User-Behavior Based Detection of Infection Onset

A major vector of computer infection is through exploiting software or design flaws in networked applications such as the browser. Malicious code can be fetched and executed on a victim’s machine without the user’s permission, as in drive-by download (DBD) attacks. In this paper, we describe a new tool called DeWare for detecting the onset of infection delivered through vulnerable applications. DeWare explores and enforces causal relationships between computer-related human behaviors and system properties, such as file-system access and process execution. Our tool can be used to provide real time protection of a personal computer, as well as for diagnosing and evaluating untrusted websites for forensic purposes. Besides the concrete DBD detection solution, we also formally define causal relationships between user actions and system events on a host. Identifying and enforcing correct causal relationships have important applications in realizing advanced and secure operating systems. We perform extensive experimental evaluation, including a user study with 21 participants, thousands of legitimate websites (for testing false alarms), as well as 84 malicious websites in the wild. Our results show that DeWare is able to correctly distinguish legitimate download events from unauthorized system events with a low false positive rate (< 1%)

Hawking Radiation of Black p-Branes from Gravitational Anomaly

We investigate the Hawking radiation of black $p$-branes of superstring theories using the method of anomaly cancelation, specially, we use the method of [S. Iso, H. Umetsu and F. Wilczek, {\sl Phys. Rev. Lett.} {\bf 96}, 151302 (2006); {\sl Phys. Rev. D} {\bf 74}, 044017 (2006)]. The metrics of black $p$-branes are spherically symmetric, but not the Schwarzschild type. In order to simplify the calculation, we first make a coordinate transformation to transform the metric to the Schwarzschild type. Then we calculate its energy-momentum flux from the method of anomaly cancelation of the above mentioned references. The obtained energy-momentum flux is equal to a black body radiation, the thermodynamic temperature of the radiation is equal to its Hawking temperature. And we find that the results are not changed for the original non-Schwarzschild type spherically symmetric metric.Comment: 19 pages Latex, some mistakes correcte