Detecting Malicious Code by Model Checking

Abstract. The ease of compiling malicious code from source code in higher programming languages has increased the volatility of malicious programs: The first appearance of a new worm in the wild is usually followed by modified versions in quick succession. As demonstrated by Christodorescu and Jha, however, classical detection software relies on static patterns, and is easily outsmarted. In this paper, we present a flexible method to detect malicious code patterns in executables by model checking. While model checking was originally developed to verify the correctness of systems against specifications, we argue that it lends itself equally well to the specification of malicious code patterns. To this end, we introduce the specification language CTPL (Computation Tree Predicate Logic) which extends the well-known logic CTL, and describe an efficient model checking algorithm. Our practical experiments demonstrate that we are able to detect a large number of worm variants with a single specification. Key words: Model Checking, Malware Detection.

A two-parameter wind speed algorithm for Ku-band altimeters

Globally distributed crossovers of altimeter and scatterometer observations clearly demonstrate that ocean altimeter backscatter correlates with both the near-surface wind speed and the sea state. Satellite data from TOPEX/Poseidon and NSCAT are used to develop an empirical altimeter wind speed model that attenuates the sea-state signature and improves upon the present operational altimeter wind model. The inversion is defined using a multilayer perceptron neural network with altimeter-derived backscatter and significant wave height as inputs. Comparisons between this new model and past single input routines indicates that the rms wind error is reduced by 10%–15% in tandem with the lowering of wind error residuals dependent on the sea state. Both model intercomparison and validation of the new routine are detailed, including the use of large independent data compilations that include the SeaWinds and ERS scatterometers, ECMWF wind fields, and buoy measurements. The model provides consistent improvement against these varied sources with a wind-independent bias below 0.3 m s?1. The continuous form of the defined function, along with the global data used in its derivation, suggest an algorithm suitable for operational application to Ku-band altimeters. Further model improvement through wave height inclusion is limited due to an inherent multivaluedness between any single realization of the altimeter measurement pair [?o, HS] and observed near-surface winds. This ambiguity indicates that HS is a limited proxy for variable gravity wave properties that impact upon altimeter backscatter

Effects of sources and meteorology on particulate matter in the Western Mediterranean Basin: an overview of the DAURE campaign

DAURE (Determination of the Sources of Atmospheric Aerosols in Urban and Rural Environments in the Western Mediterranean) was a multidisciplinary international field campaign aimed at investigating the sources and meteorological controls of particulate matter in the Western Mediterranean Basin (WMB). Measurements were simultaneously performed at an urban-coastal (Barcelona, BCN) and a rural-elevated (Montseny, MSY) site pair in NE Spain during winter and summer. State-of-the-art methods such as 14C analysis, proton-transfer reaction mass spectrometry, and high-resolution aerosol mass spectrometry were applied for the first time in the WMB as part of DAURE. WMB regional pollution episodes were associated with high concentrations of inorganic and organic species formed during the transport to inland areas and built up at regional scales. Winter pollutants accumulation depended on the degree of regional stagnation of an air mass under anticyclonic conditions and the planetary boundary layer height. In summer, regional recirculation and biogenic secondary organic aerosols (SOA) formation mainly determined the regional pollutant concentrations. The contribution from fossil sources to organic carbon (OC) and elemental carbon (EC) and hydrocarbon-like organic aerosol concentrations were higher at BCN compared with MSY due to traffic emissions. The relative contribution of nonfossil OC was higher at MSY especially in summer due to biogenic emissions. The fossil OC/EC ratio at MSY was twice the corresponding ratio at BCN indicating that a substantial fraction of fossil OC was due to fossil SOA. In winter, BCN cooking emissions were identified as an important source of modern carbon in primary organic aerosol

Canopy-scale flux measurements and bottom-up emission estimates of volatile organic compounds from a mixed oak and hornbeam forest in northern Italy

This paper reports the fluxes and mixing ratios of biogenically emitted volatile organic compounds (BVOCs) 4aEuro-m above a mixed oak and hornbeam forest in northern Italy. Fluxes of methanol, acetaldehyde, isoprene, methyl vinyl ketoneaEuro-+aEuro-methacrolein, methyl ethyl ketone and monoterpenes were obtained using both a proton-transfer-reaction mass spectrometer (PTR-MS) and a proton-transfer-reaction time-of-flight mass spectrometer (PTR-ToF-MS) together with the methods of virtual disjunct eddy covariance (using PTR-MS) and eddy covariance (using PTR-ToF-MS). Isoprene was the dominant emitted compound with a mean daytime flux of 1.9aEuro-mgaEuro-m(-2)aEuro-h(-1). Mixing ratios, recorded 4aEuro-m above the canopy, were dominated by methanol with a mean value of 6.2aEuro-ppbv over the 28-day measurement period. Comparison of isoprene fluxes calculated using the PTR-MS and PTR-ToF-MS showed very good agreement while comparison of the monoterpene fluxes suggested a slight over estimation of the flux by the PTR-MS. A basal isoprene emission rate for the forest of 1.7aEuro-mgaEuro-m(-2)aEuro-h(-1) was calculated using the Model of Emissions of Gases and Aerosols from Nature (MEGAN) isoprene emission algorithms (Guenther et al., 2006). A detailed tree-species distribution map for the site enabled the leaf-level emission of isoprene and monoterpenes recorded using gas-chromatography mass spectrometry (GC-MS) to be scaled up to produce a bottom-up canopy-scale flux. This was compared with the top-down canopy-scale flux obtained by measurements. For monoterpenes, the two estimates were closely correlated and this correlation improved when the plant-species composition in the individual flux footprint was taken into account. However, the bottom-up approach significantly underestimated the isoprene flux, compared with the top-down measurements, suggesting that the leaf-level measurements were not representative of actual emission rates.Peer reviewe

Size-dependent influence of NO_x on the growth rates of organic aerosol particles

Atmospheric new-particle formation (NPF) affects climate by contributing to a large fraction of the cloud condensation nuclei (CCN). Highly oxygenated organic molecules (HOMs) drive the early particle growth and therefore substantially influence the survival of newly formed particles to CCN. Nitrogen oxide (NO_x) is known to suppress the NPF driven by HOMs, but the underlying mechanism remains largely unclear. Here, we examine the response of particle growth to the changes of HOM formation caused by NO_x. We show that NO_x suppresses particle growth in general, but the suppression is rather nonuniform and size dependent, which can be quantitatively explained by the shifted HOM volatility after adding NO_x. By illustrating how NO_x affects the early growth of new particles, a critical step of CCN formation, our results help provide a refined assessment of the potential climatic effects caused by the diverse changes of NO_x level in forest regions around the globe

Size-dependent influence of NOx on the growth rates of organic aerosol particles

Atmospheric new-particle formation (NPF) affects climate by contributing to a large fraction of the cloud condensation nuclei (CCN). Highly oxygenated organic molecules (HOMs) drive the early particle growth and therefore substantially influence the survival of newly formed particles to CCN. Nitrogen oxide (NOx) is known to suppress the NPF driven by HOMs, but the underlying mechanism remains largely unclear. Here, we examine the response of particle growth to the changes of HOM formation caused by NOx. We show that NOx suppresses particle growth in general, but the suppression is rather nonuniform and size dependent, which can be quantitatively explained by the shifted HOM volatility after adding NOx. By illustrating how NOx affects the early growth of new particles, a critical step of CCN formation, our results help provide a refined assessment of the potential climatic effects caused by the diverse changes of NOx level in forest regions around the globe.Peer reviewe

Oxidation products of biogenic emissions contribute to nucleation of atmospheric particles

Atmospheric new-particle formation affects climate and is one of the least understood atmospheric aerosol processes. The complexity and variability of the atmosphere has hindered elucidation of the fundamental mechanism of new-particle formation from gaseous precursors. We show, in experiments performed with the CLOUD (Cosmics Leaving Outdoor Droplets) chamber at CERN, that sulfuric acid and oxidized organic vapors at atmospheric concentrations reproduce particle nucleation rates observed in the lower atmosphere. The experiments reveal a nucleation mechanism involving the formation of clusters containing sulfuric acid and oxidized organic molecules from the very first step. Inclusion of this mechanism in a global aerosol model yields a photochemically and biologically driven seasonal cycle of particle concentrations in the continental boundary layer, in good agreement with observations

Evolution of particle composition in CLOUD nucleation experiments

Peer reviewe