Execution tracing is essential for understanding system and software behaviour, yet lost trace events can significantly compromise data integrity and analysis. Existing solutions for trace reconstruction often fail to fully leverage available data, particularly in complex and high-dimensional contexts. Recent advancements in generative artificial intelligence, particularly diffusion models, have set new benchmarks in image, audio, and natural language generation. This study conducts the first comprehensive evaluation of diffusion models for reconstructing incomplete trace event sequences. Using nine distinct datasets generated from the Phoronix Test Suite, we rigorously test these models on sequences of varying lengths and missing data ratios. Our results indicate that the SSSDS4model, in particular, achieves superior performance, in terms of accuracy, perfect rate, and ROUGE-L score across diverse imputation scenarios. These findings underscore the potential of diffusion-based models to accurately reconstruct missing events, thereby maintaining data integrity and enhancing system monitoring and analysis.

Large Language Models (LLMs) have demonstrated remarkable success in tasks like the Winograd Schema Challenge (WSC), showcasing advanced textual common-sense reasoning.However, applying this reasoning to multimodal domains, where understanding text and images together is essential, remains a substantial challenge.To address this, we introduce WINOVIS, a novel dataset specifically designed to probe text-to-image models on pronoun disambiguation within multimodal contexts.Utilizing GPT-4 for prompt generation and Diffusion Attentive Attribution Maps (DAAM) for heatmap analysis, we propose a novel evaluation framework that isolates the models' ability in pronoun disambiguation from other visual processing challenges.Evaluation of successive model versions reveals that, despite incremental advancements, Stable Diffusion 2.0 achieves a precision of 56.7% on WINOVIS, showing minimal improvement from past iterations and only marginally surpassing random guessing.Further error analysis identifies important areas for future research aimed at advancing text-to-image models in their ability to interpret and interact with the complex visual world.

The privacy and security of users are increasingly threatened due to the rising frequency of malware assaults. Both Host-based Intrusion Detection Systems (HIDSes) and Antivirus software rely on signature-based or anomaly-based techniques for malware detection. However, the escalating diversity and sophistication of malware pose significant obstacles. In this research, we introduce EMD-SCS, an early malware detection methodology, employing sonification and system call sequence analysis. In our methodology, we interpret an executing program/process as a sequence of system calls, leveraging a Long Short-Term Memory network (LSTM) to hold a record of preceding system calls within this chain, consequently facilitating the prediction of future calls. After this prediction phase, the BLEU and hamming distance scores are utilized to classify the system call sequence. Importantly, these results are attained by analyzing just a small segment of the data for early prediction, which is crucial for a sonification-based approach as it enables us to notify administrators in advance of potential threats. This early warning system would allow admins to protect the host before a potential compromise. EMD-SCS uses sonification to convey the prediction outcomes using natural and animal sounds, offering a broader monitoring scope than visual observation. Evaluation results from the ADFA-LD dataset suggest that EMD-SCS surpasses prior techniques in early malware detection with an accuracy of 91.2%, a detection rate of 87.7%, and a false-positive rate of 15.3%, achieved by only processing 40% of the input system call sequences before they infiltrate the host.

Identifying and diagnosing performance anomalies is essential for maintaining software quality, yet it can be a complex and time-consuming task. Low level kernel events have been used as an excellent data source to monitor performance, but raw trace data is often too large to easily conduct effective analyses. To address this shortcoming, in this paper, we propose a framework for uncovering performance problems using execution critical path data. A critical path is the longest execution sequence without wait delays, and it can provide valuable insight into a program's internal and external dependencies. Upon extracting this data, course grained anomaly detection techniques are employed to determine if a finer grained analysis is required. If this is the case, the critical paths of individual executions are grouped together with machine learning clustering to identify different execution types, and outlying anomalies are identified using performance indicators. Finally, multiple sequence alignment is used to pinpoint specific abnormalities in the identified anomalous executions, allowing for improved application performance diagnosis and overall program comprehension.

The use of containers within cloud environments has become increasing popular due to their lightweight nature, scalability, and efficiency. However, as containers share their host's resources, advanced resource management techniques are essential to avoid performance impacting resource contention. Coarse measures such as CPU, disk, and network usage collected from internal agents are often considered, yet these methods may be improved upon to garner a more precise view of container workloads. In this paper, we present a container workload characterization method using host system tracing. Features derived from thread execution states are taken from tracing data to reveal container runtime behaviour. A PageRank-based algorithm is then used to identify the most significant threads for further analysis. Once this data is collected and vectorized, a two stage K-Means clustering technique is used to generate groups of containers with similar workloads. This eliminates the need for manual analysis of individual containers, and instead allows administrators to view and address container behaviours collectively. Experimental results show that our methodology can identify a variety of execution behaviours. Administrators may use these results to remove idle containers to free up system resources. Moreover, they may identify clusters of containers that are at risk of resource contention, allowing for more effective resource assignment.