Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

Machine learning based solutions have been successfully employed for automatic detection of malware in Android applications. However, machine learning models are known to lack robustness against inputs crafted by an adversary. So far, the adversarial examples can only deceive Android malware detectors that rely on syntactic features, and the perturbations can only be implemented by simply modifying Android manifest. While recent Android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new highly-effective attack that generates adversarial examples of Android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto Android APK using a substitute model. Based on the transferability concept, the perturbations that successfully deceive the substitute model are likely to deceive the original models as well. We develop an automated tool to generate the adversarial examples without human intervention to apply the attacks. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK's Dalvik bytecode rather than Android manifest to evade from recent detectors. We evaluated the proposed manipulation methods for adversarial examples by using the same datasets that Drebin and MaMadroid (5879 malware samples) used. Our results show that, the malware detection rates decreased from 96% to 1% in MaMaDroid, and from 97% to 1% in Drebin, with just a small distortion generated by our adversarial examples manipulation method.Comment: 15 pages, 11 figure

Bis[(E)-4-bromo-2-(ethoxy­imino­meth­yl)phenolato-κ2 N,O 1]copper(II)

The title compound, [Cu(C9H9BrNO2)2], is a centrosymmetric mononuclear copper(II) complex. The Cu atom is four-coordinated in a trans-CuN2O2 square-planar geometry by two phenolate O and two oxime N atoms from two symmetry-related N,O-bidentate (E)-4-bromo-2-(ethoxy­imino­meth­yl)phenolate oxime-type ligands. An inter­esting feature of the crystal structure is the centrosymmetric inter­molecular Cu⋯O inter­action [3.382 (1) Å], which establishes an infinite chain structure along the b axis

1,3-Bis[(4-methylbenzylidene)amino­oxy]propane

The title bis­oxime compound, C19H22N2O2, synthesized by the reaction of 4-methyl-2-hydroxy­benzaldehyde with 1,3-bis­(amino­oxy)propane in ethanol, adopts a V-shaped conformation. The dihedral angle between the rings is 84.59 (3)°. The mol­ecule is disposed about a crystallographic twofold rotation axis, with one C atom lying on the axis. In the crystal, mol­ecules are packed by C—H⋯π(Ph) inter­actions, forming chains

The palaeobiogeographical spread of the acritarch Veryhachium in the Early and Middle Ordovician and its impact on biostratigraphical applications

The genus Veryhachium Deunff, 1954, is one of the most frequently documented acritarch genera, being recorded from the Early Ordovician to the Neogene. Detailed investigations show that Veryhachium species first appeared near the South Pole in the earliest part of the Tremadocian (Early Ordovician). The genus was present at high palaeolatitudes (generally>60° S) on the Gondwanan margin during the Tremadocian before spreading to lower palaeolatitudes on the Gondwanan margin and other palaeocontinents (Avalonia and Baltica) during the Floian. It became cosmopolitan in the Middle and Late Ordovician. Although useful for distinguishing Ordovician from Cambrian strata, the diachronous first appearance data of Veryhachium morphotypes mean that they should be used with caution for long-distance correlation

Model selection for fish growth patterns based on a Bayesian approach: A case study of five freshwater fish species

Selecting an appropriate growth pattern for individual fish is a meaningful but complex topic in fishery research. We model four growth functions − the commonly used von Bertalanffy growth model (VBGM), and the Gompertz growth model (GGM), Schnute–Richards growth model (SRGM), and generalized VBGM (G-VBGM) − to examine possible growth patterns. Mean total length-at-age fish datasets for five commercial fish species (yellow perch Perca flavescens, walleye Sander vitreus, northern pike Esox lucius, largemouth bass Micropterus salmoides and lake herring Coregonus artedi) from North American freshwater ecosystems, were analyzed. Using a Markov chain Monte Carlo (MCMC) algorithm, we structured four models combining informative priors of model parameters. It is the first time that deviance information criterion (DIC) and leave-one-out cross-validation (LOOCV) were combined to select the best growth model. During the model-selection process, the smooth LOOCV error successfully followed the trend of the LOOCV error, although there were difference in the curve shapes. Values of scale reduction factor (SRF) for all four models indicated convergence, ranging 1.02–1.06, below the 1.2 threshold. The GGM was selected for C. artedi, and the G-VBGM for the other four species. Our approach provided a robust process in model-selection uncertainty analysis, with the G-VBGM having the best prediction ability among our datasets