Learning Fast and Slow: PROPEDEUTICA for Real-time Malware Detection

In this paper, we introduce and evaluate PROPEDEUTICA, a novel methodology and framework for efficient and effective real-time malware detection, leveraging the best of conventional machine learning (ML) and deep learning (DL) algorithms. In PROPEDEUTICA, all software processes in the system start execution subjected to a conventional ML detector for fast classification. If a piece of software receives a borderline classification, it is subjected to further analysis via more performance expensive and more accurate DL methods, via our newly proposed DL algorithm DEEPMALWARE. Further, we introduce delays to the execution of software subjected to deep learning analysis as a way to "buy time" for DL analysis and to rate-limit the impact of possible malware in the system. We evaluated PROPEDEUTICA with a set of 9,115 malware samples and 877 commonly used benign software samples from various categories for the Windows OS. Our results show that the false positive rate for conventional ML methods can reach 20%, and for modern DL methods it is usually below 6%. However, the classification time for DL can be 100X longer than conventional ML methods. PROPEDEUTICA improved the detection F1-score from 77.54% (conventional ML method) to 90.25%, and reduced the detection time by 54.86%. Further, the percentage of software subjected to DL analysis was approximately 40% on average. Further, the application of delays in software subjected to ML reduced the detection time by approximately 10%. Finally, we found and discussed a discrepancy between the detection accuracy offline (analysis after all traces are collected) and on-the-fly (analysis in tandem with trace collection). Our insights show that conventional ML and modern DL-based malware detectors in isolation cannot meet the needs of efficient and effective malware detection: high accuracy, low false positive rate, and short classification time.Comment: 17 pages, 7 figure

Phenotypes of Cornelia de Lange syndrome caused by non-cohesion genes: Novel variants and literature review

BackgroundCornelia de Lange syndrome (CdLS) is a genetic disorder caused by variants in cohesion genes including NIPBL, SMC1A, SMC3, RAD21, and HDAC8. According to the 2018 consensus statement, a patient with clinical scored ≥ 11 points could be diagnosed as CdLS. However, some variants in non-cohesion genes rather than cohesion genes can manifest as phenotypes of CdLS.ObjectivesThis study describes six variants of non-cohesion genes (KDM6A, KMT2D, KMT2A ANKRD11, and UBE2A), and assesses the reliability of 11-points scale criteria in the clinical diagnosis of CdLS.MethodsWhole-exome sequencing (WES) was performed on six patients with features of CdLS. Phenotypic and genotypic spectra of 40 previously reported patients with features of CdLS caused by non-cohesion genes variants and 34 previously reported patients with NIPBL variants were summarized. Clinical score comparison among patients with NIPBL variants versus those with variants in non-cohesin genes was performed.ResultsVariants in non-cohesion genes were found in six patients [KMT2A (n = 2), KMT2D, ANKRD11, KDM6A, and UBE2A]. Of them, four variants (KMT2A c.7789C > T, ANKRD11 c.1757_1776del, KDM6A c.655-1G > A, and UBE2A c.439C > T) were novel. Combining with previously reported cases, 46 patients with phenotypes of CdLS caused by variants in 20 non-cohesion genes are now reported. From this total cohort, the average clinical score of patients in ANKRD11 cohort, SETD5 cohort, and AFF4 cohort was statistically lower than those in NIPBL cohort (8.92 ± 1.77 vs. 12.23 ± 2.58, 7.33 ± 2.52 vs. 12.23 ± 2.58, 5.33 ± 1.53 vs. 12.23 ± 2.58; p < 0.05). The average clinical score of KMT2A cohort, EP300 cohort, and NIPBL cohort had not significantly different from (11 ± 2.19 vs. 12.23 ± 2.58, 10 ± 4.58 vs. 12.23 ± 2.58; p > 0.05).ConclusionWe described 4 novel variants of non-cohesion genes in six Chinese patients with phenotypes of CdLS. Of note, three genes (KMT2D, KDM6A, and UBE2A) causing features of CdLS have never been reported. The proposed clinical criteria for CdLS needed to be updated and refined, insofar as WES was necessary to confirm the diagnosis of CdLS. Our study expanded the spectra of non-cohesion genetic variations in patients with features of CdLS

SVH-B interacts directly with p53 and suppresses the transcriptional activity of p53

AbstractWe previously reported that inhibition of SVH-B, a specific splicing variant of SVH, results in apoptotic cell death. In this study, we reveal that this apoptosis may be dependent on the presence of p53. Co-immunoprecipitation and GST pull-down assays have demonstrated that SVH-B directly interacts with p53. In both BEL-7404 cells and p53-null Saos-2 cells transfected with a temperature-sensitive mutant of p53, V143A, ectopically expressed SVH-B suppresses the transcriptional activity of p53, and suppression of SVH by RNA interference increases the transcriptional activity of p53. Our results suggested the function of SVH-B in accelerating growth and inhibition of apoptosis is related to its inhibitory binding to p53

Optimal ultraviolet wavelength for in vivo photoacoustic imaging of cell nuclei

In order to image noninvasively cell nuclei in vivo without staining, we have developed ultraviolet photoacoustic microscopy (UV-PAM), in which ultraviolet light excites nucleic acids in cell nuclei to produce photoacoustic waves. Equipped with a tunable laser system, the UV-PAM was applied to in vivo imaging of cell nuclei in small animals. We found that 250 nm was the optimal wavelength for in vivo photoacoustic imaging of cell nuclei. The optimal wavelength enables UV-PAM to image cell nuclei using as little as 2 nJ laser pulse energy. Besides the optimal wavelength, application of a wavelength between 245 and 275 nm can produce in vivo images of cell nuclei with specific, positive, and high optical contrast

In vivo imaging of cell nuclei by photoacoustic microscopy without staining

Ultraviolet photoacoustic microscopy (UVPAM) can image cell nuclei in vivo with high contrast and resolution noninvasively without staining. Here, we used UV light at wavelengths of 210-310 nm for excitation of DNA and RNA to produce photoacoustic waves. We applied the UVPAM to in vivo imaging of cell nuclei in mouse skin, and obtained UVPAM images of the unstained cell nuclei at wavelengths of 245-282 nm as ultrasound gel was used for acoustic coupling. The largest ratio of contrast to noise was found for the images of cell nuclei at a 250 nm wavelength

Recurrence network analysis of design-quality interactions in additive manufacturing

Powder bed fusion (PBF) additive manufacturing (AM) provides a great level of flexibility in the design-driven build of metal products. However, the more complex the design, the more difficult it becomes to control the quality of AM builds. The quality challenge persistently hampers the widespread application of AM technology. Advanced imaging (e.g., X-ray computed tomography scans and high-resolution optical images) has been increasingly explored to enhance the visibility of information and improve the AM quality control. Realizing the full potential of imaging data depends on the advent of information processing methodologies for the analysis of design-quality interactions. This paper presents a design of AM experiment to investigate how design parameters (e.g., build orientation, thin-wall width, thin-wall height, and contour space) interact with quality characteristics in thin-wall builds. Note that the build orientation refers to the position of thin-walls in relation to the recoating direction on the plate, and the contour space indicates the width between rectangle hatches. First, we develop a novel generalized recurrence network (GRN) to represent the AM spatial image data. Then, GRN quantifiers, namely degree, betweenness, pagerank, closeness, and eigenvector centralities, are extracted to characterize the quality of layerwise builds. Further, we establish a regression model to predict how the design complexity impacts GRN behaviors in each layer of thin-wall builds. Experimental results show that network features are sensitive to build orientations, width, height, and contour space under the significant level α = 0.05. Thin-walls with the width bigger than 0.1 mm printed under orientation 0° are found to yield better quality compared to 60° and 90°. Also, thin-walls build with orientation 60° are more sensitive to the changes in contour space compare to the other two orientations. As a result, the orientation 60° should be avoided while printing thin-wall structures. The proposed design-quality analysis shows great potential to optimize engineering design and enhance the quality of PBF-AM builds

Attention Consistency Refined Masked Frequency Forgery Representation for Generalizing Face Forgery Detection

Due to the successful development of deep image generation technology, visual data forgery detection would play a more important role in social and economic security. Existing forgery detection methods suffer from unsatisfactory generalization ability to determine the authenticity in the unseen domain. In this paper, we propose a novel Attention Consistency Refined masked frequency forgery representation model toward generalizing face forgery detection algorithm (ACMF). Most forgery technologies always bring in high-frequency aware cues, which make it easy to distinguish source authenticity but difficult to generalize to unseen artifact types. The masked frequency forgery representation module is designed to explore robust forgery cues by randomly discarding high-frequency information. In addition, we find that the forgery attention map inconsistency through the detection network could affect the generalizability. Thus, the forgery attention consistency is introduced to force detectors to focus on similar attention regions for better generalization ability. Experiment results on several public face forgery datasets (FaceForensic++, DFD, Celeb-DF, and WDF datasets) demonstrate the superior performance of the proposed method compared with the state-of-the-art methods.Comment: The source code and models are publicly available at https://github.com/chenboluo/ACM