We consider the possibility of detecting malicious behaviors of the advanced persistent threat (APT) at endpoints during incident response or forensics investigations. Specifically, we study the case where third-party sensors are not available; our observables are obtained solely from inherent digital artifacts of Windows operating systems. What is of particular interest is an artifact called the Application Compatibility Cache (Shimcache). As it is not apparent from the Shimcache when a file has been executed, we propose an algorithm of estimating the time of file execution up to an interval. We also show guarantees of the proposed algorithm's performance and various possible extensions that can improve the estimation. Finally, combining this approach with methods of machine learning, as well as information from other digital artifacts, we design a prototype system called XTEC and demonstrate that it can help hunt for the APT in a real-world case study.

With the spread of smartphones and machine-to-machine devices that communicate via cellular networks, mobility and communication characteristics in cellular networks have become diverse. However, because existing cellular networks are designed for human-to-human communication, mobility management in cellular networks is not necessarily effective. In this paper, we propose an adaptive method of designing registration and paging areas to reduce costs in the mobility management of cellular networks. The proposed method uses the interacting multiple model algorithm to support multiple motion models that switch over time.

Explicit-state model checking which is conducted by state space search has difficulty in exploring satisfactory state space because of its memory requirements. Though bitstate hashing achieves memory efficiency, it cannot guarantee complete verification. Thus, it is desirable to provide a reliability indicator such as a coverage estimate. However, the existing approaches for coverage estimation are not very accurate when a verification run covers a small portion of state space. This mainly stems from the lack of information that reflects characteristics of models. Therefore, we propose coverage estimation methods using a growth curve that approximates an increase in reached states by enlarging a bloom filter. Our approaches improve estimation accuracy by leveraging the statistics from multiple verification runs. Coverage is estimated by fitting the growth curve to these statistics. Experimental results confirm the validity of the proposed growth curve and the applicability of our approaches to practical models. In fact, for practical models, our approaches outperformed the conventional ones when the actual coverage is relatively low.

We developed a robust domain selection method and verified its extensibility. An issue in domain selection is its robustness against out-of-grammar utterances. It is essential to generate correct system responses because such utterances often cause domain selection errors. We therefore integrated the topic estimation results and the dialogue history to construct a robust domain classifier. Another issue is that domain selection should be performed within an extensible framework, because the system is often modified and extended. That is, the classifier should still have high performance without reconstructing it after adding new domains. The extensibility of our method was not experimentally verified yet, because it requires a lot of effort to collect new dialogue data after extending the system. Therefore, we verified extensibility without collecting new data. We constructed the classifier by leaving out some domains in the dialogue data and then evaluated its accuracy as the classifier for the data where the left-out domains were virtually added. Index Terms: multi-domain spoken dialogue system, domain selection, out-of-grammar utterance

In a multi-domain spoken dialogue system, a user’s utterances are more prone to be out-of-grammar, because this kind of system deals with more tasks than a single-domain system. We defined a topic as a domain about which users want to find more information, and we developed a method of recovering out-ofgrammar utterances based on topic estimation, i.e., by providing a help message in the estimated domain. Moreover, the domain extensibility, that is, to facilitate adding new domains, should be inherently retained in multi-domain systems. We therefore collected documents from the Web as training data for topic estimation. Because the data contained not a few noises, we used Latent Semantic Mapping (LSM), which enables robust topic estimation by removing the effect of noise from the data. The experimental results based on using 272 utterances collected with a Woz-like method showed that our method increased the topic estimation accuracy by 23.1 points from the baseline. Index Terms: multi-domain spoken dialogue system, topic estimation, out-of-grammar utterance 1.

In this paper, we propose a finger-tapping interface called FINGERTAP, which can estimate the contact states and forces on human fingertips in real time by using only the fingertip positions measured by high-speed vision cameras. In particular, we focus on the high-frequency component that develops at the moment a fingertip contacts something. We introduce a real-time estimation algorithm for the fingertip contact state and force by using frequency filtering to detect the high-frequency movement component of the fingertip positions. We also introduce a clickable pointing interface and a virtual musical instrument as a demonstration of an application using the FINGERTAP system.

Suppose that a distributed system is modeled by an undirected graph G = (V, E), where V and E, respectively, are the sets of processes and communication links. Israeli and Jalfon (1990) proposed a simple self-stabilizing mutual exclusion algorithm: a token is circulated among the processes (i.e., vertices) and a process can access the critical section only when it holds the token. In order to guarantee equal access chance to all processes, the token circulation needs to be fair in the sense that all processes have the same probability of holding the token. However, the Israeli-Jalfon token circulation scheme does not meet the requirement. This paper proposes a new scheme for making it fair. We evaluate the average of the longest waiting times in terms of the cover time and show an O(deg(G)n/sup 2/) upper bound on the cover time for our scheme, where n and deg(G) are the number of processes and the maximum degree of G, respectively. The same (tight) upper bound is known for the Israeli-Jalfon scheme.