Feature Engineering Using File Layout for Malware Detection

Malware detection on binary executables provides a high availability to even binaries which are not disassembled or decompiled. However, a binary-level approach could cause ambiguity problems. In this paper, we propose a new feature engineering technique that use minimal knowledge about the internal layout on a binary. The proposed feature avoids the ambiguity problems by integrating the information about the layout with structural entropy. The experimental results show that our feature improves accuracy and F1-score by 3.3% and 0.07, respectively, on a CNN based malware detector with realistic benign and malicious samples.Comment: 2pages, no figures, This manuscript was presented in the poster session of The Annual Computer Security Applications Conference (ACSAC) 202

The Eruption from a Sigmoidal Solar Active Region on 2005 May 13

This paper presents a multiwavelength study of the M8.0 flare and its associated fast halo CME that originated from a bipolar active region NOAA 10759 on 2005 May 13. The source active region has a conspicuous sigmoid structure at TRACE 171 A channel as well as in the SXI soft X-ray images, and we mainly concern ourselves with the detailed process of the sigmoid eruption as evidenced by the multiwavelength data ranging from Halpha, WL, EUV/UV, radio, and hard X-rays (HXRs). The most important finding is that the flare brightening starts in the core of the active region earlier than that of the rising motion of the flux rope. This timing clearly addresses one of the main issues in the magnetic eruption onset of sigmoid, namely, whether the eruption is initiated by an internal tether-cutting to allow the flux rope to rise upward or a flux rope rises due to a loss of equilibrium to later induce tether cutting below it. Our high time cadence SXI and Halpha data shows that the first scenario is relevant to this eruption. As other major findings, we have the RHESSI HXR images showing a change of the HXR source from a confined footpoint structure to an elongated ribbon-like structure after the flare maximum, which we relate to the sigmoid-to-arcade evolution. Radio dynamic spectrum shows a type II precursor that occurred at the time of expansion of the sigmoid and a drifting pulsating structure in the flare rising phase in HXR. Finally type II and III bursts are seen at the time of maximum HXR emission, simultaneous with the maximum reconnection rate derived from the flare ribbon motion in UV. We interpret these various observed properties with the runaway tether-cutting model proposed by Moore et al. in 2001.Comment: 10 pages, 10 figures, The Astrophysical Journal, accepted July, 200

Pre-flare activity and magnetic reconnection during the evolutionary stages of energy release in a solar eruptive flare

In this paper, we present a multi-wavelength analysis of an eruptive white-light M3.2 flare which occurred in active region NOAA 10486 on November 1, 2003. Excellent set of high resolution observations made by RHESSI and TRACE provide clear evidence of significant pre-flare activities for ~9 minutes in the form of an initiation phase observed at EUV/UV wavelengths followed by the X-ray precursor phase. During the initiation phase, we observed localized brightenings in the highly sheared core region close to the filament and interactions among short EUV loops overlying the filament which led to the opening of magnetic field lines. The X-ray precursor phase is manifested in RHESSI measurements below ~30 keV and coincided with the beginning of flux emergence at the flaring location along with early signatures of the eruption. From the RHESSI observations, we conclude that both plasma heating and electron acceleration occurred during the precursor phase. The main flare is consistent with the standard flare model. However, after the impulsive phase, intense HXR looptop source was observed without significant footpoint emission. More intriguingly, for a brief period the looptop source exhibited strong HXR emission with energies up to 100 keV and significant non-thermal characteristics. The present study indicates a causal relation between the activities in the preflare and main flare. We also conclude that pre-flare activities, occurred in the form of subtle magnetic reorganization along with localized magnetic reconnection, played a crucial role in destabilizing the active region filament leading to solar eruptive flare and associated large-scale phenomena.Comment: 31 pages, 13 figures; Accepted in The Astrophysical Journa

Investigating the origins of two extreme solar particle events: proton source profile and associated electromagnetic emissions

We analyze the high-energy particle emission from the Sun in two extreme solar particle events, in which protons are accelerated to relativistic energies and can cause a significant signal even in the ground-based particle detectors. Analysis of a relativistic proton event is based on modeling of the particle transport and interaction, from a near-Sun source through the solar wind and the Earth’s magnetosphere and atmosphere to a detector on the ground. This allows us to deduce the time profile of the proton source at the Sun and compare it with observed electromagnetic emissions. The 2 May 1998 event is associated with flare and coronal mass ejection (CME) well observed by the Nan¸cay Radioheliograph, so that the images of radio sources are available. For the 2 November 2003 event, there are available the low-corona images of the CME liftoff obtained at the Mauna Loa Solar Observatory. Those complementary data sets are analyzed jointly with the broadband dynamic radio spectra, EUV images and other data available for both events. We find a common scenario for both eruptions, including the flare’s dual impulsive phase, the CME-launch-associated decimetric-continuum burst, and the late, low-frequency type III radio bursts at the time of the relativistic proton injection into the interplanetary medium. The analysis supports the idea that the two considered events start with emission of relativistic protons previously accelerated during the flare and CME launch, then trapped in large-scale magnetic loops and later released by the expanding CME

Investigating the Origins of Two Extreme Solar Particle Events: Proton Source Profile and Associated Electromagnetic Emissions

We analyze the high-energy particle emission from the Sun in two extreme solar particle events. in which protons are accelerated to relativistic energies and can cause a significant signal even in the ground-based particle detectors. Analysis of a relativistic proton event is based on modeling of the particle transport and interaction, from a near-Sun source through the solar wind and the Earth's magnetosphere and atmosphere to a detector on the ground. This allows us to deduce the time profile of the proton source at the Sun and compare it with observed electromagnetic emissions. The 1998 May 2 event is associated with a. flare and a coronal mass ejection (CME), which were well observed by the Nancay Radioheliograph, thus. the images of the. radio sources are available. For the 2003 November 2 event, the low corona images of the CME liftoff obtained at the Mauna Loa Solar Observatory. are available. Those complementary data sets are analyzed jointly with the broadband dynamic radio spectra, EUV images, and other data available for both events. We find a common scenario for both eruptions, including the flare's dual impulsive phase, the CME-launch-associated decimetric-continuum burst, and the late, low-frequency type III radio bursts at the time of the relativistic proton injection into the interplanetary medium. The analysis supports the idea that the two considered events start with emission of relativistic protons previously accelerated during the flare and CME launch, then trapped in large-scale magnetic loops and later released by the expanding CME

FastMimic: Model-Based Motion Imitation for Agile, Diverse and Generalizable Quadrupedal Locomotion

Robots operating in human environments require a diverse set of skills, including slow and fast walking, turning, side-stepping, and more. However, developing robot controllers capable of exhibiting such a broad range of behaviors is a challenging problem that necessitates meticulous investigation for each task. To address this challenge, we introduce a trajectory optimization method that resolves the kinematic infeasibility of reference animal motions. This method, combined with a model-based controller, results in a unified data-driven model-based control framework capable of imitating various animal gaits without the need for expensive simulation training or real-world fine-tuning. Our framework is capable of imitating a variety of motor skills such as trotting, pacing, turning, and side-stepping with ease. It shows superior tracking capabilities in both simulations and the real world compared to other imitation controllers, including a model-based one and a learning-based motion imitation technique

A Current Reconstruction at Parallel Three Phase Inverters Using Two Current Sensors

In this paper, a current restoration method which can be applied to three phase parallel interleaved inverters (TPPII) using two current sensors has been proposed. In the proposed current reconstruction method, the branch current and the phase current of the two phases of the TPPII are sampled concurrently at the peak and valley of the pulse width modulation (PWM) carrier using two hall-effect sensors. Then, the phase current of each inverter is reconstructed by analyzing the sensed current with the current conduction path information according to the switch state in the peak and valley of the PWM carrier. This paper additionally analyzes the characteristics of the offset occurring in the detection process of two current sensors and it proposes a compensation method to reduce the offset on-line. In order to at once reduce the offset of the three-phase recovery current caused by the DC offset of the sensor, a coordinate conversion method and a low pass are used. To verify the performance of the proposed current recovery method and real-time offset compensation method, a simulation using PSIM software was performed, and experiments were conducted using a three phase parallel inverter composed of insulated gate bipolar transistor (IGBT) modules. In particular, the AC offset that occurred in the sampling process during the experiment was analyzed and modeled, and it was reduced by simple calculation

A Study on N2O Measurement Characteristics Using Photoacoustic Spectroscopy (PAS)

N2O, which is emitted mainly from nitrogen decomposition via bacteria, livestock manure, agricultural fertilizer use, fossil fuel combustion and waste incineration, is classified as a substance that causes significant destruction of the ozone layer. The N2O measurement methods for these emission sources may be divided into chromatography, optical, and electrical current measurements. Chromatography has been widely utilized for analyzing N2O. However, up until now, few studies have been conducted on N2O using photoacoustic spectroscopy. Therefore, this study aimed to evaluate performance of photoacoustic spectroscopy in this regard based on laboratory and field test results. The repeatability of photoacoustic spectroscopy was measured at 1.12%, which is lower than the repeatability of 3.0% suggested by the ISO 1564 standard, so, it has shown an excellent repeatability. The detection limit was determined to be 0.025 ppm, and the response time was confirmed to be 3 min and 26 s. The results of comparison between these measurements and GC show that the latter has superior accuracy, but mobility and convenience are superior for PAS. On the contrary, GC has a continuous measurement limitation, but PAS makes it possible to conduct continuous measurements. Therefore, PAS can be extremely useful to confirm the characteristics of N2O emissions and to quantify their amount