Binary provenance analysis recovers essential information, such as architecture, structure, and toolchain, from executables lacking reliable metadata. This is crucial for reverse engineering. However, provenance recovery from binaries is highly challenging, due to three key factors: (1) binaries span diverse CPU architectures; (2) Raw byte sequences are often extremely long without clear boundaries; and (3) Compilation alters control flow, register usage, and memory layout, obscuring the original code structure and complicating analysis. To address these challenges, we propose a novel and robust analysis toolset, namely ProvSpider, to identify segment boundaries, types of segments as well as target CPU architectures, bitness, and endianness based on code-only sections. ProvSpider is built based on a convolutional neural network (CNN) to learn local execution patterns. We embed byte sequences into eight-dimensional vectors to capture bytes’ global dependencies. The gating mechanism after convolutional layers filters out noise and keeps most representative features. At last, the sliding window divides lengthy byte sequences into fixedlength processable chunks. Our model achieves high accuracy in all five analysis tasks, significantly outperforming the state-of-the-art models. By providing a universal and robust approach, ProvSpider lays the foundation for advancing binary provenance analysis, facilitating future improvements in binary analysis and reverse engineering.

Embedded PowerShell commands or scripts are among the most popular malware payloads. For malware that prioritizes stealthiness, such as fileless malware, PowerShell’s access to Windows API functions without additional libraries makes it useful for evading detection. Detecting malicious PowerShell scripts and commands is an open challenge for proactive endpoint protection due to three major issues: (1) The malicious commands are usually hidden in a long script beyond the processing limit of typical machine learning models. (2) They are usually mixed with bulky benign scripts. (3) Script obfuscation can easily conceal their potential matching signatures. In this article, we introduce a novel model addressing these challenges. It incorporates similarity learning, sentence transformer, sliding window method, and stochastic gradient descent (SGD) classifier. Our key insight is that malicious PowerShell code, particularly when obfuscated, exhibits semantic and statistical deviations from benign administrative usage, and these deviations can be captured by contrastive sentence embeddings without the need for de-obfuscation or handcrafted features. We operate this insight through a Siamese similarity learning framework that improves robustness against Out-of-Vocabulary tokens due to unseen code obfuscation methods. The sliding window method enables the model to handle long scripts, and the SGD classifier evaluates segment-level maliciousness. Our model achieves accuracies of 99.01%, 97.59%, 98.70%, and 99.73% across multiple obfuscated and mixed script benchmarks, outperforming existing baselines by over 30% in all cases. This work demonstrates a scalable and effective strategy for robust PowerShell malware detection in real-world scenarios.

With increasing numbers of novel malware each year, tools are required for efficient and accurate variant matching under the same family, for the purpose of effective proactive threat detection, retro-hunting, and attack campaign tracking. All of the state-of-the-art Deep Learning (DL) approaches assume that the incoming samples originate from known families and incorrectly identify novel families. Additionally, most of the existing solutions that leverage the Siamese Neural Network architecture either rely on pair-wise comparisons or computationally expensive preprocessing steps that are not scalable to a real-world malware triage volume requirement. We propose a different route, Mecha, a Neural-Symbolic Machine Learning (ML) system for malware variant matching and zero-day family detection. Mecha is comprised of an embedding network trained in two different scenarios for byte string embedding and an open-set approximate nearest neighbour algorithm for variant matching and zero-day detection. Our embedding network uses triplet loss for embedding generation and reinforcement-based Expectation Maximization (EM) learning for full deployment optimization. We conduct multiple in-sample and out-of-sample experiments to demonstrate the model's generalizability toward novel variants and families. We also show that Mecha can detect samples outside the known set of malware samples with an accuracy greater than 0.990.

During the COVID-19 pandemic, the traditional emergency healthcare systems faced unprecedented strain due to the sharp rise in demands for urgent care, scarcity of resources, and increased risks of people getting infected while waiting at the emergency care facility. We present Triage-Bot, an online medical triage provisioning service, that can revolutionize emergency care by decreasing the load on emergency departments (ED), reducing healthcare expenses, and improving the quality of care. Empowered by artificial intelligence and natural language processing, the Triage-Bot service assesses and prioritizes patients' needs based on symptoms, medical history, and perceived conditions from multimodal video, audio, and text data captured during patients' interactions. The captured summarized information with a severity ranking is sent to a human expert to suggest the next action on the user's part. The diverse data types used by the Triage-Bot in communication, authentication, data collection, storage, and analytics requires a robust and scalable system architecture for online service provisioning. In this paper, we specifically focus on the system design and architecture of the Triage-Bot for emergency healthcare settings. With integrated electronic medical records (EMR) and online platforms, the bot fosters collaboration among healthcare professionals and enables swift and informed decision-making even in the face of crises. By partially automating and offering a hybrid triage process, the Triage-Bot improves resource allocation, reduces healthcare management costs for emergency care, minimizes patient waiting times, and improves wellbeing. To address the complexities and demands of healthcare data management, our proposed system incorporates MongoDB database for flexibility, scalability, and versatility in supporting different types of data. Additionally, we implement a data linking and analytics pipeline utilizing a data Lakehouse system to effectively ingest, manage, process, and generate knowledge from heterogeneous data sources.

We report our experience of preparing and conducting unplanned online exams in the unique half-physical, half-virtual semester of Winter 2020. The report covers four courses in a large university's computer science program, ranging from first-year to third-year. With the data generated by students taking both in-person and online exams in multiple courses, we perform analyses to evaluate the validity of the online exams (especially the unproctored ones) as an assessment of student understanding. With the fine-grained student activity data provided by the online exam platform, we are also able to investigate the patterns in student exam-taking behaviours and their correlations with student performance on the exam. In addition, we share, in detail, the tips and lessons that were learned throughout the process of designing, implementing, and hosting the online exams.

Many password alternatives for web authentication proposed over the years, despite having different designs and objectives, all predominantly rely on the knowledge of some secret. This motivates us, herein, to provide the first detailed exploration of the integration of a fundamentally different element of defense into the design of web authentication schemes: a mimicry-resistance dimension. We analyze web authentication mechanisms with respect to new usability and security properties related to mimicry-resistance (augmenting the UDS framework), and in particular evaluate invisible techniques (those requiring neither user actions, nor awareness) that provide some mimicry-resistance (unlike those relying solely on static secrets), including device fingerprinting schemes, PUFs (physically unclonable functions), and a subset of Internet geolocation mechanisms.

As the number of wireless devices sharing a radio band increases, so does the number N of potential co-channel interferers. The receiver performance is then strongly dependent on the total received interference power. While the statistics of this power have previously been studied under the channel assumption of independent shadowing, it is easy to show that for large N the correlation among the shadowing paths cannot be neglected. While this correlation may be simulated by matrix decomposition, we show that an alternative approximately equivalent algorithm using shadowing fields can achieve simulation performance that scales much better with N and has additional advantages.