Search

This Research proposes a Novel Reinforcement Learning (RL) model to optimise malware forensics investigation during cyber incident response. It aims to improve forensic investigation efficiency by reducing false negatives and adapting current practices to evolving malware signatures. The proposed RL framework leverages techniques such as Q-learning and the Markov Decision Process (MDP) to train the system to identify malware patterns in live memory dumps, thereby automating forensic tasks. The RL model is based on a detailed malware workflow diagram that guides the analysis of malware artefacts using static and behavioural techniques as well as machine learning algorithms. Furthermore, it seeks to address challenges in the UK justice system by ensuring the accuracy of forensic evidence. We conduct testing and evaluation in controlled environments, using datasets created with Windows operating systems to simulate malware infections. The experimental results demonstrate that RL improves malware detection rates compared to conventional methods, with the RL model's performance varying depending on the complexity and learning rate of the environment. The study concludes that while RL offers promising potential for automating malware forensics, its efficacy across diverse malware types requires ongoing refinement of reward systems and feature extraction methods., Comment: 8 pages. arXiv admin note: substantial text overlap with arXiv:2408.01999

Although wave kinetic equations have been rigorously derived in dimension $d \geq 2$, both the physical and mathematical theory of wave turbulence in dimension $d = 1$ is less understood. Here, we look at the one-dimensional MMT (Majda, McLaughlin, and Tabak) model on a large interval of length $L$ with nonlinearity of size $\alpha$, restricting to the case where there are no derivatives in the nonlinearity. The dispersion relation here is $|k|^\sigma$ for $0 < \sigma \leq 2$ and $\sigma \neq 1$, and when $\sigma = 2$, the MMT model specializes to the cubic nonlinear Schr\"odinger (NLS) equation. In the range of $1 < \sigma \leq 2$, the proposed collision kernel in the kinetic equation is trivial, begging the question of what is the appropriate kinetic theory in that setting. In this paper we study the kinetic limit $L \to \infty$ and $\alpha \to 0$ under various scaling laws $\alpha \sim L^{-\gamma}$ and exhibit the wave kinetic equation up to timescales $T \sim L^{-\epsilon}\alpha^{-\frac{5}{4}}$ (or $T \sim L^{-\epsilon} T_{\mathrm{kin}}^{\frac{5}{8}}$). In the case of a trivial collision kernel, our result implies there can be no nontrivial dynamics of the second moment up to timescales $T_{\mathrm{kin}}$., Comment: 45 pages, 16 figures

Canopy fuels and surface fuel models, topographic features and other canopy attributes such as stand height and canopy cover, provide the necessary spatial datasets required by various fire behaviour modelling simulators. This is a technical note reporting on a pan-European fuel map server, highlighting the methods for the production and validation of canopy features, more specifically canopy fuels, and surface fuel models created for the European Union Horizon 2020 FIRE-RES project, as well as other related data derived from earth observation. The aim was to deliver a fuel cartography in a findable, accessible, interoperable and replicable manner as per F.A.I.R. guiding principles for research data stewardship. We discuss the technology behind sharing large raster datasets via web-GIS technologies and highlight advances and novelty of the shared data. Uncertainty maps related to the canopy fuel variables are also available to give users the expected reliability of the data. Users can view, query and download single layers of interest, or download the whole pan-European dataset. All layers are in raster format and co-registered in the same reference system, extent and spatial resolution (100 m). Viewing and downloading is available at all NUTS scales, ranging from country level (NUTS0) to province level (NUTS3), thus facilitating data management and access. The system was implemented using R for part of the processing and Google Earth Engine. The final app is openly available to the public for accessing the data at various scales.

This research focused on enhancing post-incident malware forensic investigation using reinforcement learning RL. We proposed an advanced MDP post incident malware forensics investigation model and framework to expedite post incident forensics. We then implement our RL Malware Investigation Model based on structured MDP within the proposed framework. To identify malware artefacts, the RL agent acquires and examines forensics evidence files, iteratively improving its capabilities using Q Table and temporal difference learning. The Q learning algorithm significantly improved the agent ability to identify malware. An epsilon greedy exploration strategy and Q learning updates enabled efficient learning and decision making. Our experimental testing revealed that optimal learning rates depend on the MDP environment complexity, with simpler environments benefiting from higher rates for quicker convergence and complex ones requiring lower rates for stability. Our model performance in identifying and classifying malware reduced malware analysis time compared to human experts, demonstrating robustness and adaptability. The study highlighted the significance of hyper parameter tuning and suggested adaptive strategies for complex environments. Our RL based approach produced promising results and is validated as an alternative to traditional methods notably by offering continuous learning and adaptation to new and evolving malware threats which ultimately enhance the post incident forensics investigations., Comment: v1.1

We have applied an operator-overloading forward-mode algorithmic differentiation tool to the Monte-Carlo particle simulation toolkit Geant4. Our differentiated version of Geant4 allows computing mean pathwise derivatives of user-defined outputs of Geant4 applications with respect to user-defined inputs. This constitutes a major step towards enabling gradient-based optimization techniques in high-energy physics, as well as other application domains of Geant4. This is a preliminary report on the technical aspects of applying operator-overloading AD to Geant4, as well as a first analysis of some results obtained by our differentiated Geant4 prototype. We plan to follow up with a more refined analysis.

Among the well-known methods to approximate derivatives of expectancies computed by Monte-Carlo simulations, averages of pathwise derivatives are often the easiest one to apply. Computing them via algorithmic differentiation typically does not require major manual analysis and rewriting of the code, even for very complex programs like simulations of particle-detector interactions in high-energy physics. However, the pathwise derivative estimator can be biased if there are discontinuities in the program, which may diminish its value for applications. This work integrates algorithmic differentiation into the electromagnetic shower simulation code HepEmShow based on G4HepEm, allowing us to study how well pathwise derivatives approximate derivatives of energy depositions in a sampling calorimeter with respect to parameters of the beam and geometry. We found that when multiple scattering is disabled in the simulation, means of pathwise derivatives converge quickly to their expected values, and these are close to the actual derivatives of the energy deposition. Additionally, we demonstrate the applicability of this novel gradient estimator for stochastic gradient-based optimization in a model example., Comment: 12 pages, 11 figures, 2 tables

Detecting out of policy speech (OOPS) content is important but difficult. While machine learning is a powerful tool to tackle this challenging task, it is hard to break the performance ceiling due to factors like quantity and quality limitations on training data and inconsistencies in OOPS definition and data labeling. To realize the full potential of available limited resources, we propose a meta learning technique (MLT) that combines individual models built with different text representations. We analytically show that the resulting technique is numerically stable and produces reasonable combining weights. We combine the MLT with a threshold-moving (TM) technique to further improve the performance of the combined predictor on highly-imbalanced in-distribution and out-of-distribution datasets. We also provide computational results to show the statistically significant advantages of the proposed MLT approach. All authors contributed equally to this work., Comment: 22 pages, including 5 figures, 12 tables, 1 appendix

In this paper we formulate some conjectures in sub-Riemannian geometry concerning a characterisation of the Koranyi-Kaplan ball in a group of Heisenberg type through the existence of a solution to suitably overdetermined problems. We prove an integral identity that provides a rigidity constraint for one of the two problems. By exploiting some new invariances of these Lie groups, for domains having partial symmetry we solve these problems by converting them to known results for the classical $p$-Laplacian

In the dynamic landscape of digital forensics, the integration of Artificial Intelligence (AI) and Machine Learning (ML) stands as a transformative technology, poised to amplify the efficiency and precision of digital forensics investigations. However, the use of ML and AI in digital forensics is still in its nascent stages. As a result, this paper gives a thorough and in-depth analysis that goes beyond a simple survey and review. The goal is to look closely at how AI and ML techniques are used in digital forensics and incident response. This research explores cutting-edge research initiatives that cross domains such as data collection and recovery, the intricate reconstruction of cybercrime timelines, robust big data analysis, pattern recognition, safeguarding the chain of custody, and orchestrating responsive strategies to hacking incidents. This endeavour digs far beneath the surface to unearth the intricate ways AI-driven methodologies are shaping these crucial facets of digital forensics practice. While the promise of AI in digital forensics is evident, the challenges arising from increasing database sizes and evolving criminal tactics necessitate ongoing collaborative research and refinement within the digital forensics profession. This study examines the contributions, limitations, and gaps in the existing research, shedding light on the potential and limitations of AI and ML techniques. By exploring these different research areas, we highlight the critical need for strategic planning, continual research, and development to unlock AI's full potential in digital forensics and incident response. Ultimately, this paper underscores the significance of AI and ML integration in digital forensics, offering insights into their benefits, drawbacks, and broader implications for tackling modern cyber threats., Comment: version 2 post peer review Forensic Science International Digital Investigation

The main goal of this paper is to extend [J. Algebra Appl. 20 (2021), 2150074] to generalized quaternion algebras, even when these algebras are not necessarily division rings. More precisely, in such cases, the image of a multilinear polynomial evaluated on a quaternion algebra is a vector space and we additionally provide a classification of possible images., Comment: One new section is added, namely Section 3, and thus the paper is now 18 pages

Research in high energy physics (HEP) requires huge amounts of computing and storage, putting strong constraints on the code speed and resource usage. To meet these requirements, a compiled high-performance language is typically used; while for physicists, who focus on the application when developing the code, better research productivity pleads for a high-level programming language. A popular approach consists of combining Python, used for the high-level interface, and C++, used for the computing intensive part of the code. A more convenient and efficient approach would be to use a language that provides both high-level programming and high-performance. The Julia programming language, developed at MIT especially to allow the use of a single language in research activities, has followed this path. In this paper the applicability of using the Julia language for HEP research is explored, covering the different aspects that are important for HEP code development: runtime performance, handling of large projects, interface with legacy code, distributed computing, training, and ease of programming. The study shows that the HEP community would benefit from a large scale adoption of this programming language. The HEP-specific foundation libraries that would need to be consolidated are identified, Comment: 32 pages, 5 figures, 4 tables

In these notes, using the method of differential constraints, novel exact kink-like solutions are obtained for certain classes of complex Ginzburg--Landau equations with cubic-quintic nonlinearity. The foregoing solutions are presented in terms of the Lambert W function., Comment: 6 pages, 1 figure

As we reach the limit of Moore's Law, researchers are exploring different paradigms to achieve unprecedented performance. Approximate Computing (AC), which relies on the ability of applications to tolerate some error in the results to trade-off accuracy for performance, has shown significant promise. Despite the success of AC in domains such as Machine Learning, its acceptance in High-Performance Computing (HPC) is limited due to stringent requirements for accuracy. We need tools and techniques to identify regions of code that are amenable to approximations and their impact on the application output quality to guide developers to employ selective approximation. To this end, we propose CHEF-FP, a flexible, scalable, and easy-to-use source-code transformation tool based on Automatic Differentiation (AD) for analyzing approximation errors in HPC applications. CHEF-FP uses Clad, an efficient AD tool built as a plugin to the Clang compiler and based on the LLVM compiler infrastructure, as a backend and utilizes its AD abilities to evaluate approximation errors in C++ code. CHEF-FP works at the source by injecting error estimation code into the generated adjoints. This enables the error-estimation code to undergo compiler optimizations resulting in improved analysis time and reduced memory usage. We also provide theoretical and architectural augmentations to source code transformation-based AD tools to perform FP error analysis. This paper primarily focuses on analyzing errors introduced by mixed-precision AC techniques. We also show the applicability of our tool in estimating other kinds of errors by evaluating our tool on codes that use approximate functions. Moreover, we demonstrate the speedups CHEF-FP achieved during analysis time compared to the existing state-of-the-art tool due to its ability to generate and insert approximation error estimate code directly into the derivative source., Comment: 11 pages, to appear in the 2023 IEEE International Parallel and Distributed Processing Symposium (IPDPS'23)

The simplicity of Python and the power of C++ force stark choices on a scientific software stack. There have been multiple developments to mitigate language boundaries by implementing language bindings, but the impedance mismatch between the static nature of C++ and the dynamic one of Python hinders their implementation; examples include the use of user-defined Python types with templated C++ and advanced memory management. The development of the C++ interpreter Cling has changed the way we can think of language bindings as it provides an incremental compilation infrastructure available at runtime. That is, Python can interrogate C++ on demand, and bindings can be lazily constructed at runtime. This automatic binding provision requires no direct support from library authors and offers better performance than alternative solutions, such as PyBind11. ROOT pioneered this approach with PyROOT, which was later enhanced with its successor, cppyy. However, until now, cppyy relied on the reflection layer of ROOT, which is limited in terms of provided features and performance. This paper presents the next step for language interoperability with cppyy, enabling research into uniform cross-language execution environments and boosting optimization opportunities across language boundaries. We illustrate the use of advanced C++ in Numba-accelerated Python through cppyy. We outline a path forward for re-engineering parts of cppyy to use upstream LLVM components to improve performance and sustainability. We demonstrate cppyy purely based on a C++ reflection library, InterOp, which offers interoperability primitives based on Cling and Clang-Repl., Comment: 7 pages, 3 figures, 1 table; submitted to ACAT 2022 proceedings

RooFit is a toolkit for statistical modeling and fitting used by most experiments in particle physics. Just as data sets from next-generation experiments grow, processing requirements for physics analysis become more computationally demanding, necessitating performance optimizations for RooFit. One possibility to speed-up minimization and add stability is the use of Automatic Differentiation (AD). Unlike for numerical differentiation, the computation cost scales linearly with the number of parameters, making AD particularly appealing for statistical models with many parameters. In this paper, we report on one possible way to implement AD in RooFit. Our approach is to add a facility to generate C++ code for a full RooFit model automatically. Unlike the original RooFit model, this generated code is free of virtual function calls and other RooFit-specific overhead. In particular, this code is then used to produce the gradient automatically with Clad. Clad is a source transformation AD tool implemented as a plugin to the clang compiler, which automatically generates the derivative code for input C++ functions. We show results demonstrating the improvements observed when applying this code generation strategy to HistFactory and other commonly used RooFit models. HistFactory is the subcomponent of RooFit that implements binned likelihood models with probability densities based on histogram templates. These models frequently have a very large number of free parameters and are thus an interesting first target for AD support in RooFit., Comment: 6 pages, 5 figures, 21st International Workshop on Advanced Computing and Analysis Techniques in Physics Research

Expanding on the work of Kemp, Ratliff and Shah, for any closure ${\rm cl}$ defined on a class of modules over a Noetherian ring, we develop the theory of ${\rm cl}$-prereductions of submodules. For any interior ${\rm i}$ on a class of $R$-modules, we also develop the theory of {\rm i}-postexpansions. Using the duality of Epstein, R.G. and Vassilev, we show that if ${\rm i}$ is the interior dual to ${\rm cl}$, then these notions are in fact dual to each other. We consider the ${\rm cl}$-precore (${\rm i}$-postcore), the intersection of all ${\rm cl}$-prereductions ${\rm i}$-postexpansions) of a submodule and the ${\rm cl}$-prehull (${\rm i}$-posthull), the sum of all ${\rm cl}$-prereductions (${\rm i}$-postexpansions) of a submodule and give comparisons with the ${\rm cl}$-core (${\rm i}$-hull). We further give a classification of ${\rm cl}$-prereductions of ${\rm cl}$-closed ideals of a Noetherian ring where ${\rm cl}$ is a closure with a special part., Comment: 26 pages, 2 figures

There are several ways to convert a closure or interior operation to a different operation that has particular desirable properties. In this paper, we axiomatize 3 ways to do so, drawing on disparate examples from the literature, including tight closure, basically full closure, and various versions of integral closure. In doing so, we explore several such desirable properties, including *hereditary*, *residual*, and *cofunctorial*, and see how they interact with other properties such as the *finitistic* property., Comment: Accepted version. 56 pages

The ALICE ITS3 (Inner Tracking System 3) upgrade project and the CERN EP R&D on monolithic pixel sensors are investigating the feasibility of the Tower Partners Semiconductor Co. 65 nm process for use in the next generation of vertex detectors. The ITS3 aims to employ wafer-scale Monolithic Active Pixel Sensors thinned down to 20 to 40 um and bent to form truly cylindrical half barrels. Among the first critical steps towards the realisation of this detector is to validate the sensor technology through extensive characterisation both in the laboratory and with in-beam measurements. The Digital Pixel Test Structure (DPTS) is one of the prototypes produced in the first sensor submission in this technology and has undergone a systematic measurement campaign whose details are presented in this article. The results confirm the goals of detection efficiency and non-ionising and ionising radiation hardness up to the expected levels for ALICE ITS3 and also demonstrate operation at +20 C and a detection efficiency of 99% for a DPTS irradiated with a dose of $10^{15}$ 1 MeV n$_{\mathrm{eq}}/$cm$^2$. Furthermore, spatial, timing and energy resolutions were measured at various settings and irradiation levels., Comment: v4: Corrected Table 1. v3: Implemented reviewers' comments. v2: Updated threshold calibration method. Implemented colorblind friendly color palette in all figures. Updated references

The second workshop on the HEP Analysis Ecosystem took place 23-25 May 2022 at IJCLab in Orsay, to look at progress and continuing challenges in scaling up HEP analysis to meet the needs of HL-LHC and DUNE, as well as the very pressing needs of LHC Run 3 analysis. The workshop was themed around six particular topics, which were felt to capture key questions, opportunities and challenges. Each topic arranged a plenary session introduction, often with speakers summarising the state-of-the art and the next steps for analysis. This was then followed by parallel sessions, which were much more discussion focused, and where attendees could grapple with the challenges and propose solutions that could be tried. Where there was significant overlap between topics, a joint discussion between them was arranged. In the weeks following the workshop the session conveners wrote this document, which is a summary of the main discussions, the key points raised and the conclusions and outcomes. The document was circulated amongst the participants for comments before being finalised here.

This article concerns monomial ideals fixed by differential operators of affine semi-group rings over $\mathbb{C}$. We give a complete characterization of when this happens. Perhaps surprisingly, every monomial ideal is fixed by an infinite set of homogeneous differential operators and is in fact determined by them. This opens up a new tool for studying monomial ideals. We explore applications of this to (mixed) multiplier ideals and other variants as well as give examples of detecting ideal membership in integrally closed powers and symbolic powers of squarefree monomial ideals.

In this paper we establish the sharp asymptotic decay of positive solutions of the Yamabe type equation $\frlap u=u^{\frac{Q+2s}{Q-2s}}$ in a homogeneous Lie group, where $\frlap$ represents a suitable pseudodifferential operator modelled on a class of nonlocal operators arising in conformal CR geometry.

Corrigenda to "$L^p$ estimates and asymptotic behavior for finite energy solutions of extremals to Hardy-Sobolev inequalities", Trans. Amer. Math. Soc. 363 (2011), no. 1, 37--62.

Global machine learning force fields (MLFFs), that have the capacity to capture collective many-atom interactions in molecular systems, currently only scale up to a few dozen atoms due a considerable growth of the model complexity with system size. For larger molecules, locality assumptions are typically introduced, with the consequence that non-local interactions are poorly or not at all described, even if those interactions are contained within the reference ab initio data. Here, we approach this challenge and develop an exact iterative parameter-free approach to train global symmetric gradient domain machine learning (sGDML) force fields for systems with up to several hundred atoms, without resorting to any localization of atomic interactions or other potentially uncontrolled approximations. This means that all atomic degrees of freedom remain fully correlated in the global sGDML FF, allowing the accurate description of complex molecules and materials that present phenomena with far-reaching characteristic correlation lengths. We assess the accuracy and efficiency of our MLFFs on a newly developed MD22 benchmark dataset containing molecules from 42 to 370 atoms. The robustness of our approach is demonstrated in nanosecond long path-integral molecular dynamics simulations for the supramolecular complexes in the MD22 dataset.

Machine learning force fields (MLFFs) are gradually evolving towards enabling molecular dynamics simulations of molecules and materials with ab initio accuracy but at a small fraction of the computational cost. However, several challenges remain to be addressed to enable predictive MLFF simulations of realistic molecules, including: (1) developing efficient descriptors for non-local interatomic interactions, which are essential to capture long-range molecular fluctuations, and (2) reducing the dimensionality of the descriptors in kernel methods (or a number of parameters in neural networks) to enhance the applicability and interpretability of MLFFs. Here we propose an automatized approach to substantially reduce the number of interatomic descriptor features while preserving the accuracy and increasing the efficiency of MLFFs. To simultaneously address the two stated challenges, we illustrate our approach on the example of the global GDML MLFF; however, our methodology can be equally applied to other models. We found that non-local features (atoms separated by as far as 15$~\r{A}$ in studied systems) are crucial to retain the overall accuracy of the MLFF for peptides, DNA base pairs, fatty acids, and supramolecular complexes. Interestingly, the number of required non-local features in the reduced descriptors becomes comparable to the number of local interatomic features (those below 5$~\r{A}$). These results pave the way to constructing global molecular MLFFs whose cost increases linearly, instead of quadratically, with system size.

ROOT is high energy physics' software for storing and mining data in a statistically sound way, to publish results with scientific graphics. It is evolving since 25 years, now providing the storage format for more than one exabyte of data; virtually all high energy physics experiments use ROOT. With another significant increase in the amount of data to be handled scheduled to arrive in 2027, ROOT is preparing for a massive upgrade of its core ingredients. As part of a review of crucial software for high energy physics, the ROOT team has documented its R&D plans for the coming years.

This document discusses the state, roadmap, and risks of the foundational components of ROOT with respect to the experiments at the HL-LHC (Run 4 and beyond). As foundational components, the document considers in particular the ROOT input/output (I/O) subsystem. The current HEP I/O is based on the TFile container file format and the TTree binary event data format. The work going into the new RNTuple event data format aims at superseding TTree, to make RNTuple the production ROOT event data I/O that meets the requirements of Run 4 and beyond.