Search

Catalysts for warm cloud seeding have significant potential for applications in warm cloud catalytic precipitation and fog elimination. In recent years, numerous innovative materials have been developed, each with the potential to be used in warm cloud catalysis. However, a universally recognized ideal formulation has not yet been established. It is necessary to conduct a scientific analysis on the performance of various hygroscopic catalysts under consistent experimental conditions.Therefore, 9 types of typical powdered hygroscopic catalysts are collected, and experiments involving fog chamber and static testing of catalysts are conducted at CMA Key Laboratory of Cloud-precipitation Physics and Weather Modification in May 2023. Fog elimination capabilities and hygroscopic characteristics of various catalysts are comprehensively evaluated and compared. Results indicate that, under the same fog conditions, salt type catalysts demonstrate the shortest time to eliminate fog, and porous composite materials (PCM-100 and PCM-10) are also effective, while fog elimination effects of modified starch, molecular sieves, organic bentonite and sodium bentonite are not obvious after seeding. In static detection, under normal temperature and humidity conditions, CaCl2 exhibits the strongest static hygroscopicity, followed by porous composite materials such as PCM-100 and PCM-10. Composite salt catalysts exhibit strong hygroscopic absorption, whereas the static hygroscopic absorption capacity of other catalysts is not as pronounced. In high humidity conditions, bentonite and molecular sieve catalysts still do not exhibit moisture absorption characteristics. The hygroscopic abilities of CaCl2, PCM-100, and PCM-10 are significantly higher than those of other catalysts. The performance of various catalysts in the fog chamber experiment and static detection is basically consistent.Microstructures of various catalysts with strong hygroscopic properties do not show significant changes after 30 minutes. PCM-10 primarily exists in the form of liquid droplets after standing for 5 minutes and can continue to provide hydration. PCM-100 remains in irregular crystal form after 5 minutes and transforms into droplets after 30 minutes. CaCl2 absorbs moisture rapidly under the microscope, initially existing as liquid droplets for 5 minutes. Subsequently, there are no significant changes, primarily small droplets. Complex salts always form crystals, while the size of liquid droplets formed is larger.It should be noted that, although the hygroscopicity and the ability of fog elimination of various catalysts are important indicators, the dispersibility, corrosiveness and ease of preparation and storage of the catalyst are also important parameters of whether they can be used as efficient warm cloud catalysts. Follow-up research and evaluation of various catalysts will be conducted.

The first Android-ready "G1" phone debuted in late October 2008. Since then, the growth of Android malware has been explosive, analogous to the rise in the popularity of Android. The major positive aspect of Android is its open-source nature, which empowers app developers to expand their work. However, authors with malicious intentions pose grave threats to users. In the presence of such threats, Android malware detection is the need of an hour. Consequently, researchers have proposed various techniques involving static, dynamic, and hybrid analysis to address such threats to numerous features in the last decade. However, the feature that most researchers have extensively used to perform malware analysis and detection in Android security is Android permission. Hence, to provide a clarified overview of the latest and past work done in Android malware analysis and detection, we perform a comprehensive literature review using permissions as a central feature or in combination with other components by collecting and analyzing 205 studies from 2009 to 2023. We extracted information such as the choice opted by researchers between analysis or detection, techniques used to select or rank the permissions feature set, features used along with permissions, detection models employed, malware datasets used by researchers, and limitations and challenges in the field of Android malware detection to propose some future research directions. In addition, on the basis of the information extracted, we answer the six research questions designed considering the above factors. [ABSTRACT FROM AUTHOR]

Due to technical barriers and economic costs, malicious circuits, known as hardware Trojans, are easily implanted in the complicated integrated circuit design and manufacturing process, which can lead to many disastrous consequences, such as denial of service, information leakage, performance degradation, etc. Research on how to detecting hardware Trojans has grown into a significantly open issue over the past decade. While, for very large scale integrated circuits, numerous new challenges deserve our full attention, including golden-free chip reference, automatic feature engineering, hardware Trojan localization, and scalable framework. In response to the above challenges, a fine-grained gate-level hardware Trojan detection approach is proposed in this paper, named GateDet, from improving earlier circuit graph modeling to developing a detection framework based on Bidirectional Graph Convolution Networks with a timely information fusion strategy. GateDet achieves automatic feature circuit extraction and further overcomes the original neighborhood limitation of Bidirectional Graph Convolution Network. Moreover, for large-scale training, it comprehensively considers the problems of sample imbalance and boundary network, and develops a circuit directed graph sampling method based on GraphSAINT, which improves the training performance of the directed graph framework. From experiments, GateDet shows high scalability on 24 benchmarks of TrustHub. It could be used to learn about adaptive structural feature extraction for different Trojans simultaneously. Compared to the existing gate-level detections, the fine-grained results of GateDet are more accurate and can be used to track suspicious structures, reducing manual review.

Copyright of Journal of National University of Defense Technology / Guofang Keji Daxue Xuebao is the property of NUDT Press and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

In order to improve the detection accuracy of Android malware, a static detection method of Android malware based on LSTM-SVM (long short-term memory network-support vector machine) model is proposed. Firstly, by means of the APK (Android Package) file of decompilation Android software, three types of information, including permission, component and intent, are extracted from the AndroidManifest.xml file to form the XML features. Then, the API features are formed by analyzing the API (Application Programming Interface) called situation. By considering the timing and feature dimension of malware operation, LSTM anomaly detection model is constructed based on XML feature, meanwhile, SVM anomaly detection model is constructed based on API feature. The obtained models are parallelly undergone to obtain the final detection result via the probability difference fusion algorithm. Finally, the experimental results on CICAndMal2017 data set show that the detection accuracy of this proposed method can reach more than 98%. [ABSTRACT FROM AUTHOR]

In this study, Portable Document Format (PDF), Word, Excel, Rich Test format (RTF) and image documents are taken as the research objects to study a static and fast method by which to detect malicious documents. Malicious PDF and Word document features are abstracted and extended, which can be used to detect other types of documents. A universal static detection framework for malicious documents based on feature generalization is then proposed. The generalized features include specification check errors, the structure path, code keywords, and the number of objects. The proposed method is verified on two datasets, and is compared with Kaspersky, NOD32, and McAfee antivirus software. The experimental results demonstrate that the proposed method achieves good performance in terms of the detection accuracy, runtime, and scalability. The average F1-score of all types of documents is found to be 0.99, and the average detection time of a document is 0.5926 s, which is at the same level as the compared antivirus software. [ABSTRACT FROM AUTHOR]

Recently, there are various methods for detecting the hardware trojans (HTs) in the integrated circuits (ICs). The circuit's logic representations of different types, structures, and functional characteristics should be different. Each type of circuit has its' own performance characteristics according to its' purpose. However, the traditional HTs detection methods adopt the same approach to deal with the multi-purpose hardware trojan. At the same time, as the scale of integrated circuits growing, the structures are more complex, and the functions are more refined. The current situation makes the traditional HTs detection methods weaker and even unfeasible. Therefore, we propose an HTs classified locating method based on machine learning, named ML-HTCL, which belongs to the static detection and locating method. In ML-HTCL, different purpose HTs were represented by different features. Due to the different features, the ML-HTCL employs the multi-layer BP neural network for the control signal type HTs and the one-class SVM for the information leakage HTs, respectively. To deal with the HTs completely, the boundary nets are considered for all data set, while those were ignored by the most existing methods due to the high detection error rate. After detection, the HTs' precise locations were achieved. To evaluate the ML-HTCL, 17 gate-level netlist benchmarks are used for training and testing by leave-one-out cross-validation. From the results, the ML-HTCL reaches 85.05% of TPR and 73.91% of TNR for all kinds of HTs, which performs better than the most existing methods.

In this study, Portable Document Format (PDF), Word, Excel, Rich Test format (RTF) and image documents are taken as the research objects to study a static and fast method by which to detect malicious documents. Malicious PDF and Word document features are abstracted and extended, which can be used to detect other types of documents. A universal static detection framework for malicious documents based on feature generalization is then proposed. The generalized features include specification check errors, the structure path, code keywords, and the number of objects. The proposed method is verified on two datasets, and is compared with Kaspersky, NOD32, and McAfee antivirus software. The experimental results demonstrate that the proposed method achieves good performance in terms of the detection accuracy, runtime, and scalability. The average F1-score of all types of documents is found to be 0.99, and the average detection time of a document is 0.5926 s, which is at the same level as the compared antivirus software.

When the malicious code is detected by the current method, the features of the malicious code cannot be classified in detail. A static detection method of malicious code based on behavior information gain is proposed. The method uses the feature selection method of behavior information gain to get the average mutual information between different code types, and gives different types of feature libraries. On this basis, the character sets are fused and the sample characteristics of the malicious code are extracted. The dispersion degree of the sequence distribution of malicious code samples is measured, the distance vector of the plurality of eigenvectors is obtained, and the weighted matching of the features is performed. The malicious code is detected statically based on the matching result. The results demonstrated that the proposed method tends to be more accurate and provides a scientific basis for ensuring the security and stability of the Android operating system. [ABSTRACT FROM AUTHOR]

Due to technical barriers and economic costs, malicious circuits, known as hardware Trojans, are easily implanted in the complicated integrated circuit design and manufacturing process, which can lead to many disastrous consequences, such as denial of service, information leakage, performance degradation, etc. Research on how to detecting hardware Trojans has grown into a significantly open issue over the past decade. While, for very large scale integrated circuits, numerous new challenges deserve our full attention, including golden-free chip reference, automatic feature engineering, hardware Trojan localization, and scalable framework. In response to the above challenges, a fine-grained gate-level hardware Trojan detection approach is proposed in this paper, named GateDet, from improving earlier circuit graph modeling to developing a detection framework based on Bidirectional Graph Convolution Networks with a timely information fusion strategy. GateDet achieves automatic feature circuit extraction and further overcomes the original neighborhood limitation of Bidirectional Graph Convolution Network. Moreover, for large-scale training, it comprehensively considers the problems of sample imbalance and boundary network, and develops a circuit directed graph sampling method based on GraphSAINT, which improves the training performance of the directed graph framework. From experiments, GateDet shows high scalability on 24 benchmarks of TrustHub. It could be used to learn about adaptive structural feature extraction for different Trojans simultaneously. Compared to the existing gate-level detections, the fine-grained results of GateDet are more accurate and can be used to track suspicious structures, reducing manual review. [ABSTRACT FROM AUTHOR]

Android devices are currently widely used in many fields, such as automatic control, embedded systems, the Internet of Things and so on. At the same time, Android applications (apps) always use multiple permissions, and permissions can be abused by malicious apps that disclose users’ privacy or breach the secure storage of information. FlowDroid has been extensively studied as a novel and highly precise static taint analysis for Android applications. Aiming at the problem of complex detection and false alarms in FlowDroid, an improved static detection method based on feature permission and risk rating is proposed. Firstly, the Chi-square test is used to extract correlated permissions related to malicious apps, and mutual information is used to cluster the permissions to generate feature permission clusters. Secondly, risk calculation method based on permissions and combinations of permissions are proposed to identify dangerous data flows. Experiments show that this method can significantly improve detection efficiency while maintaining the accuracy of dangerous data flow detection.

In recent years, there is a rapid growth of malware on operators network. It severely threats security of mobile internet. Based on reviewing of existing malware protection technologies, mobile malware protection architecture including both network side and terminal side technology and their interaction mechanism was proposed. Some key implementation technologies for engineer's reference were also studied.

Recently, Android malicious code has increased dramatically and the technology of reinforcement is increasingly powerful. Due to the development of code obfuscation and polymorphic deformation technology, the current Android malicious code static detection method whose feature selected is the semantic of application source code can not completely extract malware's code features. The Android malware static detection methods whose features used are only obtained from the AndroidManifest.xml file are easily affected by useless permissions. Therefore, there are some limitations in current Android malware static detection methods. The current Android malware dynamic detection algorithm is mostly required to customize the system or needs system root permissions. Based on the Dendritic Cell Algorithm (DCA), this paper proposes an Android malware algorithm that has a higher detection rate, does not need to modify the system, and reduces the impact of code obfuscation to a certain degree. This algorithm is applied to an Android malware detection method based on oriented Dalvik disassembly sequence and application interface (API) calling sequence. Through the designed experiments, the effectiveness of this method is verified for the detection of Android malware. [ABSTRACT FROM AUTHOR]

The security and privacy issues of android system have attracted a lot of attention from both industry and academia in recent years. Static detection is one typical method to analyze malicious code. However, existing single static detection method can introduce high false alarm rate and is only appropriate for a limited scope. In this paper, we propose an integrated static detection framework, which consists of four layers of filtering mechanisms, that is, the message digest (MD5) values, the combination of malicious permissions, the dangerous permissions, and the dangerous intention, respectively. An intuitive threat-degree model is proposed especially on dangerous permissions detection. Furthermore, we implement a prototype system ASE and validate its feasibility, performance and scalability. A comprehensive evaluation shows that the proposed framework has obvious advantages especially in efficiency, granularity, layers, and correctness. [ABSTRACT FROM AUTHOR]

JavaScript language, through its dynamic feature, provides user interactivity with websites. It also pose serious security threats to both user and website. On top of this, obfuscation is widely used to hide its malicious purpose and to evade the detection of antivirus software. Malware embedded in web pages is regularly used as part of targeted attacks. To hinder detection by antivirus scanners, the malicious code is usually obfuscated, often with encodings like hexadecimal, unicode, base64, escaped characters and rarely with substitution ciphers like Vigenere, Caesar and Atbash. The malicious iframes are injected to the websites using JavaScript and are also made hidden from the users perspective in-order to prevent detection. To defend against obfuscated malicious JavaScript code, we propose a mostly static approach called, AMA, Amrita Malware Analyzer, a framework capable of detecting the presence of malicious code through static code analysis of web page. To this end, the framework performs probable plaintext attack using strings likely contained in malicious web pages. But this approach targets only few among many possible obfuscation strategies. The evaluation based on the links provided in the Malware domain list demonstrates high level accuracy [ABSTRACT FROM AUTHOR]

Android devices are currently widely used in many fields, such as automatic control, embedded systems, the Internet of Things and so on. At the same time, Android applications (apps) always use multiple permissions, and permissions can be abused by malicious apps that disclose users' privacy or breach the secure storage of information. FlowDroid has been extensively studied as a novel and highly precise static taint analysis for Android applications. Aiming at the problem of complex detection and false alarms in FlowDroid, an improved static detection method based on feature permission and risk rating is proposed. Firstly, the Chi-square test is used to extract correlated permissions related to malicious apps, and mutual information is used to cluster the permissions to generate feature permission clusters. Secondly, risk calculation method based on permissions and combinations of permissions are proposed to identify dangerous data flows. Experiments show that this method can significantly improve detection efficiency while maintaining the accuracy of dangerous data flow detection. [ABSTRACT FROM AUTHOR]