With the widespread adoption of virtualization technology, it is imperative to strengthen its security, and dynamically modeling and instantly trapping malicious behaviors are challenging problems. Extant detection methods will be invalidated after the evasive malware manipulates the behavior trace. Currently, there is no approach to model the complex dynamic behavior of evasive malware, leading to missed opportunities for optimal detection. This work first presents antibypassing four-stage dynamic behavior modeling for time-efficient evasive malware detection (AFDBM-TEMD). AFDBM-TEMD models the interaction between evasive malware and its execution environment, identifying the optimal detection phases for various evasive malware. Moreover, it traps the crucial instructions and system calls invoked by the evasive malware into the virtual machine monitor layer to obtain the dynamic behavior information (including transmitted parameters, execution time, process information, return values, etc.) to identify the malicious software. Experimental results show that AFDBM-TEMD achieves new state-of-the-art results, and the proposed dynamic behavior modeling method has wide applicability, while the average detection time reaches milliseconds. Specifically, the detection rate is improved from 0–56.52% to 100% in contrast with the comparative methods, and the detection speed is increased by more than six times.

Having a system to stratify individuals according to risk is key to clinical disease prevention. This allows individuals identified at different risk tiers to benefit from further investigation and intervention. But the same risk score estimated for two different persons does not mean they need the same further investigation or represent the similarity health condition between two persons. Meanwhile, users still do not know a prior what most of the risk tiers are, and how many tiers should be found in risk stratification. In this paper, the proposed pairwise and size constrained Kmeans (PSCKmeans) method simultaneously integrates the limited supervised information and the size constraints to screen the high-risk population based on similarity measurement, and gets a feasible and balanced stratification solution to avoid cluster with few points. Results on China Health and Nutrition Survey public dataset and follow-up dataset show that the proposed PSCKmeans method can naturally grade the risk of diabetes into four tiers, and achieve 73.8%, 85.1%, and 0.95% sensitivity, specificity, and ratio of minimum to expected on testing data. The proposed method compares favorably with eight previous semisupervised clustering methods; it demonstrates that semisupervised clustering by unifying multiple forms of constraints can guide a good partition that is more relevant for the domain and find new categories through prior knowledge. Finally, this risk stratification model can provide a tool for risk stratification of clinical disease and be used for further intervention for people with similar health condition.

Abstract The kernel‐level rootkits compromise the security of operating systems. In the current research studies, virtualization is used as a key tool against these attacks with virtualization‐based memory protection. There are glitches in the memory protection mechanism, and it is vulnerable to page mapping attack and hard to be used for protecting dynamic data. To address these problems, we proposed a secure paging mechanism and constructed an external and transparent architecture named multiple operating systems kernel guard (MOSKG), which can protect critical kernel data in different operating systems like Windows and Linux, both of 32‐bit and 64‐bit. To evaluate our proposed architecture, we applied some experiments that are based on the study of kernel rootkits. The results show that MOSKG can protect critical kernel data from dynamic kernel object manipulation and page mapping attack, and it defeats all of the kernel‐level attacks. It is also a significant conclusion that MOSKG only introduces a small performance overhead of 2.3%. Copyright © 2015 John Wiley & Sons, Ltd.

Diabetes mellitus is a chronic disease and a worldwide public health challenge. It has been shown that 50-80% proportion of T2DM is undiagnosed. In this paper, support vector machines are utilized to screen diabetes, and an ensemble learning module is added, which turns the "black box" of SVM decisions into comprehensible and transparent rules, and it is also useful for solving imbalance problem. Results on China Health and Nutrition Survey data show that the proposed ensemble learning method generates rule sets with weighted average precision 94.2% and weighted average recall 93.9% for all classes. Furthermore, the hybrid system can provide a tool for diagnosis of diabetes, and it supports a second opinion for lay users.