Subgradient-based Decomposition Methods for Stochastic Mixed-integer Programs with Special Structures

The focus of this dissertation is solution strategies for stochastic mixed-integer programs with special structures. Motivation for the methods comes from the relatively sparse number of algorithms for solving stochastic mixed-integer programs. Two stage models with finite support are assumed throughout. The first contribution introduces the nodal decision framework under private information restrictions. Each node in the framework has control of an optimization model which may include stochastic parameters, and the nodes must coordinate toward a single objective in which a single optimal or close-to-optimal solution is desired. However, because of competitive issues, confidentiality requirements, incompatible database issues, or other complicating factors, no global view of the system is possible. An iterative methodology called the nodal decomposition-coordination algorithm (NDC) is formally developed in which each entity in the cooperation forms its own nodal deterministic or stochastic program. Lagrangian relaxation and subgradient optimization techniques are used to facilitate negotiation between the nodal decisions in the system without any one entity gaining access to the private information from other nodes. A computational study on NDC using supply chain inventory coordination problem instances demonstrates that the new methodology can obtain good solution values without violating private information restrictions. The results also show that the stochastic solutions outperform the corresponding expected value solutions. The next contribution presents a new algorithm called scenario Fenchel decomposition (SFD) for solving two-stage stochastic mixed 0-1 integer programs with special structure based on scenario decomposition of the problem and Fenchel cutting planes. The algorithm combines progressive hedging to restore nonanticipativity of the first-stage solution, and generates Fenchel cutting planes for the LP relaxations of the subproblems to recover integer solutions. A computational study SFD using instances with multiple knapsack constraint structure is given. Multiple knapsack constrained problems are chosen due to the advantages they provide when generating Fenchel cutting planes. The computational results are promising, and show that SFD is able to find optimal solutions for some problem instances in a short amount of time, and that overall, SFD outperforms the brute force method of solving the DEP

Análise de malware com suporte de hardware

Orientadores: Paulo Lício de Geus, André Ricardo Abed GrégioDissertação (mestrado) - Universidade Estadual de Campinas, Instituto de ComputaçãoResumo: O mundo atual é impulsionado pelo uso de sistemas computacionais, estando estes pre- sentes em todos aspectos da vida cotidiana. Portanto, o correto funcionamento destes é essencial para se assegurar a manutenção das possibilidades trazidas pelos desenvolvi- mentos tecnológicos. Contudo, garantir o correto funcionamento destes não é uma tarefa fácil, dado que indivíduos mal-intencionados tentam constantemente subvertê-los visando benefíciar a si próprios ou a terceiros. Os tipos mais comuns de subversão são os ataques por códigos maliciosos (malware), capazes de dar a um atacante controle total sobre uma máquina. O combate à ameaça trazida por malware baseia-se na análise dos artefatos coletados de forma a permitir resposta aos incidentes ocorridos e o desenvolvimento de contramedidas futuras. No entanto, atacantes têm se especializado em burlar sistemas de análise e assim manter suas operações ativas. Para este propósito, faz-se uso de uma série de técnicas denominadas de "anti-análise", capazes de impedir a inspeção direta dos códigos maliciosos. Dentre essas técnicas, destaca-se a evasão do processo de análise, na qual são empregadas exemplares capazes de detectar a presença de um sistema de análise para então esconder seu comportamento malicioso. Exemplares evasivos têm sido cada vez mais utilizados em ataques e seu impacto sobre a segurança de sistemas é considerá- vel, dado que análises antes feitas de forma automática passaram a exigir a supervisão de analistas humanos em busca de sinais de evasão, aumentando assim o custo de se manter um sistema protegido. As formas mais comuns de detecção de um ambiente de análise se dão através da detecção de: (i) código injetado, usado pelo analista para inspecionar a aplicação; (ii) máquinas virtuais, usadas em ambientes de análise por questões de escala; (iii) efeitos colaterais de execução, geralmente causados por emuladores, também usados por analistas. Para lidar com malware evasivo, analistas tem se valido de técnicas ditas transparentes, isto é, que não requerem injeção de código nem causam efeitos colaterais de execução. Um modo de se obter transparência em um processo de análise é contar com suporte do hardware. Desta forma, este trabalho versa sobre a aplicação do suporte de hardware para fins de análise de ameaças evasivas. No decorrer deste texto, apresenta-se uma avaliação das tecnologias existentes de suporte de hardware, dentre as quais máqui- nas virtuais de hardware, suporte de BIOS e monitores de performance. A avaliação crítica de tais tecnologias oferece uma base de comparação entre diferentes casos de uso. Além disso, são enumeradas lacunas de desenvolvimento existentes atualmente. Mais que isso, uma destas lacunas é preenchida neste trabalho pela proposição da expansão do uso dos monitores de performance para fins de monitoração de malware. Mais especificamente, é proposto o uso do monitor BTS para fins de construção de um tracer e um debugger. O framework proposto e desenvolvido neste trabalho é capaz, ainda, de lidar com ataques do tipo ROP, um dos mais utilizados atualmente para exploração de vulnerabilidades. A avaliação da solução demonstra que não há a introdução de efeitos colaterais, o que per- mite análises de forma transparente. Beneficiando-se desta característica, demonstramos a análise de aplicações protegidas e a identificação de técnicas de evasãoAbstract: Today¿s world is driven by the usage of computer systems, which are present in all aspects of everyday life. Therefore, the correct working of these systems is essential to ensure the maintenance of the possibilities brought about by technological developments. However, ensuring the correct working of such systems is not an easy task, as many people attempt to subvert systems working for their own benefit. The most common kind of subversion against computer systems are malware attacks, which can make an attacker to gain com- plete machine control. The fight against this kind of threat is based on analysis procedures of the collected malicious artifacts, allowing the incident response and the development of future countermeasures. However, attackers have specialized in circumventing analysis systems and thus keeping their operations active. For this purpose, they employ a series of techniques called anti-analysis, able to prevent the inspection of their malicious codes. Among these techniques, I highlight the analysis procedure evasion, that is, the usage of samples able to detect the presence of an analysis solution and then hide their malicious behavior. Evasive examples have become popular, and their impact on systems security is considerable, since automatic analysis now requires human supervision in order to find evasion signs, which significantly raises the cost of maintaining a protected system. The most common ways for detecting an analysis environment are: i) Injected code detec- tion, since injection is used by analysts to inspect applications on their way; ii) Virtual machine detection, since they are used in analysis environments due to scalability issues; iii) Execution side effects detection, usually caused by emulators, also used by analysts. To handle evasive malware, analysts have relied on the so-called transparent techniques, that is, those which do not require code injection nor cause execution side effects. A way to achieve transparency in an analysis process is to rely on hardware support. In this way, this work covers the application of the hardware support for the evasive threats analysis purpose. In the course of this text, I present an assessment of existing hardware support technologies, including hardware virtual machines, BIOS support, performance monitors and PCI cards. My critical evaluation of such technologies provides basis for comparing different usage cases. In addition, I pinpoint development gaps that currently exists. More than that, I fill one of these gaps by proposing to expand the usage of performance monitors for malware monitoring purposes. More specifically, I propose the usage of the BTS monitor for the purpose of developing a tracer and a debugger. The proposed framework is also able of dealing with ROP attacks, one of the most common used technique for remote vulnerability exploitation. The framework evaluation shows no side-effect is introduced, thus allowing transparent analysis. Making use of this capability, I demonstrate how protected applications can be inspected and how evasion techniques can be identifiedMestradoCiência da ComputaçãoMestre em Ciência da ComputaçãoCAPE

Aerosol processes relevant for the Netherlands

Particulate matter (or aerosols) are particles suspended in the atmosphere. Aerosols are believed to be the most important pollutant associated with increased human mortality and morbidity. Therefore, it is important to investigate the relationship between sources of aerosols (such as industry) and the concentration of harmful aerosols at ground level. Furthermore, aerosols influence the climate system by scattering and absorbing solar radiation and by influencing cloud properties. The total climate effect of aerosols is poorly understood compared to the climate effect of greenhouse gases. Therefore, climate studies also benefit from a better understanding of aerosols. The goal of this thesis is to investigate the spatial distribution of aerosols over Europe with focus on the Netherlands. The aerosol life cycle and effects are calculated with numerical simulations. Performing numerical simulations of aerosols is very challenging, because, in contrast to gas molecules, each individual aerosol differs in size, composition and microphysical properties. Without simplifications, a model has to track each individual particle, which would take far too much computational time, even for modern supercomputers. The challenge is to design simplifications in such a way that the life cycle of aerosols and the effects of aerosols on human health and climate are still properly represented. Many model studies are supported by measurements. Both the measurements and the models can have different purposes. Using the correct combination of different models and observations is key for studies on aerosols. A different combination of models and observations is required to accomplish the different sub goals of this thesis. These sub goals are: Investigation of the aerosol life cycle over Europe Improvement of the understanding of gas-aerosol phase transition of ammonium nitrate and aerosol optics Improvement of representation of aerosols and their effects in models The life cycle of aerosols in Europe is investigated in chapter 3. The full life cycle of aerosols has been implemented in a global transport model. It is concluded that Europe is a net source of anthropogenic (man-made) aerosols and a net sink of natural aerosols. The most important sink of anthropogenic aerosols is removal by clouds and rain, while natural aerosols are removed predominantly by dry deposition processes. By comparing model results with observations, it is concluded that the largest uncertainties are caused by the parameterisation of wet removal processes and by missing emissions. In the Netherlands, emissions of nitrogen oxides and ammonia are high because of the high population density and intensive agriculture. After oxidation of nitrogen oxides to nitric acid, ammonium nitrate aerosols can be formed. This aerosol is special, because it can evaporate under warm and dry conditions and condense back to the aerosol phase under cold and moist conditions. Like the case of clouds, the phase equilibrium changes with altitude as the atmospheric temperature decreases with altitude. The phase of ammonium nitrate is poorly detected by many measurement instruments, because the gas-aerosol partitioning can change inside the instrument. Partly due to the scarcity of reliable measurements, the phase transition of ammonium nitrate is poorly implemented in large-scale models. Because ammonium nitrate aerosol and its phase transition is important for the aerosol budget of the Netherlands, this process has further been investigated in case studies. The goal of case studies is to gain detailed insight in the aerosol processes and, ultimately, to develop better parameterisations for large-scale models. These case-studies are performed with more detailed small-scale models. In these models, not the full aerosol life cycle is simulated but only the processes that are being investigated. A large advantage, however, is that these models have a higher resolution both in the spatial and the temporal domain. As a result, the important processes can be resolved more precisely. Chapter 4 presents a case study where the interaction between ammonium nitrate phase transition and mixing in the lower atmosphere (boundary layer) is investigated for a warm day in spring. During an intensive measurement campaign near the Cabauw tower in the Netherlands, measurements of ammonium nitrate have been performed. Importantly, the gas and the aerosol phases have been separated with a special instrument so that both concentrations are measured without errors due to phase transition inside the instrument. It is shown that the observed partitioning between gas and aerosol ammonium nitrate deviates significantly from the thermodynamic equilibrium. The hypothesised explanation for this mismatch is that aerosol-rich air from higher altitudes (where the aerosol phase is preferred due to lower temperatures) is transported to the surface, increasing the aerosol-phase fraction of ammonium nitrate at the surface. This implies that the thermodynamic equilibrium is not instantaneously restored at the surface. A simulation of ammonium nitrate partitioning in the boundary layer has been performed with a simplified column model. The match between model results and observations improved drastically when applying a delay timescale up to two hours for the gas-aerosol equilibrium. The interaction between turbulence and ammonium nitrate partitioning is further investigated in a more detailed model study (chapter 5). In this model, turbulent motions are explicitly resolved. As highlighted above, downward motions are associated with higher aerosol concentrations, because the phase equilibrium of ammonium nitrate is shifted towards the aerosol phase at higher altitudes. Therefore, turbulent motions induce a fluctuating concentration of aerosol ammonium nitrate with updrafts containing lower aerosol ammonium nitrate concentrations and subsidence motions containing enhanced aerosol ammonium nitrate concentrations. It is discussed that these fluctuations in observations may provide information about the speed of gas-aerosol partitioning, which is very difficult to measure directly. Throughout chapters 3 to 5, several ideas for model improvements have been posed. These ideas originate both from knowledge gained in the studies and from further challenges that are discovered. One such improvement for models is a computationally efficient and adequate representation of the optical properties of aerosols. Implementation of aerosol optics has been quite challenging, because the physics of aerosol optics is very complicated. Chapter 6 presents a package that allows easy implementation of aerosol optics in atmospheric models that represent aerosols. Aerosol modelling is a very challenging task and can be developed much further. In this thesis, important steps have been taken to improve knowledge about aerosols. Future research should proceed by unravelling remaining aerosol mysteries, such as those presented in the final chapter (7) of this thesis.</p