Detecting Malicious Code by Model Checking

Abstract. The ease of compiling malicious code from source code in higher programming languages has increased the volatility of malicious programs: The first appearance of a new worm in the wild is usually followed by modified versions in quick succession. As demonstrated by Christodorescu and Jha, however, classical detection software relies on static patterns, and is easily outsmarted. In this paper, we present a flexible method to detect malicious code patterns in executables by model checking. While model checking was originally developed to verify the correctness of systems against specifications, we argue that it lends itself equally well to the specification of malicious code patterns. To this end, we introduce the specification language CTPL (Computation Tree Predicate Logic) which extends the well-known logic CTL, and describe an efficient model checking algorithm. Our practical experiments demonstrate that we are able to detect a large number of worm variants with a single specification. Key words: Model Checking, Malware Detection.

The dust temperature distribution in prestellar cores

We have computed the dust temperature distribution to be expected in a pre-protostellar core in the phase prior to the onset of gravitational instability. We have done this in the approximation that the heating of the dust grains is solely due to the attenuated external radiation field and that the core is optically thin to its own radiation. This permits us to consider non spherically symmetric geometries. We predict the intensity distributions of our model cores at millimeter and sub-millimeter wavelengths and compare with observations of the well studied object L1544. We have also developed an analytical approximation for the temperature at the center of spherically symmetric cores and we compare this with the numerical calculations. Our results show (in agreement with Evans et al. 2001) that the temperatures in the nuclei of cores of high visual extinction (> 30 magnitudes) are reduced to values of below ~8 K or roughly half of the surface temperature. This has the consequence that maps at wavelengths shortward of 1.3 mm see predominantly the low density exterior of pre-protostellar cores. It is extremely difficult to deduce the true density distribution from such maps alone. We have computed the intensity distribution expected on the basis of the models of Ciolek & Basu (2000) and compared with the observations of L1544. The agreement is good with a preference for higher inclinations (37 degrees instead of 16) than that adopted by Ciolek & Basu (2000). We find that a simple extension of the analytic approximation allows a reasonably accurate calculation of the dust temperature as a function of radius in cores with density distributions approximating those expected for Bonnor-Ebert spheres and suggest that this may be a useful tool for future calculations of the gas temperature in such cores.Comment: 14 latex pages, 10 ps figures, A&A accepte

[12CII] and [13CII] 158 mum emission from NGC 2024: Large column densities of ionized carbon

Context: We analyze the NGC 2024 HII region and molecular cloud interface using [12CII] and [13CII] observations. Aims: We attempt to gain insight into the physical structure of the interface layer between the molecular cloud and the HII region. Methods. Observations of [12CII] and [13CII] emission at 158 {\mu}m with high spatial and spectral resolution allow us to study the detailed structure of the ionization front and estimate the column densities and temperatures of the ionized carbon layer in the PDR. Results: The [12CII] emission closely follows the distribution of the 8 mum continuum. Across most of the source, the spectral lines have two velocity peaks similar to lines of rare CO isotopes. The [13CII] emission is detected near the edge-on ionization front. It has only a single velocity component, which implies that the [12CII] line shape is caused by self-absorption. An anomalous hyperfine line-intensity ratio observed in [13CII] cannot yet be explained. Conclusions: Our analysis of the two isotopes results in a total column density of N(H)~1.6\times10^23 cm^-2 in the gas emitting the [CII] line. A large fraction of this gas has to be at a temperature of several hundred K. The self-absorption is caused by a cooler (T<=100 K) foreground component containing a column density of N(H)~10^22 cm^-2

Far-Infrared Properties of Spitzer-selected Luminous Starbursts

We present SHARC-2 350 micron data on 20 luminous z ~ 2 starbursts with S(1.2mm) > 2 mJy from the Spitzer-selected samples of Lonsdale et al. and Fiolet et al. All the sources were detected, with S(350um) > 25 mJy for 18 of them. With the data, we determine precise dust temperatures and luminosities for these galaxies using both single-temperature fits and models with power-law mass--temperature distributions. We derive appropriate formulae to use when optical depths are non-negligible. Our models provide an excellent fit to the 6um--2mm measurements of local starbursts. We find characteristic single-component temperatures T1 ~ 35.5+-2.2 K and integrated infrared (IR) luminosities around 10^(12.9+-0.1) Lsun for the SWIRE-selected sources. Molecular gas masses are estimated at 4 x 10^(10) Msun, assuming kappa(850um)=0.15 m^2/kg and a submillimeter-selected galaxy (SMG)-like gas-to-dust mass ratio. The best-fit models imply >~2 kpc emission scales. We also note a tight correlation between rest-frame 1.4 GHz radio and IR luminosities confirming star formation as the predominant power source. The far-IR properties of our sample are indistinguishable from the purely submillimeter-selected populations from current surveys. We therefore conclude that our original selection criteria, based on mid-IR colors and 24 um flux densities, provides an effective means for the study of SMGs at z ~ 1.5--2.5.Comment: 13 pages, 4 figures, edited to match published version in ApJ 717, 29-39 (2010

Accuracy of core mass estimates in simulated observations of dust emission

We study the reliability of mass estimates obtained for molecular cloud cores using sub-millimetre and infrared dust emission. We use magnetohydrodynamic simulations and radiative transfer to produce synthetic observations with spatial resolution and noise levels typical of Herschel surveys. We estimate dust colour temperatures using different pairs of intensities, calculate column densities and compare the estimated masses with the true values. We compare these results to the case when all five Herschel wavelengths are available. We investigate the effects of spatial variations of dust properties and the influence of embedded heating sources. Wrong assumptions of dust opacity and its spectral index beta can cause significant systematic errors in mass estimates. These are mainly multiplicative and leave the slope of the mass spectrum intact, unless cores with very high optical depth are included. Temperature variations bias colour temperature estimates and, in quiescent cores with optical depths higher than for normal stable cores, masses can be underestimated by up to one order of magnitude. When heated by internal radiation sources the observations recover the true mass spectra. The shape, although not the position, of the mass spectrum is reliable against observational errors and biases introduced in the analysis. This changes only if the cores have optical depths much higher than expected for basic hydrostatic equilibrium conditions. Observations underestimate the value of beta whenever there are temperature variations along the line of sight. A bias can also be observed when the true beta varies with wavelength. Internal heating sources produce an inverse correlation between colour temperature and beta that may be difficult to separate from any intrinsic beta(T) relation of the dust grains. This suggests caution when interpreting the observed mass spectra and the spectral indices.Comment: Revised version, 17 pages, 17 figures, submitted to A&

Submillimeter to centimeter excess emission from the Magellanic Clouds. II. On the nature of the excess

Dust emission at submm to cm wavelengths is often simply the Rayleigh-Jeans tail of dust particles at thermal equilibrium and is used as a cold mass tracer in various environments including nearby galaxies. However, well-sampled spectral energy distributions of the nearby, star-forming Magellanic Clouds have a pronounced (sub-)millimeter excess (Israel et al., 2010). This study attempts to confirm the existence of such a millimeter excess above expected dust, free-free and synchrotron emission and to explore different possibilities for its origin. We model NIR to radio spectral energy distributions of the Magellanic Clouds with dust, free-free and synchrotron emission. A millimeter excess emission is confirmed above these components and its spectral shape and intensity are analysed in light of different scenarios: very cold dust, Cosmic Microwave Background (CMB) fluctuations, a change of the dust spectral index and spinning dust emission. We show that very cold dust or CMB fluctuations are very unlikely explanations for the observed excess in these two galaxies. The excess in the LMC can be satisfactorily explained either by a change of the spectral index due to intrinsic properties of amorphous grains, or by spinning dust emission. In the SMC however, due to the importance of the excess, the dust grain model including TLS/DCD effects cannot reproduce the observed emission in a simple way. A possible solution was achieved with spinning dust emission, but many assumptions on the physical state of the interstellar medium had to be made. Further studies, using higher resolution data from Planck and Herschel, are needed to probe the origin of this observed submm-cm excess more definitely. Our study shows that the different possible origins will be best distinguished where the excess is the highest, as is the case in the SMC.Comment: 7 pages, 6 figures; accepted in A&

The P2 Receptor Antagonist PPADS Supports Recovery from Experimental Stroke In Vivo

BACKGROUND: After ischemia of the CNS, extracellular adenosine 5'-triphosphate (ATP) can reach high concentrations due to cell damage and subsequent increase of membrane permeability. ATP may cause cellular degeneration and death, mediated by P2X and P2Y receptors. METHODOLOGY/PRINCIPAL FINDINGS: The effects of inhibition of P2 receptors by pyridoxalphosphate-6-azophenyl-2',4'-disulphonic acid (PPADS) on electrophysiological, functional and morphological alterations in an ischemia model with permanent middle cerebral artery occlusion (MCAO) were investigated up to day 28. Spontaneously hypertensive rats received PPADS or vehicle intracerebroventricularly 15 minutes prior MCAO for up to 7 days. The functional recovery monitored by qEEG was improved by PPADS indicated by an accelerated recovery of ischemia-induced qEEG changes in the delta and alpha frequency bands along with a faster and sustained recovery of motor impairments. Whereas the functional improvements by PPADS were persistent at day 28, the infarct volume measured by magnetic resonance imaging and the amount of TUNEL-positive cells were significantly reduced by PPADS only until day 7. Further, by immunohistochemistry and confocal laser scanning microscopy, we identified both neurons and astrocytes as TUNEL-positive after MCAO. CONCLUSION: The persistent beneficial effect of PPADS on the functional parameters without differences in the late (day 28) infarct size and apoptosis suggests that the early inhibition of P2 receptors might be favourable for the maintenance or early reconstruction of neuronal connectivity in the periinfarct area after ischemic incidents

High mass star formation in the IRAS 17233-3606 region: a new nearby and bright hot core in the southern sky

We present molecular line observations of the massive star forming region IRAS 17233-3606 aimed at studying the molecular core associated with the source. The observations were made using the Atacama Pathfinder Experiment telescope in the CO (3-2) and HCO^+ (4-3) transitions, and in the CH_3OH (6_K-5_K), (7_K-6_K) and CH_3CN (16_K-15_K) bands. For the CO(3-2) and HCO^+ (4-3) transitions, we obtained maps with a size of 70''\times 70''. The typical angular resolution of the data is ~18''. Our observations reveal an exceptionally rich molecular spectrum, a signpost of hot core activity. Comparisons with two other prominent southern hot cores were made through observations in the same frequency setups. We also detected a bipolar outflow in CO (3-2) and HCO^+ (4-3) lines. Modelling reveals a hot core of size ~3'' and a temperature of 150 K in the IRAS17233-3606 region. The parameters of the molecular outflow are derived through the analysis of the CO (3-2) emission, and are typical of outflows driven by high-mass young stellar objects.Comment: 9 pages, 10 figures (plus 8 figures as Online material), accepted by A&

GMRT 333 MHz observations of 6 nearby normal galaxies

We report Giant Meterwave Radio Telescope (GMRT) continuum observations of six nearby normal galaxies at 333 MHz. The galaxies are observed with angular resolutions better than ~20" (corresponding to a linear scale of about 0.4 - 1 kpc). These observations are sensitive to all the angular scales of interest, since the resolution of the shortest baseline in GMRT is greater than the angular size of the galaxies. Further, for five of these galaxies we show that at 333 MHz, the mean thermal fraction is less than 5%. Using archival data at about 1 GHz, we estimate the mean thermal fraction to be about 10% at that frequency. We also find that the nonthermal spectral index is generally steeper in regions with low thermal fraction and/or located in the outer parts of the galaxy. In regions of high thermal fraction, the nonthermal spectral index is flatter, and has a narrow distribution peaking at ~ -0.78 with a spread of 0.16, putting stringent constraints on the physical conditions for generation, diffusion and energy losses of cosmic ray electrons at scales of ~ 1 kpc.Comment: 18 pages, 11 figures, Accepted for publication in MNRA

Analysis of galaxy SEDs from far-UV to far-IR with CIGALE: Studying a SINGS test sample

Photometric data of galaxies covering the rest-frame wavelength range from far-UV to far-IR make it possible to derive galaxy properties with a high reliability by fitting the attenuated stellar emission and the related dust emission at the same time. For this purpose we wrote the code CIGALE (Code Investigating GALaxy Emission) that uses model spectra composed of the Maraston (or PEGASE) stellar population models, synthetic attenuation functions based on a modified Calzetti law, spectral line templates, the Dale & Helou dust emission models, and optional spectral templates of obscured AGN. Depending on the input redshifts, filter fluxes are computed for the model set and compared to the galaxy photometry by carrying out a Bayesian-like analysis. CIGALE was tested by analysing 39 nearby galaxies selected from SINGS. The reliability of the different model parameters was evaluated by studying the resulting expectation values and their standard deviations in relation to the input model grid. Moreover, the influence of the filter set and the quality of photometric data on the code results was estimated. For up to 17 filters between 0.15 and 160 mum, we find robust results for the mass, star formation rate, effective age of the stellar population at 4000 A, bolometric luminosity, luminosity absorbed by dust, and attenuation in the far-UV. A study of the mutual relations between the reliable properties confirms the dependence of star formation activity on morphology in the local Universe and indicates a significant drop in this activity at about 10^11 M_sol towards higher total stellar masses. The dustiest sample galaxies are present in the same mass range. [abridged]Comment: 22 pages, 21 figures, accepted for publication in A&