches

In fifth Generation (5G) networks, protection from internal attacks, external breaches, violation of confidentiality, and misuse of network vulnerabilities is a challenging task. Various approaches, especially deep-learning (DL) prototypes, have been adopted in order to counter such challenges. For 5G network defense, DL module are recommended here in order to symptomize suspicious NetFlow data. This module behaves as a virtual network function (VNF) and is placed along a 5G network. The DL module as a cyber threat-symptomizing (CTS) unit acts as a virtual security scanner along the 5G network data analytic function (NWDAF) to monitor the network data. When the data were found to be suspicious, causing network bottlenecks and let-downs of end-user services, they were labeled as “Anomalous”. For the best proactive and adaptive cyber defense system (PACDS), a logically organized modular approach has been followed to design the DL security module. In the application context, improvements have been made to input features dimension and computational complexity reduction with better response times and accuracy in outlier detection. Moreover, key performance indicators (KPIs) have been proposed for security module placement to secure interslice and intraslice communication channels from any internal or external attacks, also suggesting an adaptive defense mechanism and indicating its placement on a 5G network. Among the chosen DL models, the CNN model behaves as a stable model during behavior analysis in the results. The model classifies botnet-labeled data with 99.74% accuracy and higher precision.

Research on New Virtualization Security Protection Management System Based on Cloud Platform

Research on New Virtualization Security Protection Management System Based on Cloud Platform

A novel abstraction for security configuration in virtual networks

The incessant growth of network virtualization determined the proliferation of Virtual Network Functions (VNFs), software programs that can run on general-purpose servers and that can also integrate security controls for protection from cyber-attacks. However, a high availability of VNFs may be counterproductive for the network administrators who have to select the most suitable ones to establish the security configuration of their network. On the one hand, the vendor-dependent technicalities of each VNF may cloud the security controls it can actually perform. On the other hand, VNF selection traditionally occurs before the synthesis of the virtual network graph, so it does not employ any network information and it may outcome unoptimized results. In light of these shortcomings, this paper proposes a novel security configuration workflow, based on new abstractions that we call projections. They represent the security-related operations that VNFs should perform to enforce a security policy. Thanks to these abstractions, the actual selection of the VNFs can be postponed to the moment their deployment in the physical network is actually required. In fact, projections are enough for the synthesis of the virtual security graph. This paper also proposes a two-step algorithm for computing projection chains as candidate solutions for graph synthesis. The proposed approach has been implemented as a Java framework and a set of tests have validated its applicability to real-world VNFs, correctness, scalability and optimization. These tests showed that the new security configuration workflow can achieve a significant reduction for the number of selected VNFs and their deployment cost. Specifically, in the analyzed scenario, the improvement percentages for these two parameters are 79% and 90% with respect to the worst-case strategy, while 68% and 77% with respect to a traditional more optimized configuration strategy.

A Network Function Virtualization Architecture for Automatic and Efficient Detection and Mitigation against Web Application Malware

This paper proposes and implements a Network Function Virtualization (NFV) security architecture to provide automatic and efficient detection and mitigation against Web application malware. The mitigation is given by dynamically chaining a Virtual Security Function (VSF) to the data stream to block malicious exploitation traffic without affecting the benign traffic. We implement an NFV Security Controller (NFV-SC) that interacts with an Intrusion Detection System and a Web Application Firewall (WAF), both implemented as VSFs. We also implement a vulnerability scanner and a mechanism to automatically create rules in advance in the WAF-VSF when a security vulnerability is found in an application, even if no malicious traffic has attempted to exploit the flaw. In addition, it dynamically identifies and removes no longer used security rules to improve performance. We implement and evaluate our security proposal in the Open Platform for NFV (OPNFV). The evaluation results in our experimental scenarios show that the NFV security architecture automatically blocks 99.12% of the HTTP malicious traffic without affecting 93.6% of the benign HTTP requests. Finally, we show that the number of rules in the WAF-VSF severely affects the latency to load HTTP response headers and that the number of redirection OpenFlow rules within Open vSwitches is not enough to significantly impact the end-user experience in modern web browser applications.

327 Optimizing the management of atopic dermatitis with a new minimal disease activity concept and criteria and consensus-based recommendations for systemic therapy

Abstract Inconsistent criteria are used to identify patients with atopic dermatitis (AD) who are candidates for systemic therapy and assess their response to systemic therapy. This may lead to undertreatment and treatment dissatisfaction. A treat-to-target (T2T) framework was previously proposed to guide systemic treatment decisions in patients with moderate-to-severe AD.1 While patient representatives were included in the T2T consensus voting process, no patient or caregiver stakeholders were included in the development of the T2T recommendations. Additionally, a recent analysis of the cross-sectional, 28-country MEASURE-AD study suggests that the treatment targets in the T2T criteria may be insufficient to ensure optimal treatment outcomes.2 To develop optimized and practical criteria for identifying patients who should receive systemic therapy, including definitions of treatment goals, treatment failure and disease severity. An executive steering committee (ESC) of seven international experts was formed in January 2021 to provide insights and perspectives on how to optimize the identification of patients who would most benefit from systemic therapy for AD. After discussing the gaps and needs in current AD management, the ESC agreed that there was a lack of evidence on patients’ treatment goals, needs, and expectations. The ESC, therefore, initiated a global, ethically and culturally diverse patient research study (N = 88) to collect these insights. Subsequently, nine regional sub-committees (SCs) were created to gain clinical perspectives from different regions worldwide (covering the USA and Puerto Rico, Latin America, Western Europe and Canada, Eastern Europe and Russia, the Middle East, Asia, and Australia and New Zealand). Overall, 87 experts from 44 countries contributed to the initiative, and 46 virtual ESC and SC meetings took place to discuss how to improve the lives of patients with AD. A virtual secure platform allowed discussions and contributions to continue outside these meetings. In April 2022, all experts rated their agreement with a series of recommendations regarding the identification and monitoring of patients eligible for systemic therapy, using a 10-point Likert scale in a modified eDelphi voting process. The consensus was pre-defined as ≥70% of all respondents rating agreement as 7 (‘mildly agree’), 8 (‘moderately agree’), 9 (‘agree’) or 10 (‘strongly agree’) with a recommendation. A strong consensus was defined as ≥90% agreement. Expert perspectives and patient insights led to the development of 34 patient-focused clinical recommendations on disease severity assessments, treatment goals and targets for clinician- and patient-reported outcomes, long-term disease control and a novel minimal disease activity (MDA) concept. A consensus of ≥80% was reached for all recommendations in one round of voting, with 88% of the recommendations reaching a ‘strong’ consensus. The MDA concept combines T2T principles with shared patient/clinician treatment decision-making principles. Patients are asked to select 1–3 feature(s) of AD which are most important to them (from the itch, skin appearance/condition, sleep disturbance, mental health, skin pain and impact on daily life). The clinician is asked to choose an objective measure of disease (from the Eczema Area and Severity Index [EASI], SCORing AD and/or the Investigator’s Global Assessment and body surface area). Treatment targets are then chosen from a list of ‘moderate’ and ‘optimal’ targets based on discussions between the clinician and patient. Optimal treatment targets include ≥90% improvement in EASI and a numeric rating scale of ≤ 1 for peak pruritus, sleep, and pain. Achievement of ‘optimal’ targets is defined as MDA. This international group of AD experts developed a novel MDA concept and criteria, which builds upon existing T2T work by providing a patient-centric approach to the optimal treatment of AD. The criteria and patient-focused clinical recommendations will help to identify and monitor patients with AD who could benefit from systemic therapy.