Modern malware applies a rich arsenal of evasion techniques to render dynamic analysis ineffective. In turn, dynamic analysis tools take great pains to hide themselves from malware; typically this entails trying to be as faithful as possible to the behavior of a real run. We present a novel approach to malware analysis that turns this idea on its head, using an extreme abstraction of the operating system that intentionally strays from real behavior. The key insight is that the presence of malicious behavior is sufficient evidence of malicious intent, even if the path taken is not one that could occur during a real run of the sample. By exploring multiple paths in a system that only approximates the behavior of a real system, we can discover behavior that would often be hard to elicit otherwise. We aggregate features from multiple paths and use a funnel-like configuration of machine learning classifiers to achieve high accuracy without incurring too much of a performance penalty. We describe our system, TAMALES (The Abstract Malware Analysis LEarning System), in detail and present machine learning results using a 330K sample set showing an FPR (False Positive Rate) of 0.10% with a TPR (True Positive Rate) of 99.11%, demonstrating that extreme abstraction can be extraordinarily effective in providing data that allows a classifier to accurately detect malware.

We present a characterization that shows what it means for a formula to be a weak or strong version of another formula. We show that the weak version of a formula is not the same as Alpern and Schneider's safety component, but can be achieved by taking the closure in the Cantor topology over an augmented alphabet in which every formula is satisfiable. The resulting characterization allows us to show that the set of semantically weak formulas is exactly the set of nonpathological safety formulas. Furthermore, we use the characterization to show that the original versions of the ieee standard temporal logics psl and sva are broken, and we show that the source of the problem lies in the semantics of the sere intersection and fusion operators. Finally, we use the topological characterization to show the internal consistency of the alternative semantics adopted by the latest version of the psl standard.

In this paper we consider the problem of exploiting infeasible clock gating functions. Analysis of industrial designs reveals a large margin of potential for power saving based on clock gating functions that initially appear to be useless due to timing violation or excessive power consumption. We propose two optimization techniques for resurrecting such functions that can be used as a generic post-processing phase in an automatic clock gating tool. The first provides timing-aware approximation and the second aims at generating large gating domains by clustering similar clock gating functions. Our experimental results show that the combination of these two techniques yields an additional power saving of up to 78% in industrial designs.

The semantics of temporal logic is usually defined with respect to a word representing a computation path over a set of atomic propositions. A temporal logic formula does not control the behavior of the atomic propositions, it merely observes their behavior. Local variables are a twist on this approach, in which the user can declare variables local to the formula and control their behavior from within the formula itself. Local variables were introduced in 2002, and a formal semantics was given to them in the context of SVA, the assertion language of SystemVerilog, in 2004. That semantics suffers from several drawbacks. In particular, it breaks distributivity of the operators corresponding to intersection and union. In this paper we present a formal semantics for local variables that solves that problem and others, and compare it to the previous solution.

We are interested in the relation between weak and strong temporal operators. We would like to find a characterization that shows what it means for an operator to be the weak or strong version of another operator, or more generally for a formula to be a weak or strong version of another formula. We show that the weak version of a formula is not the same as Alpern and Schneider's safety component. By working over an extended alphabet, we show that their topological characterization of safety can be adapted to obtain a topological characterization of weakness. We study the resulting topology and the relations between weak and strong formulas. Finally, we apply the method to show the internal consistency of a logic containing both weak and strong versions of regular expressions.

We propose a methodology for developing hardware control. In addition to the usual distinction between control and data path, a further distinction within the control code is made between algorithmic code and bookkeeping code. The high level specification describes the algorithmic code in an object-oriented st yle, is executable, formally verified, and automatically translated into HDL, thus giving hardware which is by construction equivalen t to its specification. We discuss the application of this methodology as it is used in product development of cache coherence protocols.

RuleBase is a formal verification tool, developed by the IBM Haifa Research Laboratory. It is the result of three years of experience in practical formal verification of hardware which, we believe, has been a key factor in bringing the tool to its current level of maturity. We present the tool, including several unique features, and summarize our usage experience.