Mal-Netminer: Malware Classification Approach based on Social Network Analysis of System Call Graph

As the security landscape evolves over time, where thousands of species of malicious codes are seen every day, antivirus vendors strive to detect and classify malware families for efficient and effective responses against malware campaigns. To enrich this effort, and by capitalizing on ideas from the social network analysis domain, we build a tool that can help classify malware families using features driven from the graph structure of their system calls. To achieve that, we first construct a system call graph that consists of system calls found in the execution of the individual malware families. To explore distinguishing features of various malware species, we study social network properties as applied to the call graph, including the degree distribution, degree centrality, average distance, clustering coefficient, network density, and component ratio. We utilize features driven from those properties to build a classifier for malware families. Our experimental results show that influence-based graph metrics such as the degree centrality are effective for classifying malware, whereas the general structural metrics of malware are less effective for classifying malware. Our experiments demonstrate that the proposed system performs well in detecting and classifying malware families within each malware class with accuracy greater than 96%.Comment: Mathematical Problems in Engineering, Vol 201

Adaptive, locally-linear models of complex dynamics

The dynamics of complex systems generally include high-dimensional, non-stationary and non-linear behavior, all of which pose fundamental challenges to quantitative understanding. To address these difficulties we detail a new approach based on local linear models within windows determined adaptively from the data. While the dynamics within each window are simple, consisting of exponential decay, growth and oscillations, the collection of local parameters across all windows provides a principled characterization of the full time series. To explore the resulting model space, we develop a novel likelihood-based hierarchical clustering and we examine the eigenvalues of the linear dynamics. We demonstrate our analysis with the Lorenz system undergoing stable spiral dynamics and in the standard chaotic regime. Applied to the posture dynamics of the nematode $C. elegans$ our approach identifies fine-grained behavioral states and model dynamics which fluctuate close to an instability boundary, and we detail a bifurcation in a transition from forward to backward crawling. Finally, we analyze whole-brain imaging in $C. elegans$ and show that the stability of global brain states changes with oxygen concentration.Comment: 25 pages, 16 figure

Dimensionality and dynamics in the behavior of C. elegans

A major challenge in analyzing animal behavior is to discover some underlying simplicity in complex motor actions. Here we show that the space of shapes adopted by the nematode C. elegans is surprisingly low dimensional, with just four dimensions accounting for 95% of the shape variance, and we partially reconstruct "equations of motion" for the dynamics in this space. These dynamics have multiple attractors, and we find that the worm visits these in a rapid and almost completely deterministic response to weak thermal stimuli. Stimulus-dependent correlations among the different modes suggest that one can generate more reliable behaviors by synchronizing stimuli to the state of the worm in shape space. We confirm this prediction, effectively "steering" the worm in real time.Comment: 9 pages, 6 figures, minor correction

Keeping track of worm trackers

C. elegans is used extensively as a model system in the neurosciences due to its well defined nervous system. However, the seeming simplicity of this nervous system in anatomical structure and neuronal connectivity, at least compared to higher animals, underlies a rich diversity of behaviors. The usefulness of the worm in genome-wide mutagenesis or RNAi screens, where thousands of strains are assessed for phenotype, emphasizes the need for computational methods for automated parameterization of generated behaviors. In addition, behaviors can be modulated upon external cues like temperature, O2 and CO2 concentrations, mechanosensory and chemosensory inputs. Different machine vision tools have been developed to aid researchers in their efforts to inventory and characterize defined behavioral “outputs”. Here we aim at providing an overview of different worm-tracking packages or video analysis tools designed to quantify different aspects of locomotion such as the occurrence of directional changes (turns, omega bends), curvature of the sinusoidal shape (amplitude, body bend angles) and velocity (speed, backward or forward movement)

Olfactory cue use by three-spined sticklebacks foraging in turbid water: prey detection or prey location?

Foraging, when senses are limited to olfaction, is composed of two distinct stages: the detection of prey and the location of prey. While specialist olfactory foragers are able to locate prey using olfactory cues alone, this may not be the case for foragers that rely primarily on vision. Visual predators in aquatic systems may be faced with poor visual conditions such as natural or human-induced turbidity. The ability of visual predators to compensate for poor visual conditions by using other senses is not well understood, although it is widely accepted that primarily visual fish, such as three-spined sticklebacks, Gasterosteus aculeatus, can detect and use olfactory cues for a range of purposes. We investigated the ability of sticklebacks to detect the presence of prey and to locate prey precisely, using olfaction, in clear and turbid (two levels) water. When provided with only a visual cue, or only an olfactory cue, sticklebacks showed a similar ability to detect prey, but a combination of these cues improved their performance. In open-arena foraging trials, a dispersed olfactory cue added to the water (masking cues from the prey) improved foraging success, contrary to our expectations, whereas activity levels and swimming speed did not change as a result of olfactory cue availability. We suggest that olfaction functions to allow visual predators to detect rather than locate prey and that olfactory cues have an appetitive effect, enhancing motivation to forage

Nemo: a computational tool for analyzing nematode locomotion

The nematode Caenorhabditis elegans responds to an impressive range of chemical, mechanical and thermal stimuli and is extensively used to investigate the molecular mechanisms that mediate chemosensation, mechanotransduction and thermosensation. The main behavioral output of these responses is manifested as alterations in animal locomotion. Monitoring and examination of such alterations requires tools to capture and quantify features of nematode movement. In this paper, we introduce Nemo (nematode movement), a computationally efficient and robust two-dimensional object tracking algorithm for automated detection and analysis of C. elegans locomotion. This algorithm enables precise measurement and feature extraction of nematode movement components. In addition, we develop a Graphical User Interface designed to facilitate processing and interpretation of movement data. While, in this study, we focus on the simple sinusoidal locomotion of C. elegans, our approach can be readily adapted to handle complicated locomotory behaviour patterns by including additional movement characteristics and parameters subject to quantification. Our software tool offers the capacity to extract, analyze and measure nematode locomotion features by processing simple video files. By allowing precise and quantitative assessment of behavioral traits, this tool will assist the genetic dissection and elucidation of the molecular mechanisms underlying specific behavioral responses.Comment: 12 pages, 2 figures. accepted by BMC Neuroscience 2007, 8:8

Modeling the ballistic-to-diffusive transition in nematode motility reveals variation in exploratory behavior across species

A quantitative understanding of organism-level behavior requires predictive models that can capture the richness of behavioral phenotypes, yet are simple enough to connect with underlying mechanistic processes. Here we investigate the motile behavior of nematodes at the level of their translational motion on surfaces driven by undulatory propulsion. We broadly sample the nematode behavioral repertoire by measuring motile trajectories of the canonical lab strain $C. elegans$ N2 as well as wild strains and distant species. We focus on trajectory dynamics over timescales spanning the transition from ballistic (straight) to diffusive (random) movement and find that salient features of the motility statistics are captured by a random walk model with independent dynamics in the speed, bearing and reversal events. We show that the model parameters vary among species in a correlated, low-dimensional manner suggestive of a common mode of behavioral control and a trade-off between exploration and exploitation. The distribution of phenotypes along this primary mode of variation reveals that not only the mean but also the variance varies considerably across strains, suggesting that these nematode lineages employ contrasting ``bet-hedging'' strategies for foraging.Comment: 46 pages, 18 figures, 6 table