Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection

Machine learning based solutions have been successfully employed for automatic detection of malware in Android applications. However, machine learning models are known to lack robustness against inputs crafted by an adversary. So far, the adversarial examples can only deceive Android malware detectors that rely on syntactic features, and the perturbations can only be implemented by simply modifying Android manifest. While recent Android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new highly-effective attack that generates adversarial examples of Android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto Android APK using a substitute model. Based on the transferability concept, the perturbations that successfully deceive the substitute model are likely to deceive the original models as well. We develop an automated tool to generate the adversarial examples without human intervention to apply the attacks. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK's Dalvik bytecode rather than Android manifest to evade from recent detectors. We evaluated the proposed manipulation methods for adversarial examples by using the same datasets that Drebin and MaMadroid (5879 malware samples) used. Our results show that, the malware detection rates decreased from 96% to 1% in MaMaDroid, and from 97% to 1% in Drebin, with just a small distortion generated by our adversarial examples manipulation method.Comment: 15 pages, 11 figure

8-(2,2,2-Trifluoro­ethoxy)quinolinium perchlorate–8-(2,2,2-trifluoro­ethoxy)quinoline (1/1)

The title compound, C11H9F3NO+·ClO4 −·C11H8F3NO or [(C11H8F3NO)H(C11H8F3NO)]ClO4, contains two 8-(2,2,2-trifluoro­eth­­oxy)quinoline molecules, one of which combines a proton from perchloric acid to form the corresponding quinolinium cation. The quinolinium and quinoline rings form a cationic unit via an inter­molecular N—H⋯N hydrogen bond. The heterocyclic units are almost perpendicular to each other [inter­planar angle 86.97 (6)°]. In the crystal, each perchlorate anion bridges two adjacent cationic units and creates a chain by a combination of C—H⋯O hydrogen bonds. Two inversion-related chains associate into a mol­ecular column by π–π stacking inter­actions between the quinolinium rings. The perpendicular and centroid–centroid distances between adjacent quinolinium rings are 3.501 (3) and 3.634 (9) Å, respectively. The molecular column is linked to its neighbors, creating a two-dimensional network via the weak π–π stacking between the quinoline rings [perpendicular and centroid–centroid separations 3.340 (4) and 4.408 (4) Å, respectively]. Finally, a three-dimensional framework is formed by a combination of intermolecular C—F⋯π contacts. One –CF3 group is disordered over two positions of equal occupancy

Genetic polymorphisms of CYP2A13 and its relationship to nasopharyngeal carcinoma in the Cantonese population

Nasopharyngeal carcinoma (NPC) is characterized by a high prevalence in Southern China, especially among Cantonese individuals of the Guangdong Province. Epidemiological studies have suggested that frequent exposure to high levels of nitrosamine from preserved foods such as salted fish could be a risk factor for NPC. Cytochrome P450 encompasses a family of enzymes that metabolize carcinogens and CYP2A13, a member of this family, is expressed predominantly in the respiratory tract with the highest levels in the nasal mucosa. In an effort to test whether a correlation exists between CYP2A13 genetic polymorphism and the risk of developing NPC, we sequenced all nine exons and the exon-intron junctions of the CYP2A13 gene in 45 NPC patients. We identified a total of 21 single nucleotide polymorphism (SNPs), including 7 novel SNPs. The most frequent functional variant allele was 74A-1757G-3375T-7233G with a haplotype frequency of 7.8% in the 45 NPC cases. In addition, a stop codon mutation was detected in one case. We then selected the 3 most frequent SNPs and one stop codon mutation to expand our study to a case-control analysis within the Cantonese population. A novel haplotype consisting 8 SNPs in introns, and four additional novel SNPs were identified; but no correlation between CYP2A13 genetic polymorphism and individual susceptibility to NPC was observed

Genetic relationships among twelve Chinese indigenous goat populations based on microsatellite analysis

Twelve Chinese indigenous goat populations were genotyped for twenty-six microsatellite markers recommended by the EU Sheep and Goat Biodiversity Project. A total of 452 goats were tested. Seventeen of the 26 microsatellite markers used in this analysis had four or more alleles. The mean expected heterozygosity and the mean observed heterozygosity for the population varied from 0.611 to 0.784 and 0.602 to 0.783 respectively. The mean FST (0.105) demonstrated that about 89.5% of the total genetic variation was due to the genetic differentiation within each population. A phylogenetic tree based on the Nei (1978) standard genetic distance displayed a remarkable degree of consistency with their different geographical origins and their presumed migration throughout China. The correspondence analysis did not only distinguish population groups, but also confirmed the above results, classifying the important populations contributing to diversity. Additionally, some specific alleles were shown to be important in the construction of the population structure. The study analyzed the recent origins of these populations and contributed to the knowledge and genetic characterization of Chinese indigenous goat populations. In addition, the seventeen microsatellites recommended by the EU Sheep and Goat Biodiversity Project proved to be useful for the biodiversity studies in goat breeds

Scattering Fields Control by Metamaterial Device Based on Ultra-Broadband Polarization Converters

We proposed a novel ultra-broadband meta¬material screen with controlling the electromagnetic scat¬tering fields based on the three layers wideband polariza¬tion converter (TLW-PC). The unit cell of TLW-PC was composed of a three layers substrate loaded with double metallic split-rings structure and a metal ground plane. We observed that the polarization converter primarily per¬formed ultra-broadband cross polarization conversion from 5.71 GHz to 14.91 GHz. Furthermore, a metamaterial screen, which contributed to the low scattering charac¬teristics, had been exploited with the orthogonal array based on TLW-PC. The near scattering electronic fields are controlled due to the change of phase and amplitude for incident wave. The metamaterial screen significantly exhibited low scattering characteristics from 5.81 GHz to 15.06 GHz. To demonstrate design, a metamaterial device easily implemented by the common printed circuit board method has been fabricated and measured. Experimental results agreed well with the simulated results