On the Feasibility of Malware Authorship Attribution

There are many occasions in which the security community is interested to discover the authorship of malware binaries, either for digital forensics analysis of malware corpora or for thwarting live threats of malware invasion. Such a discovery of authorship might be possible due to stylistic features inherent to software codes written by human programmers. Existing studies of authorship attribution of general purpose software mainly focus on source code, which is typically based on the style of programs and environment. However, those features critically depend on the availability of the program source code, which is usually not the case when dealing with malware binaries. Such program binaries often do not retain many semantic or stylistic features due to the compilation process. Therefore, authorship attribution in the domain of malware binaries based on features and styles that will survive the compilation process is challenging. This paper provides the state of the art in this literature. Further, we analyze the features involved in those techniques. By using a case study, we identify features that can survive the compilation process. Finally, we analyze existing works on binary authorship attribution and study their applicability to real malware binaries.Comment: FPS 201

Measuring Gravito-magnetic Effects by Multi Ring-Laser Gyroscope

We propose an under-ground experiment to detect the general relativistic effects due to the curvature of space-time around the Earth (de Sitter effect) and to rotation of the planet (dragging of the inertial frames or Lense-Thirring effect). It is based on the comparison between the IERS value of the Earth rotation vector and corresponding measurements obtained by a tri-axial laser detector of rotation. The proposed detector consists of six large ring-lasers arranged along three orthogonal axes. In about two years of data taking, the 1% sensitivity required for the measurement of the Lense-Thirring drag can be reached with square rings of 6 $m$ side, assuming a shot noise limited sensitivity ($20 prad/s/\sqrt{Hz}$). The multi-gyros system, composed of rings whose planes are perpendicular to one or the other of three orthogonal axes, can be built in several ways. Here, we consider cubic and octahedron structures. The symmetries of the proposed configurations provide mathematical relations that can be used to study the stability of the scale factors, the relative orientations or the ring-laser planes, very important to get rid of systematics in long-term measurements, which are required in order to determine the relativistic effects.Comment: 24 pages, 26 Postscript figure

Reconstruction of the gravitational wave signal h(t)h(t) during the Virgo science runs and independent validation with a photon calibrator

The Virgo detector is a kilometer-scale interferometer for gravitational wave detection located near Pisa (Italy). About 13 months of data were accumulated during four science runs (VSR1, VSR2, VSR3 and VSR4) between May 2007 and September 2011, with increasing sensitivity. In this paper, the method used to reconstruct, in the range 10 Hz-10 kHz, the gravitational wave strain time series $h(t)$ from the detector signals is described. The standard consistency checks of the reconstruction are discussed and used to estimate the systematic uncertainties of the $h(t)$ signal as a function of frequency. Finally, an independent setup, the photon calibrator, is described and used to validate the reconstructed $h(t)$ signal and the associated uncertainties. The uncertainties of the $h(t)$ time series are estimated to be 8% in amplitude. The uncertainty of the phase of $h(t)$ is 50 mrad at 10 Hz with a frequency dependence following a delay of 8 $\mu$s at high frequency. A bias lower than $4\,\mathrm{\mu s}$ and depending on the sky direction of the GW is also present.Comment: 35 pages, 16 figures. Accepted by CQ

Measurement of the cross-section and charge asymmetry of WW bosons produced in proton-proton collisions at s=8\sqrt{s}=8 TeV with the ATLAS detector

This paper presents measurements of the $W^+ \rightarrow \mu^+\nu$ and $W^- \rightarrow \mu^-\nu$ cross-sections and the associated charge asymmetry as a function of the absolute pseudorapidity of the decay muon. The data were collected in proton--proton collisions at a centre-of-mass energy of 8 TeV with the ATLAS experiment at the LHC and correspond to a total integrated luminosity of 20.2~\mbox{fb^{-1}}. The precision of the cross-section measurements varies between 0.8% to 1.5% as a function of the pseudorapidity, excluding the 1.9% uncertainty on the integrated luminosity. The charge asymmetry is measured with an uncertainty between 0.002 and 0.003. The results are compared with predictions based on next-to-next-to-leading-order calculations with various parton distribution functions and have the sensitivity to discriminate between them.Comment: 38 pages in total, author list starting page 22, 5 figures, 4 tables, submitted to EPJC. All figures including auxiliary figures are available at https://atlas.web.cern.ch/Atlas/GROUPS/PHYSICS/PAPERS/STDM-2017-13

A Cross-correlation method to search for gravitational wave bursts with AURIGA and Virgo

We present a method to search for transient GWs using a network of detectors with different spectral and directional sensitivities: the interferometer Virgo and the bar detector AURIGA. The data analysis method is based on the measurements of the correlated energy in the network by means of a weighted cross-correlation. To limit the computational load, this coherent analysis step is performed around time-frequency coincident triggers selected by an excess power event trigger generator tuned at low thresholds. The final selection of GW candidates is performed by a combined cut on the correlated energy and on the significance as measured by the event trigger generator. The method has been tested on one day of data of AURIGA and Virgo during September 2005. The outcomes are compared to the results of a stand-alone time-frequency coincidence search. We discuss the advantages and the limits of this approach, in view of a possible future joint search between AURIGA and one interferometric detector.Comment: 11 pages, 6 figures, submitted to CQG special issue for Amaldi 7 Proceeding

Search for chargino-neutralino production with mass splittings near the electroweak scale in three-lepton final states in √s=13 TeV pp collisions with the ATLAS detector

A search for supersymmetry through the pair production of electroweakinos with mass splittings near the electroweak scale and decaying via on-shell W and Z bosons is presented for a three-lepton final state. The analyzed proton-proton collision data taken at a center-of-mass energy of √s=13  TeV were collected between 2015 and 2018 by the ATLAS experiment at the Large Hadron Collider, corresponding to an integrated luminosity of 139  fb−1. A search, emulating the recursive jigsaw reconstruction technique with easily reproducible laboratory-frame variables, is performed. The two excesses observed in the 2015–2016 data recursive jigsaw analysis in the low-mass three-lepton phase space are reproduced. Results with the full data set are in agreement with the Standard Model expectations. They are interpreted to set exclusion limits at the 95% confidence level on simplified models of chargino-neutralino pair production for masses up to 345 GeV

First narrow-band search for continuous gravitational waves from known pulsars in advanced detector data

Spinning neutron stars asymmetric with respect to their rotation axis are potential sources of continuous gravitational waves for ground-based interferometric detectors. In the case of known pulsars a fully coherent search, based on matched filtering, which uses the position and rotational parameters obtained from electromagnetic observations, can be carried out. Matched filtering maximizes the signalto- noise (SNR) ratio, but a large sensitivity loss is expected in case of even a very small mismatch between the assumed and the true signal parameters. For this reason, narrow-band analysis methods have been developed, allowing a fully coherent search for gravitational waves from known pulsars over a fraction of a hertz and several spin-down values. In this paper we describe a narrow-band search of 11 pulsars using data from Advanced LIGO’s first observing run. Although we have found several initial outliers, further studies show no significant evidence for the presence of a gravitational wave signal. Finally, we have placed upper limits on the signal strain amplitude lower than the spin-down limit for 5 of the 11 targets over the bands searched; in the case of J1813-1749 the spin-down limit has been beaten for the first time. For an additional 3 targets, the median upper limit across the search bands is below the spin-down limit. This is the most sensitive narrow-band search for continuous gravitational waves carried out so far

Search for direct stau production in events with two hadronic tau-leptons in root s=13 TeV pp collisions with the ATLAS detector

A search for the direct production of the supersymmetric partners ofτ-leptons (staus) in final stateswith two hadronically decayingτ-leptons is presented. The analysis uses a dataset of pp collisions corresponding to an integrated luminosity of139fb−1, recorded with the ATLAS detector at the LargeHadron Collider at a center-of-mass energy of 13 TeV. No significant deviation from the expected StandardModel background is observed. Limits are derived in scenarios of direct production of stau pairs with eachstau decaying into the stable lightest neutralino and oneτ-lepton in simplified models where the two staumass eigenstates are degenerate. Stau masses from 120 GeV to 390 GeV are excluded at 95% confidencelevel for a massless lightest neutralino