142 research outputs found
Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection
In this paper, we introduce and evaluate PROPEDEUTICA, a novel methodology
and framework for efficient and effective real-time malware detection,
leveraging the best of conventional machine learning (ML) and deep learning
(DL) algorithms. In PROPEDEUTICA, all software processes in the system start
execution subjected to a conventional ML detector for fast classification. If a
piece of software receives a borderline classification, it is subjected to
further analysis via more performance expensive and more accurate DL methods,
via our newly proposed DL algorithm DEEPMALWARE. Further, we introduce delays
to the execution of software subjected to deep learning analysis as a way to
"buy time" for DL analysis and to rate-limit the impact of possible malware in
the system. We evaluated PROPEDEUTICA with a set of 9,115 malware samples and
877 commonly used benign software samples from various categories for the
Windows OS. Our results show that the false positive rate for conventional ML
methods can reach 20%, and for modern DL methods it is usually below 6%.
However, the classification time for DL can be 100X longer than conventional ML
methods. PROPEDEUTICA improved the detection F1-score from 77.54% (conventional
ML method) to 90.25%, and reduced the detection time by 54.86%. Further, the
percentage of software subjected to DL analysis was approximately 40% on
average. Further, the application of delays in software subjected to ML reduced
the detection time by approximately 10%. Finally, we found and discussed a
discrepancy between the detection accuracy offline (analysis after all traces
are collected) and on-the-fly (analysis in tandem with trace collection). Our
insights show that conventional ML and modern DL-based malware detectors in
isolation cannot meet the needs of efficient and effective malware detection:
high accuracy, low false positive rate, and short classification time.Comment: 17 pages, 7 figure
ShadowNet: A Secure and Efficient System for On-device Model Inference
With the increased usage of AI accelerators on mobile and edge devices,
on-device machine learning (ML) is gaining popularity. Consequently, thousands
of proprietary ML models are being deployed on billions of untrusted devices.
This raises serious security concerns about model privacy. However, protecting
the model privacy without losing access to the AI accelerators is a challenging
problem. In this paper, we present a novel on-device model inference system,
ShadowNet. ShadowNet protects the model privacy with Trusted Execution
Environment (TEE) while securely outsourcing the heavy linear layers of the
model to the untrusted hardware accelerators. ShadowNet achieves this by
transforming the weights of the linear layers before outsourcing them and
restoring the results inside the TEE. The nonlinear layers are also kept secure
inside the TEE. The transformation of the weights and the restoration of the
results are designed in a way that can be implemented efficiently. We have
built a ShadowNet prototype based on TensorFlow Lite and applied it on four
popular CNNs, namely, MobileNets, ResNet-44, AlexNet and MiniVGG. Our
evaluation shows that ShadowNet achieves strong security guarantees with
reasonable performance, offering a practical solution for secure on-device
model inference.Comment: single column, 21 pages (29 pages include appendix), 12 figure
Hypericum sampsonii Hance: a review of its botany, traditional uses, phytochemistry, biological activity, and safety
Ethnopharmacological relevance: Hypericum sampsonii Hance, also known as Yuanbao Cao in Chinese, is a traditional medicinal herb from the Guttiferae family and has been widely used in China to treat various conditions, including dysentery, enteritis, mastitis, scrofula, and contusion.Aim of the review: This review aims to provide a comprehensive overview of the botany, traditional uses, phytochemistry, biological activity and safety of H. sampsonii and to highlight its potential for medical application and drug development.Materials and methods: We searched several databases, i.e., Web of Science, SciFinder, PubMed, CBM, CNKI, Google Scholar, etc., for relevant information on H. sampsonii. Additionally, we also consulted some books on Chinese medicine.Results: To date, 227 secondary metabolites have been isolated from H. sampsonii, including polycyclic polyprenylated acylphloroglucinols (PPAPs), benzophenones, xanthones, flavonoids, naphthodianthrones, anthraquinones and aromatic compounds. These metabolites exhibit various biological activities such as anti-inflammatory, anti-tumor, anti-depressant, anti-oxidant, anti-viral and anti-bacterial effects. PPAPs are considered the main active metabolites with rich biological activities. Despite being known as rich source of PPAPs, the full extent of H. sampsonii biological activities, including their potential as PDE4 inhibitors, remained unclear. Since, previous studies have mainly been based on structural identification of metabolites in H. sampsonii, and efficacy evaluations of these metabolites based on clinical applications of H. sampsonii lack sufficient data. However, current evidence suggest that PPAPs are the most likely material basis for efficacy. From the limited information available so far, there is no evidence of potential safety issues and the safety data are limited.Conclusion: Collectively, this review provides a comprehensive overview of the botany, traditional uses, phytochemistry, pharmacology, and safety of H. sampsonii, a valuable medicinal plant in China with various pharmacological activities. Based on pharmacological studies, H. sampsonii shows potential for treating gastrointestinal and gynecological disorders as well as traumatic injuries, which aligns with traditional medicinal use due to the presence of PPAPs, benzophenones, xanthones, and flavonoids. Therefore, further studies are needed to evaluate the pharmacological effects and elucidate the pharmacological mechanisms. In addition, pharmacological mechanisms and safety evaluation of PPAPs on animal models need to be clarified. Yet, further comprehensive studies are required to elucidate the phytochemical constituents, pharmacological mechanisms, structure-activity relationships, safety evaluation, and quality standards of this plant. Takentogether, this review highlights the potential of H. sampsonii for medical application and drug development
Case report: Bilateral carotid body tumors with a concomitant skull-base paraganglioma
BackgroundBilateral carotid body tumors with a concomitant skull-base paraganglioma are extremely rare, of which only one case has been reported in the literature to date.Case presentationWe present the case of a 35-year-old male with 1 year of hypertension and high levels of dopamine and 3-methoxytyramine. Magnetic resonance imaging (MRI) scans demonstrated three separate masses at the left middle cranial fossa floor and bilateral carotid bifurcation. Genetic testing showed succinate dehydrogenase complex subunit D mutation. The patient underwent the resection of the left skull base mass. Histopathology and immunohistochemistry confirmed the presence of a skull-base paraganglioma.ConclusionsSuccinate dehydrogenase complex subunit D mutation-associated bilateral carotid body tumors with a concomitant skull-base paraganglioma accompanied by abnormal dopamine and hypertension are extremely rare, which not only provides ideas for considering the association of gene mutations, biochemical abnormalities and clinical symptoms but also provides an expanded diagnostic spectrum for paraganglioma in atypical locations
A Praise for Defensive Programming: Leveraging Uncertainty for Effective Malware Mitigation
A promising avenue for improving the effectiveness of behavioral-based
malware detectors would be to combine fast traditional machine learning
detectors with high-accuracy, but time-consuming deep learning models. The main
idea would be to place software receiving borderline classifications by
traditional machine learning methods in an environment where uncertainty is
added, while software is analyzed by more time-consuming deep learning models.
The goal of uncertainty would be to rate-limit actions of potential malware
during the time consuming deep analysis. In this paper, we present a detailed
description of the analysis and implementation of CHAMELEON, a framework for
realizing this uncertain environment for Linux. CHAMELEON offers two
environments for software: (i) standard - for any software identified as benign
by conventional machine learning methods and (ii) uncertain - for software
receiving borderline classifications when analyzed by these conventional
machine learning methods. The uncertain environment adds obstacles to software
execution through random perturbations applied probabilistically on selected
system calls. We evaluated CHAMELEON with 113 applications and 100 malware
samples for Linux. Our results showed that at threshold 10%, intrusive and
non-intrusive strategies caused approximately 65% of malware to fail
accomplishing their tasks, while approximately 30% of the analyzed benign
software to meet with various levels of disruption. With a dynamic, per-system
call threshold, CHAMELEON caused 92% of the malware to fail, and only 10% of
the benign software to be disrupted. We also found that I/O-bound software was
three times more affected by uncertainty than CPU-bound software. Further, we
analyzed the logs of software crashed with non-intrusive strategies, and found
that some crashes are due to the software bugs
Approximating the double-cut-and-join distance between unsigned genomes
In this paper we study the problem of sorting unsigned genomes by double-cut-and-join operations, where genomes allow a mix of linear and circular chromosomes to be present. First, we formulate an equivalent optimization problem, called maximum cycle/path decomposition, which is aimed at finding a largest collection of edge-disjoint cycles/AA-paths/AB-paths in a breakpoint graph. Then, we show that the problem of finding a largest collection of edge-disjoint cycles/AA-paths/AB-paths of length no more than l can be reduced to the well-known degree-bounded k-set packing problem with k = 2l. Finally, a polynomial-time approximation algorithm for the problem of sorting unsigned genomes by double-cut-and-join operations is devised, which achieves the approximation ratio for any positive ε. For the restricted variation where each genome contains only one linear chromosome, the approximation ratio can be further improved t
- …