Getting ahead of the arms race: hothousing the coevolution of VirusTotal with a Packer

Malware detection is in a coevolutionary arms race where the attackers and defenders are constantly seeking advantage. This arms race is asymmetric: detection is harder and more expensive than evasion. White hats must be conservative to avoid false positives when searching for malicious behaviour. We seek to redress this imbalance. Most of the time, black hats need only make incremental changes to evade them. On occasion, white hats make a disruptive move and find a new technique that forces black hats to work harder. Examples include system calls, signatures and machine learning. We present a method, called Hothouse, that combines simulation and search to accelerate the white hat’s ability to counter the black hat’s incremental moves, thereby forcing black hats to perform disruptive moves more often. To realise Hothouse, we evolve EEE, an entropy-based polymorphic packer for Windows executables. Playing the role of a black hat, EEE uses evolutionary computation to disrupt the creation of malware signatures. We enter EEE into the detection arms race with VirusTotal, the most prominent cloud service for running anti-virus tools on software. During our 6 month study, we continually improved EEE in response to VirusTotal, eventually learning a packer that produces packed malware whose evasiveness goes from an initial 51.8% median to 19.6%. We report both how well VirusTotal learns to detect EEE-packed binaries and how well VirusTotal forgets in order to reduce false positives. VirusTotal’s tools learn and forget fast, actually in about 3 days. We also show where VirusTotal focuses its detection efforts, by analysing EEE’s variants

Assessing stakeholder network engagement

Purpose: With the popularity of social media platforms, firms have now tangible means not only to reach out to their stakeholders, but also to closely monitor those interactions. Yet, there are limited methodological advances on how to measure a firm’s stakeholder networks, and the level of engagement firms have with these networks. Drawn upon the customer engagement and stakeholder theory literature, this study proposes an approach to calculate a firm’s Stakeholder Network Engagement (SNE) index. Design: After deriving the SNE index formula mathematically, we illustrate how the SNE index functions using eight firms’ online Corporate Social Responsibility (CSR) networks across four diverse industries. Findings: We propose and illustrate a new approach of capturing the SNE in a stakeholder network for use by academic and practical researchers. Research limitations/implications: Researchers can use the SNE index to assess engagement in stakeholder networks in various contexts. Practical implications: Managers can use the SNE index to assess, benchmark and improve the nature and quality of their CSR strategies to derive greater return on their CSR investments. Originality: Building on the stakeholder, communication and network analysis literatures, we conceptualise SNE in four theoretical dimensions: diffusion, accessibility, interactivity, and influence. Then, we mathematically derive and empirically illustrate an index that measures SNE

Direct vs. indirect optical recombination in Ge films grown on Si substrates

The optical emission spectra from Ge films on Si are markedly different from their bulk Ge counterparts. Whereas bulk Ge emission is dominated by the material's indirect gap, the photoluminescence signal from Ge films is mainly associated with its direct band gap. Using a new class of Ge-on-Si films grown by a recently introduced CVD approach, we study the direct and indirect photoluminescence from intrinsic and doped samples and we conclude that the origin of the discrepancy is the lack of self-absorption in thin Ge films combined with a deviation from quasi-equilibrium conditions in the conduction band. The latter is confirmed by a simple model suggesting that the deviation from quasi-equilibrium is caused by the much shorter recombination lifetime in the films relative to bulk Ge

Star-forming dwarf galaxies in the Virgo cluster: the link between molecular gas, atomic gas, and dust

We present $^{12}$CO(1-0) and $^{12}$CO(2-1) observations of a sample of 20 star-forming dwarfs selected from the Herschel Virgo Cluster Survey, with oxygen abundances ranging from 12 + log(O/H) ~ 8.1 to 8.8. CO emission is observed in ten galaxies and marginally detected in another one. CO fluxes correlate with the FIR 250 $\mu$m emission, and the dwarfs follow the same linear relation that holds for more massive spiral galaxies extended to a wider dynamical range. We compare different methods to estimate H2 molecular masses, namely a metallicity-dependent CO-to-H2 conversion factor and one dependent on H-band luminosity. The molecular-to-stellar mass ratio remains nearly constant at stellar masses <~ 10$^9$ M$_{\odot}$, contrary to the atomic hydrogen fraction, M$_{HI}$/M$_*$, which increases inversely with M$_*$. The flattening of the M$_{H_2}$/M$_*$ ratio at low stellar masses does not seem to be related to the effects of the cluster environment because it occurs for both HI-deficient and HI-normal dwarfs. The molecular-to-atomic ratio is more tightly correlated with stellar surface density than metallicity, confirming that the interstellar gas pressure plays a key role in determining the balance between the two gaseous components of the interstellar medium. Virgo dwarfs follow the same linear trend between molecular gas mass and star formation rate as more massive spirals, but gas depletion timescales, $\tau_{dep}$, are not constant and range between 100 Myr and 6 Gyr. The interaction with the Virgo cluster environment is removing the atomic gas and dust components of the dwarfs, but the molecular gas appears to be less affected at the current stage of evolution within the cluster. However, the correlation between HI deficiency and the molecular gas depletion time suggests that the lack of gas replenishment from the outer regions of the disc is lowering the star formation activity.Comment: 19 pages, 11 figures, accepted for publication in Astronomy & Astrophysic

Nuevas microbialitas de arqueociatos y trombolitos del Bilbiliense (Cámbrico inferior) de la Formación Láncara (Cordillera Cantábrica, norte de España)

Recent palaeontological and microfacies studies carried out on the Láncara Formation (early Cambrian) provide evidence for an interesting, previously undescribed association of archaeocyaths (Salce locality) and microbialites (Salce and Barrios de Luna localities). The archaeocyathan assemblage consists of Archaeocyathus laqueus (Vologdin, 1932) and Pycnoidocyathus erbiensis (Zhurav leva , 1955), indicating an early Bilbilian age (Stage 4, Series 2, Cambrian) for these materials. The analysis of the upper part of the lower member has allowed differentiation of eleven carbonate facies that have been grouped into: i) non-skeletal grain packstone-grainstone, ii) fenestral mudstone-packstone, iii) heterolithic stylonodular facies, iv) microbialites, v) bioclast-intraclast packstone-grainstone. Archaeocyaths occur reworked in stylonodular facies as well as forming small archaeocyaths-thrombolitic patches (centimetre-scale). The archaeocyath-rich thrombolitic microbialites from Salce were developed in very shallow subtidal conditions surrounded by other microbialites and small lenticular intertidal bars in the inner ramp. Toyonian biostratigraphic and paleobiogeographic analyses have also been carried out. After the comparison with Toyonian archaeocyathan rich facies from Gondwana, it has become evident that the early Cambrian record from the Cantabrian Mountains provides the richest generic assemblage from Gondwana for Toyonian time.Los recientes estudios paleontológicos y de análisis de microfacies de los materiales carbonatados de la Formación Láncara (Cámbrico inferior) han deparado el hallazgo de una inédita asociación de arqueociatos (localidad de Salce) y microbialitas (localidades de Salce y Barrios de Luna). La asociación de arqueociatos está constituida por Archaeocyathus laqueus (Vologdin, 1932) y Pycnoidocyathus erbiensis (Zhurav leva , 1955), lo que indica una edad Bilbiliense (Piso 4, Serie 2, Cámbrico) para estos materiales. En el análisis de los niveles carbonatados, a techo del miembro inferior, se han distinguido once tipos de facies que han sido agrupadas en: i) packstone-grainstone de granos no esqueléticos, ii) mudstone-packstone con fábrica fenestral, iii) facies estilonodulares heterolíticas, iv) microbialitas, v) packstone-grainstone bioclásticos e intraclásticos. Los arqueociatos aparecen resedimentados en las facies estilonodulares y formando pequeños parches trombolíticos (escala centimétrica). Las microbialitas de arqueociatos y trombolitos de Salce se desarrollaron en condiciones submareales muy someras rodeadas de otras microbialitas y pequeñas barras lenticulares en zonas intermareales de la rampa interna. Se han realizado análisis bioestratigráficos y paleobiogeográficos para el Toyoniense. Tras comparar las facies del Toyoniense ricas en arqueociatos de Gondwana, se manifiesta de manera evidente que el registro del Cámbrico inferior de la Cordillera Cantábrica aporta la asociación genérica más rica de Gondwana durante el Toyoniense

Iterative 4D reconstruction of dynamic SPECT images

[Abstract] The 22nd International Congress and Exhibition, Barcelona, Spain, June 25-28, 2008The present work presents a new approach for the 4D reconstruction algorithm for dynamic SPECT in a parallel ray geometry based on B-splines including attenuation map from CT and geometry efficiency correction. In this work we make use of 4 piecewise piecewise quadratic temporal splines and a reconstruction algorithm based on the iterative maximization of Poisson likelihood. Results on a Tecnetium (99mTc-Teboroxime) canine study are shownPublicad