Search

Deep learning (DL) has proven to be effective in detecting sophisticated malware that is constantly evolving. Even though deep learning has alleviated the feature engineering problem, finding the most optimal DL model, in terms of neural architecture search (NAS) and the model's optimal set of hyper-parameters, remains a challenge that requires domain expertise. In addition, many of the proposed state-of-the-art models are very complex and may not be the best fit for different datasets. A promising approach, known as Automated Machine Learning (AutoML), can reduce the domain expertise required to implement a custom DL model. AutoML reduces the amount of human trial-and-error involved in designing DL models, and in more recent implementations can find new model architectures with relatively low computational overhead. This work provides a comprehensive analysis and insights on using AutoML for static and online malware detection. For static, our analysis is performed on two widely used malware datasets: SOREL-20M to demonstrate efficacy on large datasets; and EMBER-2018, a smaller dataset specifically curated to hinder the performance of machine learning models. In addition, we show the effects of tuning the NAS process parameters on finding a more optimal malware detection model on these static analysis datasets. Further, we also demonstrate that AutoML is performant in online malware detection scenarios using Convolutional Neural Networks (CNNs) for cloud IaaS. We compare an AutoML technique to six existing state-of-the-art CNNs using a newly generated online malware dataset with and without other applications running in the background during malware execution.In general, our experimental results show that the performance of AutoML based static and online malware detection models are on par or even better than state-of-the-art models or hand-designed models presented in literature.

Eight pairs of rare earth normally deformed nuclei around the isobaric nuclei with A = 164 and have identical values of F-spin have been studied. These pairs of identical bands cover 16 mass units and are classified. We suggested a theoretical collective rotational formula containing three parameters (CRF3) as an extended version of Bohr-Mottelson model to calculate the ground state positive parity excitation energies. Also, the sd-version of the interacting boson model (IBM) has been used to describe the nuclear shapes by using the intrinsic coherent-state. The optimized models parameters for each nucleus are adjusted by using a simulation search program to minimize the root mean square deviation between the theoretical calculation and experimental excitation energies. The best adopted model parameters of the CRF3 are used to calculate the rotational frequencies, the kinematic and dynamic moments of inertia and the evolution of with increasing hw are systematically analyzed. A smooth gradual increase in both moments of inertia was seen. The calculated results agree excellently with the experimental ones which give strong support to the suggested CRF3. The adopted IBM parameters are used to calculate the potential energy surfaces which describe the nuclear deformation. The correlation quantities which identify the IB are extracted, exhibit identical excitation energies and energy ratios in their ground state rotational bands.

Satellite communications emerged as a promising extension to terrestrial networks in future 6G network research due to their extensive coverage in remote areas and ability to support the increasing traffic rate and heterogeneous networks. Like other wireless communication technologies, satellite signals are transmitted in a shared medium, making them vulnerable to attacks, such as eavesdropping, jamming, and spoofing. A good candidate to overcome these issues is physical layer security (PLS), which utilizes physical layer characteristics to provide security, especially due to its suitability for resource-limited devices such as satellites and IoT devices. In this paper, we provide a thorough and up-to-date review of PLS solutions for securing satellite communication. We classify main satellite applications into five domains, namely: Satellite-terrestrial, satellite-based IoT, Satellite navigation systems, FSO-based, and inter-satellite. In each domain, we discuss and investigate how PLS can be used to improve the system's overall security, preserve some desirable security properties and resist popular attacks. Finally, we highlight a few gaps in the related literature and discuss open research problems and opportunities for leveraging PLS in satellite communication.

Kubernetes is the leading platform for orchestrating containerized applications. In this paper, we extend Kubernetes networking to make use of SRv6, a feature-rich overlay networking mechanism. Integration with SRv6 can be very beneficial when Kubernetes is used in large-scale and distributed multi-datacenter scenarios. We have focused on the Calico CNI plugin, one of the most used Kubernetes networking plugins. In particular, we consider Calico-VPP, a version of the Calico plugin based on the VPP (Vector Packet Processing) data plane, which provides support for SRv6 operations with very high performance. The proposed SRv6 overlay networking solution for Kubernetes offers several advantages compared to a traditional overlay (e.g. IP in IP), in particular the possibility to use Traffic Engineering for the overlay tunnels. In the paper, we provide the architecture and the detailed design of the SRv6 based overlay and describe our open source implementation. We consider the research and technological question on how to extend Kubernetes networking to support large-scale and distributed multi-datacenter scenarios, which is an important goal for Cloud and Network providers. In this respect, we compare two different solutions for the control plane architecture of the SRv6 capable Kubernetes networking plugin, one based on the BGP routing protocol and another one based on extending the Kubernetes control plane. Finally, we report a performance evaluation of the data plane of the proposed SRv6 overlay networking, showing that it has comparable performance to existing overlay solutions (e.g. IP in IP), while offering a richer set of features., Comment: Submitted paper under review

With the increase in machine learning (ML) applications in different domains, incentives for deceiving these models have reached more than ever. As data is the core backbone of ML algorithms, attackers shifted their interest toward polluting the training data. Data credibility is at even higher risk with the rise of state-of-art research topics like open design principles, federated learning, and crowd-sourcing. Since the machine learning model depends on different stakeholders for obtaining data, there are no reliable automated mechanisms to verify the veracity of data from each source. Malware detection is arduous due to its malicious nature with the addition of metamorphic and polymorphic ability in the evolving samples. ML has proven to solve the zero-day malware detection problem, which is unresolved by traditional signature-based approaches. The poisoning of malware training data can allow the malware files to go undetected by the ML-based malware detectors, helping the attackers to fulfill their malicious goals. A feasibility analysis of the data poisoning threat in the malware detection domain is still lacking. Our work will focus on two major sections: training ML-based malware detectors and poisoning the training data using the label-poisoning approach. We will analyze the robustness of different machine learning models against data poisoning with varying volumes of poisoning data.

Software-Defined Wide Area Networks (SD-WANs) are used to provide services to enterprises with geographically dispersed locations in a flexible and efficient way. We focus on SD-WAN services based on the Segment Routing over IPv6 (SRv6) technology. Performance Monitoring solutions are needed in SD-WANs to detect performance degradation and outages, and optimize network operations. In this paper, we describe a high performance solution for end-to-end delay monitoring for SRv6 based SD-WAN services. The proposed solution leverages the Simple Two-way Active Measurement Protocol (STAMP) to monitor the delay of an SRv6 path between two nodes called STAMP Session-Sender and Session-Reflector. We describe three implementations of the STAMP Session-Sender and Session-Reflector for a Linux software router and compare their performance. In particular, two implementations are based on user space processing and one is based on eBPF. The results show that the eBPF-based implementation outperforms the user space implementations and has a negligible impact on the forwarding capacity of the Linux software router., Comment: Extended version of submitted paper

The success of scene graphs for visual scene understanding has brought attention to the benefits of abstracting a visual input (e.g., image) into a structured representation, where entities (people and objects) are nodes connected by edges specifying their relations. Building these representations, however, requires expensive manual annotation in the form of images paired with their scene graphs or frames. These formalisms remain limited in the nature of entities and relations they can capture. In this paper, we propose to leverage a widely-used meaning representation in the field of natural language processing, the Abstract Meaning Representation (AMR), to address these shortcomings. Compared to scene graphs, which largely emphasize spatial relationships, our visual AMR graphs are more linguistically informed, with a focus on higher-level semantic concepts extrapolated from visual input. Moreover, they allow us to generate meta-AMR graphs to unify information contained in multiple image descriptions under one representation. Through extensive experimentation and analysis, we demonstrate that we can re-purpose an existing text-to-AMR parser to parse images into AMRs. Our findings point to important future research directions for improved scene understanding., Comment: published in CoNLL 2022

Accurately classifying malware in an environment allows the creation of better response and remediation strategies by cyber analysts. However, classifying malware in a live environment is a difficult task due to the large number of system data sources. Collecting statistics from these separate sources and processing them together in a form that can be used by a machine learning model is difficult. Fortunately, all of these resources are mediated by the operating system's kernel. User programs, malware included, interacts with system resources by making requests to the kernel with system calls. Collecting these system calls provide insight to the interaction with many system resources in a single location. Feeding these system calls into a performant model such as a random forest allows fast, accurate classification in certain situations. In this paper, we evaluate the feasibility of using system call sequences for online malware classification in both low-activity and heavy-use Cloud IaaS. We collect system calls as they are received by the kernel and take n-gram sequences of calls to use as features for tree-based machine learning models. We discuss the performance of the models on baseline systems with no extra running services and systems under heavy load and the performance gap between them., Comment: Accepted at the IEEE 23rd International Conference on Information Reuse and Integration for Data Science

This primer is an attempt to provide a detailed summary of the different facets of lifelong learning. We start with Chapter 2 which provides a high-level overview of lifelong learning systems. In this chapter, we discuss prominent scenarios in lifelong learning (Section 2.4), provide 8 Introduction a high-level organization of different lifelong learning approaches (Section 2.5), enumerate the desiderata for an ideal lifelong learning system (Section 2.6), discuss how lifelong learning is related to other learning paradigms (Section 2.7), describe common metrics used to evaluate lifelong learning systems (Section 2.8). This chapter is more useful for readers who are new to lifelong learning and want to get introduced to the field without focusing on specific approaches or benchmarks. The remaining chapters focus on specific aspects (either learning algorithms or benchmarks) and are more useful for readers who are looking for specific approaches or benchmarks. Chapter 3 focuses on regularization-based approaches that do not assume access to any data from previous tasks. Chapter 4 discusses memory-based approaches that typically use a replay buffer or an episodic memory to save subset of data across different tasks. Chapter 5 focuses on different architecture families (and their instantiations) that have been proposed for training lifelong learning systems. Following these different classes of learning algorithms, we discuss the commonly used evaluation benchmarks and metrics for lifelong learning (Chapter 6) and wrap up with a discussion of future challenges and important research directions in Chapter 7., Comment: Lifelong Learning Primer