The use of malware samples is usually required to test cyber security solutions. For that, the correct typology of the samples is of interest to properly estimate the exhibited performance of the tools under evaluation. Although several malware datasets are publicly available at present, most of them are not labeled or, if so, only one class or tag is assigned to each malware sample. We defend that just one label is not enough to represent the usual complex behavior exhibited by most of current malware. With this hypothesis in mind, and based on the varied classification generally provided by automatic detection engines per sample, we introduce here a simple multi-labeling approach to automatically tag the usual multiple behavior of malware samples. In the paper, we first analyze the coherence between the behaviors exhibited by a specific number of well-known malware samples dissected in the literature and the multiple tags provided for them by our labeling proposal. After that, the automatic multi-labeling scheme is executed over four public Android malware datasets, the different results and statistics obtained regarding their composition and representativeness being discussed. We share in a GitHub repository the multi-labeling tool developed, for public usage.

Abstract After several years, crypto‐ransomware attacks still constitute a principal threat for individuals and organisations worldwide. Despite the fact that a number of solutions are deployed to fight against this plague, one main challenge is that of early reaction, as merely detecting its occurrence can be useless to avoid the pernicious effects of the malware. With this aim, the authors introduced in a previous work a novel anti‐ransomware tool for Unix platforms named R‐Locker . The proposal is supported on a honeyfile‐based approach, where ‘infinite’ trap files are disseminated around the target filesystem for early detection and to effectively block the ransomware action. The authors extend here the tool with three main new contributions. First, R‐Locker is migrated to Windows platforms, where specific differences exist regarding FIFO handling. Second, the global management of the honeyfiles around the target filesystem is now improved to maximise protection. Finally, blocking suspicious ransomware is (semi)automated through the dynamic use of white‐/black‐lists. As in the original work for Unix systems, the new Windows version of R‐Locker shows high effectivity and efficiency in thwarting ransomware action.

Web is a primary and essential service to share information among users and organizations at present all over the world. Despite the current significance of such a kind of traffic on the Internet, the so-called Surface Web traffic has been estimated in just about 5% of the total. The rest of the volume of this type of traffic corresponds to the portion of Web known as Deep Web. These contents are not accessible by search engines because they are authentication protected contents or pages that are only reachable through the well known as darknets. To browse through darknets websites special authorization or specific software and configurations are needed. Despite TOR is the most used darknet nowadays, there are other alternatives such as I2P or Freenet, which offer different features for end users. In this work, we perform an analysis of the connectivity of websites in the I2P network (named eepsites) aimed to discover if different patterns and relationships from those used in legacy web are followed in I2P, and also to get insights about its dimension and structure. For that, a novel tool is specifically developed by the authors and deployed on a distributed scenario. Main results conclude the decentralized nature of the I2P network, where there is a structural part of interconnected eepsites while other several nodes are isolated probably due to their intermittent presence in the network.

Smartphone platforms are becoming increasingly complex, which gives way to software vulnerabilities difficult to identify and that might allow malware developers to gain unauthorised privileges through technical exploitation. However, the authors maintain that these types of attacks indirectly renders a number of unexpected behaviours in the system that can be profiled. In this work, the authors present CoME , an anomaly‐based methodology aiming at detecting software exploitation in Android systems. CoME models the normal behaviour of a given software component or service and it is capable of identifying any unanticipated behaviour. To this end, they first monitor the normal operation of a given exploitable component through lightweight virtual introspection. Then, they use a multivariate analysis approach to estimate the normality model and detect anomalies. They evaluate their system against one of the most critical vulnerable and widely exploited services in Android, i.e. the mediaserver . Results show that the proposed approach can not only provide a meaningful explanatory of discriminant features for illegitimate activities, but can also be used to accurately detect malicious software exploitations at runtime.

This paper introduces a novel IDS approach for detecting malicious packet dropping behaviors in MANETs. Although some similar proposals can be found in the specialized literature, two main differences exist with ours. First, mobility aspects are explicitly considered into the approach by means of a heuristic which considers the operation of the forwarding process at the nodes. Second, this fact results in a significant improvement in the detection performance of the system, especially in terms of low false positive rate. The different experimental results obtained show the promising nature of our approach, both in terms of the detection capabilities exhibited and from the point of view of the simplicity of the scheme.

In recent years, variants of denial of service (DoS) attacks that use low-rate traffic have been proposed, including the Shrew attack, reduction of quality attacks, and low-rate DoS attacks against application servers (LoRDAS). All of these are flooding attacks that take advantage of vulnerability in the victims for reducing the rate of the traffic. Although their implications and impact have been comprehensively studied, mainly by means of simulation, there is a need for mathematical models by which the behaviour of these sometimes complex processes can be described. In this paper, we propose a mathematical model for the LoRDAS attack. This model allows us to evaluate its performance by relating it to the configuration parameters of the attack and the dynamics of network and victim. The model is validated by comparing the performance values given against those obtained from a simulated environment. In addition, some applicability issues for the model are contributed, together with interpretation guidelines to the model's behaviour. Finally, experience of the model enables us to make some recommendations for the challenging task of building defense techniques against this attack.

This paper presents a novel approach based on the monitoring of incoming HTTP requests to detect attacks against Web servers. The detection is accomplished through a Markovian model whose states and transitions between them are determined from the specification of the HTTP protocol while the probabilities of the symbols associated to the Markovian source are obtained during a training stage according to a set of attack-free requests for the target server. The experiments carried out show a high detection capability with low false positive rates at reasonable computation requirements.

This article describes a comparative study of language models in which the evaluation protocol has been set by AUPELF-UREF . We especially pay attention on the comparison between two methods of clustering words which are necessary in the design of the corresponding language models. The first classification is done by following a linguistic and theoretical method and the second one is based on an optimization method. Both methods are evaluated through the Shannon game. The vocabulary used is 20 000 words, the training corpus is made of two years of Le Monde newspaper (42M of words) and the test corpus (400 000 words) is extracted from 6 years of Le Monde Diplomatique. First evaluations show an improvement of 13% of recognized words in the first five ranks and a decrease of 25% in perplexity.This article describes a comparative study of language models in which the evaluation protocol has been set by AUPELF-UREF . We especially pay attention on the comparison between two methods of clustering words which are necessary in the design of the corresponding language models. The first classification is done by following a linguistic and theoretical method and the second one is based on an optimization method. Both methods are evaluated through the Shannon game. The vocabulary used is 20 000 words, the training corpus is made of two years of Le Monde newspaper (42M of words) and the test corpus (400 000 words) is extracted from 6 years of Le Monde Diplomatique. First evaluations show an improvement of 13% of recognized words in the first five ranks and a decrease of 25% in perplexity.This article describes a comparative study of language models in which the evaluation protocol has been set by AUPELF-UREF . We especially pay attention on the comparison between two methods of clustering words which are necessary in the design of the corresponding language models. The first classification is done by following a linguistic and theoretical method and the second one is based on an optimization method. Both methods are evaluated through the Shannon game. The vocabulary used is 20 000 words, the training corpus is made of two years of Le Monde newspaper (42M of words) and the test corpus (400 000 words) is extracted from 6 years of Le Monde Diplomatique. First evaluations show an improvement of 13% of recognized words in the first five ranks and a decrease of 25% in perplexity.This article describes a comparative study of language models in which the evaluation protocol has been set by AUPELF-UREF . We especially pay attention on the comparison between two methods of clustering words which are necessary in the design of the corresponding language models. The first classification is done by following a linguistic and theoretical method and the second one is based on an optimization method. Both methods are evaluated through the Shannon game. The vocabulary used is 20 000 words, the training corpus is made of two years of Le Monde newspaper (42M of words) and the test corpus (400 000 words) is extracted from 6 years of Le Monde Diplomatique. First evaluations show an improvement of 13% of recognized words in the first five ranks and a decrease of 25% in perplexity.

A new parameter for estimating the difficulty of a continuous speech recognition task, called speech decoding difficulty, is presented. It is obtained from the language model defined for the recognition task and the phonetic similarity between the transcriptions of the words that make up the vocabulary used. Two variants of the proposed task difficulty measure are introduced: ideal speech decoding difficulty (ISDD), which is not influenced by practical considerations on the recognition system implemented, and a second, more realistic variant, called practical speech decoding difficulty (PSDD) to study the performance of a specific recognition system when confronting a given task.

In this work we propose a novel way of discriminating the words that are recognized by a speech recognition system as correctly or incorrectly detected words. The procedure consists of the extraction of a set of characteristics for each word. Utilizing these characteristics, we have built two classifiers: the first one is a vector quantizer, while the second one, though also a vector quantizer, was trained using adaptative technique learning. The results obtained show an improvement in the performance of the recognizer achieved by reducing the number of insertions with no significant reduction in the correctly detected words.

It is usually assumed that grammar probabilities and acoustic probabilities in a continuous speech recognition system have to be incorporated to the general score with different weights. This is an experimental fact and there is no generally accepted theoretical explanation. We propose an explanation to this fact, related to the way grammar scoring is incorporated in the searching procedure. Accordingly to this explanation, we perform a set of experiments to test our hypothesis. We are also proposing a new way of introducing grammar probabilities in a tree-based vocabulary search strategy, where systems are usually bound to use the worst strategy. To apply our ideas to unigrams is rather simple. For more complex language models like bigrams we have to implement a new procedure.

We present a preliminary version of a voice dialogue system suitable to deal with client orders and questions in fast-food restaurants. The system consists of two main sub-systems, namely a dialogue sub-system and a voice interface. The dialogue sub-system is a natural language processing system that may be considered a rule-based expert system, whose behaviour is decided from a recorded dialogue corpus obtained at a real restaurant. In this paper we present a general description of both sub-systems, and focus on knowledge representation, grammar, and module structure of the dialogue sub-system. An introduction to the natural language generation mechanism used is introduced, and future work is mentioned. Finally some conclusions are shown.

This work presents the STACC, Sistema Telef onico Autom atico de Consulta de Calificaciones (Automatic Telephone System for Consulting Marks). This system has been developed at our laboratory during 1996 and implements a service through telephone line that allows the students to consult by speech their marks after the exams by means of a simple phone call. This experience provided us an interesting point of view about the problems of real applications of speech technology. In this work we describe the system and some statistics about the use of STACC by the students are presented.

Signal representation is crucial for designinga speechrecognizer. The feature extractor selects the information to be used by the classifier to perform the recognition. In noisy environments, the data vectors representing the speech signal are changed and the recognizer performance is degraded by two main facts: (1) the mismatch between the training and the recognition conditions and (2) the degradation of the signal to be recognized. In such a situation, the representation of the speech signal plays an important role. In this paper, we analyze the importance of the representation for speechrecognition in noise. We apply the Discriminative Feature Extraction (DFE) method to optimize the representation. The experiments presented in this work show that the DFE method, which has been successfully applied in clean environments, leads also to improvements of the speech recognizers in noise.

Research on multiple vector quantization (MVQ) has shown the suitability of such a technique for speech recognition. Basically, MVQ proposes the use of one separate VQ codebook for each recognition unit. Thus, a MVQHMM model is composed of a VQ codebook and a discrete HMM model. This technique allows the incorporation in the recognition dynamics of the input sequence information wasted by discrete HMM models in the VQ process. The use of distinct codebooks also allows one to train them in a discriminative manner. We propose a new VQ codebook design method for MVQ-based systems, obtained from a modified maximum mutual information estimation. This method provides meaningful error reductions and is performed independently from the estimation of the discrete HMM part of the MVQ model. The results show that the proposed discriminative design turns the MVQHMM technique into a powerful acoustic modeling tool in comparison with other classical methods such as discrete or semicontinuous HMMs.

This paper presents a new framework developed to apply Alphanets to CSR. For this purpose, a modular system is proposed. This system is made up by three different modules: LVQ module, SLHMM module and DP module. The SLHMM module is an expansion of an Alphanet, and therefore, can be interpreted as a HMM. The system can be trained globally applying backpropagation techniques. The used pruning procedure is based upon recognized units instead of observations, which reduces the number of nodes needed to recognize a sentence, compared to HMM-based systems using the same parameters for the models in both systems. Besides, the training procedure re-adapts the weights according to the new architecture in a few iterations since the initial parameters can be estimated from a classical HMM CSR system.>