Almost-Fisher families

A classic theorem in combinatorial design theory is Fisher's inequality, which states that a family $\mathcal F$ of subsets of $[n]$ with all pairwise intersections of size $\lambda$ can have at most $n$ non-empty sets. One may weaken the condition by requiring that for every set in $\mathcal F$, all but at most $k$ of its pairwise intersections have size $\lambda$. We call such families $k$-almost $\lambda$-Fisher. Vu was the first to study the maximum size of such families, proving that for $k=1$ the largest family has $2n-2$ sets, and characterising when equality is attained. We substantially refine his result, showing how the size of the maximum family depends on $\lambda$. In particular we prove that for small $\lambda$ one essentially recovers Fisher's bound. We also solve the next open case of $k=2$ and obtain the first non-trivial upper bound for general $k$.Comment: 27 pages (incluiding one appendix

Android Malware Clustering through Malicious Payload Mining

Clustering has been well studied for desktop malware analysis as an effective triage method. Conventional similarity-based clustering techniques, however, cannot be immediately applied to Android malware analysis due to the excessive use of third-party libraries in Android application development and the widespread use of repackaging in malware development. We design and implement an Android malware clustering system through iterative mining of malicious payload and checking whether malware samples share the same version of malicious payload. Our system utilizes a hierarchical clustering technique and an efficient bit-vector format to represent Android apps. Experimental results demonstrate that our clustering approach achieves precision of 0.90 and recall of 0.75 for Android Genome malware dataset, and average precision of 0.98 and recall of 0.96 with respect to manually verified ground-truth.Comment: Proceedings of the 20th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2017

On (2,3)-agreeable Box Societies

The notion of $(k,m)$-agreeable society was introduced by Deborah Berg et al.: a family of convex subsets of $\R^d$ is called $(k,m)$-agreeable if any subfamily of size $m$ contains at least one non-empty $k$-fold intersection. In that paper, the $(k,m)$-agreeability of a convex family was shown to imply the existence of a subfamily of size $\beta n$ with non-empty intersection, where $n$ is the size of the original family and $\beta\in[0,1]$ is an explicit constant depending only on $k,m$ and $d$. The quantity $\beta(k,m,d)$ is called the minimal \emph{agreement proportion} for a $(k,m)$-agreeable family in $\R^d$. If we only assume that the sets are convex, simple examples show that $\beta=0$ for $(k,m)$-agreeable families in $\R^d$ where $k<d$. In this paper, we introduce new techniques to find positive lower bounds when restricting our attention to families of $d$-boxes, i.e. cuboids with sides parallel to the coordinates hyperplanes. We derive explicit formulas for the first non-trivial case: the case of $(2,3)$-agreeable families of $d$-boxes with $d\geq 2$.Comment: 15 pages, 10 figure