Unsupervised Anomaly-based Malware Detection using Hardware Features

Recent works have shown promise in using microarchitectural execution patterns to detect malware programs. These detectors belong to a class of detectors known as signature-based detectors as they catch malware by comparing a program's execution pattern (signature) to execution patterns of known malware programs. In this work, we propose a new class of detectors - anomaly-based hardware malware detectors - that do not require signatures for malware detection, and thus can catch a wider range of malware including potentially novel ones. We use unsupervised machine learning to build profiles of normal program execution based on data from performance counters, and use these profiles to detect significant deviations in program behavior that occur as a result of malware exploitation. We show that real-world exploitation of popular programs such as IE and Adobe PDF Reader on a Windows/x86 platform can be detected with nearly perfect certainty. We also examine the limits and challenges in implementing this approach in face of a sophisticated adversary attempting to evade anomaly-based detection. The proposed detector is complementary to previously proposed signature-based detectors and can be used together to improve security.Comment: 1 page, Latex; added description for feature selection in Section 4, results unchange

For the good of the group? Exploring group-level evolutionary adaptations using multilevel selection theory.

In this paper, we present an evolutionary framework, multilevel selection theory (MLS), that is highly amenable to existing social psychological theory and empiricism. MLS provides an interpretation of natural selection that shows how group-beneficial traits can evolve, a prevalent implication of social psychological data. We outline the theory and provide a number of example topics, focusing on prosociality, policing behavior, gossip, brainstorming, distributed cognition, and social identity. We also show that individual differences can produce important group-level outcomes depending on differential aggregation of individual types and relate this to the evolutionary dynamics underlying group traits. Drawing on existing work, we show how social psychologists can integrate this framework into their research program and suggest future directions for research

Rational Structures in Learning and Memory

My dissertation aims to disrupt an increasingly ubiquitous view of epistemology which claim that we can study rationality by considering a single belief at a single time. I target three areas where diachronic (i.e. temporal) factors make a difference in the three sections: 1. memory, a system of tremendous importance in our cognitive lives yet which is often reduced to a one-sided question of whether to trust what one’s memory says, 2. learning, where I argue that we should sometimes believe in a way that’s not warranted or reasonable in light of our current evidence, but which puts us in a better position to acquire evidence in the future, and 3. the connection between memory and learning, as exemplified in the case of remembering anomalous events. This project is important because our whole lives are organized around getting things right at the right time. When we try to act morally, we might try to have a life that is built around moral principles, or to become wiser and kinder over time, as opposed to amassing a collection of acts that all have independent moral value. I think the same thing is true of our endeavors to acquire knowledge the process of inquiry is not made up of individual, independent good inferences that happen to follow one another, but is instead about a trajectory where we learn over time, and take the right steps now to get things right in the future, and overall. So I think that to understand this more complete sense of inquiry, philosophy needs to make a place for memory, the system that sustains and directs inquiry in the background, over long periods of time even as the sciences are learning more and more about how natural memory systems work, philosophers have boxed it out of relevance.My methodology is to study natural and artificial learning and memory systems as a process of discovery, a way of using real-world cases as inspiration and guide to the normative landscape. Conversely, I hope that figuring out new normative possibilities can shed light on empirical facts - though this is not the main focus of my dissertation.PHDPhilosophyUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttps://deepblue.lib.umich.edu/bitstream/2027.42/145896/1/skaron_1.pd

Phase transitions during fruiting body formation in Myxococcus xanthus

The formation of a collectively moving group benefits individuals within a population in a variety of ways such as ultra-sensitivity to perturbation, collective modes of feeding, and protection from environmental stress. While some collective groups use a single organizing principle, others can dynamically shift the behavior of the group by modifying the interaction rules at the individual level. The surface-dwelling bacterium Myxococcus xanthus forms dynamic collective groups both to feed on prey and to aggregate during times of starvation. The latter behavior, termed fruiting-body formation, involves a complex, coordinated series of density changes that ultimately lead to three-dimensional aggregates comprising hundreds of thousands of cells and spores. This multi-step developmental process most likely involves several different single-celled behaviors as the population condenses from a loose, two-dimensional sheet to a three-dimensional mound. Here, we use high-resolution microscopy and computer vision software to spatiotemporally track the motion of thousands of individuals during the initial stages of fruiting body formation. We find that a combination of cell-contact-mediated alignment and internal timing mechanisms drive a phase transition from exploratory flocking, in which cell groups move rapidly and coherently over long distances, to a reversal-mediated localization into streams, which act as slow-spreading, quasi-one-dimensional nematic fluids. These observations lead us to an active liquid crystal description of the myxobacterial development cycle.Comment: 16 pages, 5 figure

The achievement of spacecraft autonomy through the thematic application of multiple cooperating intelligent agents

A description is given of UNICORN, a prototype system developed for the purpose of investigating artificial intelligence (AI) concepts supporting spacecraft autonomy. UNICORN employs thematic reasoning, of the type first described by Rodger Schank of Northwestern University, to allow the context-sensitive control of multiple intelligent agents within a blackboard based environment. In its domain of application, UNICORN demonstrates the ability to reason teleologically with focused knowledge. Also presented are some of the lessons learned as a result of this effort. These lessons apply to any effort wherein system level autonomy is the objective

Measuring time preferences

We review research that measures time preferences—i.e., preferences over intertemporal tradeoffs. We distinguish between studies using financial flows, which we call “money earlier or later” (MEL) decisions and studies that use time-dated consumption/effort. Under different structural models, we show how to translate what MEL experiments directly measure (required rates of return for financial flows) into a discount function over utils. We summarize empirical regularities found in MEL studies and the predictive power of those studies. We explain why MEL choices are driven in part by some factors that are distinct from underlying time preferences.National Institutes of Health (NIA R01AG021650 and P01AG005842) and the Pershing Square Fund for Research in the Foundations of Human Behavior

Frustration in Biomolecules

Biomolecules are the prime information processing elements of living matter. Most of these inanimate systems are polymers that compute their structures and dynamics using as input seemingly random character strings of their sequence, following which they coalesce and perform integrated cellular functions. In large computational systems with a finite interaction-codes, the appearance of conflicting goals is inevitable. Simple conflicting forces can lead to quite complex structures and behaviors, leading to the concept of "frustration" in condensed matter. We present here some basic ideas about frustration in biomolecules and how the frustration concept leads to a better appreciation of many aspects of the architecture of biomolecules, and how structure connects to function. These ideas are simultaneously both seductively simple and perilously subtle to grasp completely. The energy landscape theory of protein folding provides a framework for quantifying frustration in large systems and has been implemented at many levels of description. We first review the notion of frustration from the areas of abstract logic and its uses in simple condensed matter systems. We discuss then how the frustration concept applies specifically to heteropolymers, testing folding landscape theory in computer simulations of protein models and in experimentally accessible systems. Studying the aspects of frustration averaged over many proteins provides ways to infer energy functions useful for reliable structure prediction. We discuss how frustration affects folding, how a large part of the biological functions of proteins are related to subtle local frustration effects and how frustration influences the appearance of metastable states, the nature of binding processes, catalysis and allosteric transitions. We hope to illustrate how Frustration is a fundamental concept in relating function to structural biology.Comment: 97 pages, 30 figure

Cloud Computing cost and energy optimization through Federated Cloud SoS

2017 Fall.Includes bibliographical references.The two most significant differentiators amongst contemporary Cloud Computing service providers have increased green energy use and datacenter resource utilization. This work addresses these two issues from a system's architectural optimization viewpoint. The proposed approach herein, allows multiple cloud providers to utilize their individual computing resources in three ways by: (1) cutting the number of datacenters needed, (2) scheduling available datacenter grid energy via aggregators to reduce costs and power outages, and lastly by (3) utilizing, where appropriate, more renewable and carbon-free energy sources. Altogether our proposed approach creates an alternative paradigm for a Federated Cloud SoS approach. The proposed paradigm employs a novel control methodology that is tuned to obtain both financial and environmental advantages. It also supports dynamic expansion and contraction of computing capabilities for handling sudden variations in service demand as well as for maximizing usage of time varying green energy supplies. Herein we analyze the core SoS requirements, concept synthesis, and functional architecture with an eye on avoiding inadvertent cascading conditions. We suggest a physical architecture that diminishes unwanted outcomes while encouraging desirable results. Finally, in our approach, the constituent cloud services retain their independent ownership, objectives, funding, and sustainability means. This work analyzes the core SoS requirements, concept synthesis, and functional architecture. It suggests a physical structure that simulates the primary SoS emergent behavior to diminish unwanted outcomes while encouraging desirable results. The report will analyze optimal computing generation methods, optimal energy utilization for computing generation as well as a procedure for building optimal datacenters using a unique hardware computing system design based on the openCompute community as an illustrative collaboration platform. Finally, the research concludes with security features cloud federation requires to support to protect its constituents, its constituents tenants and itself from security risks