Publikace

Článek

10.1007/s11416-024-00519-z

Machine learning has proven to be a valuable tool for automated malware detection, but machine learning systems have also been shown to be subject to adversarial attacks. This paper summarizes and compares related work on generating adversarial malware samples, specifically malicious Windows Portable Executable files. In contrast with previous research, we not only compare generators of adversarial malware examples theoretically, but we also provide an experimental comparison and evaluation for practical usability. We use gradient-based, evolutionary-based, and reinforcement-based approaches to create adversarial samples, which we test against selected antivirus products. The results show that applying optimized modifications to previously detected malware can lead to incorrect classification of the file as benign. Moreover, generated malicious samples can be effectively employed against detection models other than those used to produce them, and combinations of methods can construct new instances that avoid detection. Based on our findings, the Gym-malware generator, which uses reinforcement learning, has the greatest practical potential. This generator has the fastest average sample production time of 5.73 s and the highest average evasion rate of 44.11%. Using the Gym-malware generator in combination with itself further improved the evasion rate to 58.35%. However, other tested methods scored significantly lower in our experiments than reported in the original publications, highlighting the importance of a standardized evaluation environment.

Článek

10.1103/PhysRevC.109.014616

We combine the ab initio symmetry-adapted no-core shell model (SA-NCSM) with the single-particle Green's function approach to construct optical potentials rooted in first principles. Specifically, we show that total cross sections and phase shifts for neutron elastic scattering from a 4He target with projectile energies between 0.5 and 10 MeV closely reproduce the experiment. In addition, we discuss an important new development that resolves a long-standing issue with spurious center-of-mass motion in the Green's function formalism for many-body approaches. The new development opens a path for first-principle predictions of cross sections for elastic scattering of single-nucleon projectiles, nucleon capture, and deuteron breakup reactions, feasible for a broad range of open-shell spherical and deformed nuclei in the SA-NCSM approach.

Stať ve sborníku

10.5220/0012385600003636

This paper addresses exact approaches to multi-agent collective construction problem which tasks a group of cooperative agents to build a given structure in a blocksworld under the gravity constraint. We propose a generalization of the existing exact model based on mixed integer linear programming by accommodating varying agent action durations. We refer to the model as a fraction-time model. The introduction of action durations enables one to create a more realistic model for various domains. It provides a significant reduction of plan execution duration at the cost of increased computational time, which rises steeply the closer the model gets to the exact real-world action duration. We also propose a makespan estimation function for the fraction-time model. This can be used to estimate the construction time reduction size for cost-benefit analysis. The fraction-time model and the makespan estimation function have been evaluated in a series of experiments using a set of benchmark st ructures. The results show a significant reduction of plan execution duration for non-constant duration actions due to decreasing synchronization overhead at the end of each action. According to the results, the makespan estimation function provides a reasonably accurate estimate of the makespan.

Stať ve sborníku

10.1109/DDECS60919.2024.10508927

Neural networks with quantized activation functions cannot adapt the quantization at the input of their first layer. Preprocessing is therefore required to adapt the range of input data to the quantization range. Such preprocessing usually includes an activation-wise linear transformation and is steered by the properties of the training set. We suggest to include the linear transform into the training process. We document that it improves accuracy, requires the same resources as standard preprocessing, plays a role in network pruning, and is reasonably stable with respect to initialization.

Článek

10.1016/j.dam.2023.11.021

The average-case complexity of a branch-and-bound algorithm for MIN DOMINATING SET problem in random graphs in the G(n, p) model is studied. We identify phase transitions between subexponential and exponential average-case complexities, depending on the growth of the probability p with respect to the number n of nodes. (c) 2023 Elsevier B.V. All rights reserved.

Článek

10.1007/s11416-024-00513-5

A large amount of new malware is constantly being generated, which must not only be distinguished from benign samples, but also classified into malware families. For this purpose, investigating how existing malware families are developed and examining emerging families need to be explored. This paper focuses on the online processing of incoming malicious samples to assign them to existing families or, in the case of samples from new families, to cluster them. We experimented with seven prevalent malware families from the EMBER dataset, four in the training set and three additional new families in the test set. The features were extracted by static analysis of portable executable files for the Windows operating system. Based on the classification score of the multilayer perceptron, we determined which samples would be classified and which would be clustered into new malware families. We classified 97.21% of streaming data with a balanced accuracy of 95.33%. Then, we clustered the remaining data using a self-organizing map, achieving a purity from 47.61% for four clusters to 77.68% for ten clusters. These results indicate that our approach has the potential to be applied to the classification and clustering of zero-day malware into malware families.

Článek

10.1007/s11416-024-00516-2

Because of its world-class results, machine learning (ML) is becoming increasingly popular as a go-to solution for many tasks. As a result, antivirus developers are incorporating ML models into their toolchains. While these models improve malware detection capabilities, they also carry the disadvantage of being susceptible to adversarial attacks. Although this vulnerability has been demonstrated for many models in white-box settings, a black-box scenario is more applicable in practice for the domain of malware detection. We present a method of creating adversarial malware examples using reinforcement learning algorithms. The reinforcement learning agents utilize a set of functionality-preserving modifications, thus creating valid adversarial examples. Using the proximal policy optimization (PPO) algorithm, we achieved an evasion rate of 53.84% against the gradient-boosted decision tree (GBDT) detector. The PPO agent previously trained against the GBDT classifier scored an evasion rate of 11.41% against the neural network-based classifier MalConv and an average evasion rate of 2.31% against top antivirus programs. Furthermore, we discovered that random application of our functionality-preserving portable executable modifications successfully evades leading antivirus engines, with an average evasion rate of 11.65%. These findings indicate that ML-based models used in malware detection systems are sensitive to adversarial attacks and that better safeguards need to be taken to protect these systems.

Článek

10.1007/s10844-023-00809-w

Along with the ongoing digitalization of society, we witness a strong movement to make scientific data FAIR, machine-actionable, and available in the form of knowledge graphs. On the other hand, converting machine-actionable data from knowledge graphs back into human-oriented formats, including documents, graphical, or voice user interfaces, poses significant challenges. The solutions often build on various templates tailored to specific platforms on top of the shared underlying data. These templates suffer from limited reusability, making their adaptations difficult. Moreover, the continuous evolution of data or technological advancements requires substantial efforts to maintain these templates over time. In general, these challenges increase software development costs and are error-prone. In this paper, we propose a solution based on Normalized Systems Theory to address this challenge with the aim of achieving evolvability and sustainability in the transformation process of knowledge graphs into human-oriented formats with broad applicability across domains and technologies. We explain the theoretical foundation and design theorems used in our solution and outline the approach and implementation details. We theoretically evaluate our solution by comparing it to the traditional approach, where the systems are crafted manually. The evaluation shows that our solution is more efficient and effective on a large scale, reducing the human labor required to maintain various templates and supported target platforms. Next, we demonstrate the technical feasibility of our solution on a proof-of-concept implementation in a domain of data management planning that may also serve as a basis for future development.

Stať ve sborníku

In the Multiagent Path Finding (MAPF for short) problem, we focus on efficiently finding non-colliding paths for a set of k agents on a given graph G, where each agent seeks a path from its source vertex to a target. An important measure of the quality of the solution is the length of the proposed schedule l, that is, the length of a longest path (including the waiting time). In this work, we propose a systematic study under the parameterized complexity framework. The hardness results we provide align with many heuristics used for this problem, whose running time could potentially be improved based on our Fixed-Parameter Tractability (FPT) results. We show that MAPF is W[1]-hard with respect to k (even if k is combined with the maximum degree of the input graph). The problem remains NP-hard in planar graphs even if the maximum degree and the makespan l are fixed constants. On the positive side, we show an FPT algorithm for k+l. As we continue, the structure of G comes into play. We give an FPT algorithm for parameter k plus the diameter of the graph G. The MAPF problem is W[1]-hard for cliquewidth of G plus l while it is FPT for treewidth of G plus l.

Článek

10.1016/j.comgeo.2023.102055

A framework, which is a (possibly infinite) graph with a realization of its vertices in the plane, is called flexible if it can be continuously deformed while preserving the edge lengths. We focus on flexibility of frameworks in which 4-cycles form parallelograms. For the class of frameworks considered in this paper (allowing triangles), we prove that the following are equivalent: flexibility, infinitesimal flexibility, the existence of at least two classes of an equivalence relation based on 3- and 4-cycles and being a non -trivial subgraph of the Cartesian product of graphs. We study the algorithmic aspects and the rotationally symmetric version of the problem. The results are illustrated on frameworks obtained from tessellations by regular polygons.

Článek

10.17815/cd.2024.162

Heterogeneous crowd consisting of pedestrians with essentially diverse abilities behaves in certain aspects differently than a homogeneous crowd consisting of "average" pedestrians. This study investigates the influence of heterogeneity in aspects connected to the ability to navigate through a crowd in front of a bottleneck. Simulations of cellular multi-agent model suggest that the heterogeneity in ability to push through the crowd (represented by aggressiveness) and willingness to bypass the crowd (represented by sensitivity to occupation) may be responsible for the bottleneck flow decreasing in time – a phenomenon observed in experiments.

Článek

10.1088/1751-8121/ad4936

This article is a contribution to the classification of quadratically integrable systems with vector potentials whose integrals are of the nonstandard, nonseparable type. We focus on generalized parabolic cylindrical case, related to non-subgroup-type coordinates. We find three new systems, two with magnetic fields polynomial in Cartesian coordinates and one with unbounded exponential terms. The limit in the parameters of the integrals yields a new parabolic cylindrical system; the limit of vanishing magnetic fields leads to the free motion. This confirms the conjecture that non-subgroup type integrals can be related to separable systems only in a trivial manner.

Článek

10.1088/1751-8121/ad45cd

We construct integrable Hamiltonian systems with magnetic fields of the ellipsoidal, paraboloidal and conical type, i.e. systems that generalize natural Hamiltonians separating in the respective coordinate systems to include nonvanishing magnetic field. In the ellipsoidal and paraboloidal case each this classification results in three one-parameter families of systems, each involving one arbitrary function of a single variable and a parameter specifying the strength of the magnetic field of the given fully determined form. In the conical case the results are more involved, there are two one-parameter families like in the other cases and one class which is less restrictive and so far resists full classification.

Stať ve sborníku

10.1609/aaai.v38i21.30514

Modern machine learning heavily relies on optimization, and as deep learning models grow more complex and data-hungry, the search for efficient learning becomes crucial. Learned optimizers disrupt traditional handcrafted methods such as SGD and Adam by learning the optimization strategy itself, potentially speeding up training. However, the learned optimizers' dynamics are still not well understood. To remedy this, our work explores their optimization trajectories from the perspective of network architecture symmetries and proposed parameter update distributions.

Článek

10.1093/ptep/ptae054

Poisson-Lie T-duality/plurality was recently generalized to Jacobi-Lie T-plurality formulated in terms of Double Field Theory and based on Leibniz algebras given by structure coefficients $f_{ab}{}^{c}, f_{c}{}^{ab},$ and $Z_a, Z^a$. We investigate three- and four-dimensional sigma models corresponding to six-dimensional Leibniz algebras with $f_b{}^{ba} \neq 0$, $Z^a=0$. We show that these algebras are plural one to another and, moreover, to an algebra with $f_b{}^{ba}= 0$, $Z^a=0$. These pluralities are used for construction of Jacobi--Lie models. It was conjectured that plural models should satisfy generalized supergravity equations. We have found examples of models satisfying ``true'' generalized supergravity equations where no trivialization to usual supergravity equations s is possible. On the other hand, we show that there are also models corresponding to algebras with $f_b{}^{ba}\neq 0$, $Z^a=0$ where the Killing vector appearing in generalized supergravity equations either vanishes or can be removed by suitable gauge transformation. Such models then satisfy usual supergravity equations, i.e. vanishing beta-function equations.

Stať ve sborníku

10.1007/978-3-031-56326-3_22

High-quality datasets are an essential requirement for leveraging machine learning (ML) in data processing and recently in network security as well. However, the quality of datasets is overlooked or underestimated very often. Having reliable metrics to measure and describe the input dataset enables the feasibility assessment of a dataset. Imperfect datasets may require optimization or updating, e.g., by including more data and merging class labels. Applying ML algorithms will not bring practical value if a dataset does not contain enough information. This work addresses the neglected topics of dataset evaluation and missing metrics. We propose three novel metrics to estimate the quality of an input dataset and help with its improvement or building a new dataset. This paper describes experiments performed on public datasets to show the benefits of the proposed metrics and theoretical definitions for more straightforward interpretation. Additionally, we have implemented and published Python code so that the metrics can be adopted by the worldwide scientific community.

Článek

10.51305/cl.2024.02.04

Cílem tohoto článku je analyzovat možnosti a především výsledky strojového zpracování motivických a tematických shluků v poezii 19. století, které bylo provedeno na korpusu básní v plnotextové databázi České elektronické knihovny.

Článek

10.1016/j.comnet.2023.110147

Network traffic monitoring based on IP Flows is a standard monitoring approach that can be deployed to various network infrastructures, even the large ISP networks connecting millions of people. Since flow records traditionally contain only limited information (addresses, transport ports, and amount of exchanged data), they are also commonly extended by additional features that enable network traffic analysis with high accuracy. These flow extensions are, however, often too large or hard to compute, which then allows only offline analysis or limits their deployment only to smaller-sized networks. This paper proposes a novel extended IP flow called NetTiSA (Network Time Series Analysed) flow, based on analysing the time series of packet sizes. By thoroughly testing 25 different network traffic classification tasks, we show the broad applicability and high usability of NetTiSA flow. For practical deployment, we also consider the sizes of flows extended by NetTiSA features and evaluate the performance impacts of their computation in the flow exporter. The novel features proved to be computationally inexpensive and showed excellent discriminatory performance. The trained machine learning classifiers with proposed features mostly outperformed the state-of-the-art methods. NetTiSA finally bridges the gap and brings universal, small-sized, and computationally inexpensive features for traffic classification that can be scaled up to extensive monitoring infrastructures, bringing the machine learning traffic classification even to 100 Gbps backbone lines.

Stať ve sborníku

Cryptography serves as the cornerstone of information security and privacy in modern society. While notable progress has been made in the implementation of cryptographic techniques, a substantial portion of research outputs in cryptography, which strive to offer robust security solutions, are either implemented inadequately or not at all. Our study aims to investigate the challenges involved in bringing cryptography innovations from papers to products. To address this open question, we conducted 21 semistructured interviews with cryptography experts who possess extensive experience (10+ years) in academia, industry, and nonprofit and governmental organizations. We aimed to gain insights into their experiences with deploying cryptographic research outputs, their perspectives on the process of bringing cryptography to products, and the necessary changes within the cryptography ecosystem to facilitate faster, wider, and more secure adoption. We identified several challenges including misunderstandings and miscommunication among stakeholders, unclear delineation of responsibilities, misaligned or conflicting incentives, and usability challenges when bringing cryptography from theoretical papers to end-user products. Drawing upon our findings, we provide a set of recommendations for cryptography researchers and practitioners. We encourage better supporting cross-disciplinary engagement between cryptographers, standardization organizations, and software developers for increased cryptography adoption.

Článek

10.1080/17445760.2023.2291349

Each generation of CPU provides more resources and new features. These increase the ability to perform algorithms faster and with a higher degree of parallelism. The article discusses methods used to optimise CRC generation algorithms for long data blocks with consideration of the capabilities of contemporary systems. We analysed known software CRC algorithms and combined all known principles into a solution scalable in multiple CPU cores on single and multi-socket systems. Various algorithms were evaluated on contemporary multicore systems with 1 × 4, 1 × 64, 2 × 12, and 4 × 26 cores. The results show how the performance is affected by the architecture of the memory subsystem. Compared to the original sequential Sarwate algorithm, our algorithms are 48.0, 51.1, 38.0, and 28.8 times faster.