Using behaviour association or dependency to detect malicious code can improve the recognition rate of malicious code. A malicious code detection method based on precise behaviour dependency graph (PBDG) is proposed. We create a stain file index by filtering the stain source blacklist, which not only saves storage space, but also quickly locates instructions. An active variable path verification algorithm is proposed to verify and purify the Source → Sink path. The PBDG and its matching algorithm are constructed to identify the malicious code family of the source program. The experimental results on six data sets show the effectiveness of this method. The introduction of active variable paths reduces the number of paths that need to be traversed by 91.2% at most. In terms of the detection effect of malicious code, especially for web applications, it has a good detection accuracy and a low false positive rate.

Abstract Collecting and analysing customers' data plays an essential role in the more intense market competition. It is critical to perform data analysis effectively while ensuring the user's privacy, especially after various privacy regulations are enacted. In this paper, we consider the problem of aggregating the stream data generated from wearable devices in a specific time period in a privacy‐preserving manner. Specifically, we adopt the local differential privacy mechanism to provide a strong privacy guarantee for users. One major challenge is that all values of the stream need to be perturbed. The additive noise makes it hard to release an accurate data stream. One way to reduce the noise scale is to select some data points to perturb instead of all. The intuition is that more privacy budgets are applied to a single data point, which ensures the statistical accuracy. The perturbed data points are used to predict the un‐selected data points without consuming an extra privacy budget. Based on this idea, we propose a novel stream data statistical framework, which includes four components, data fitting, skeleton point selection, noisy stream generation, and data aggregation. Extensive experiment results show that our proposed method achieves a much smaller mean square error given a fixed privacy budget compared with the state‐of‐the‐art.

Using the features of malicious family to detect malicious code can improve the analysis efficiency and reduce the workload. Aiming at the problems of low efficiency and low accuracy of classifiers in analyzing and detecting malicious code using traditional machine learning, a new malicious family identification method 2MFI-FT is proposed. Firstly, the more comprehensive and essential features of malicious code are obtained by extracting local feature information, assembly instruction set information and visible string information. Secondly, in order to solve the problem of inconsistent images generated by feature sequences, different feature grayscale images are fused into a multi-channel mapping feature image (2MFI) based on the signature matrix. Thirdly, in view of the high cost of collecting and labeling enough data, a classification model with high recognition accuracy and strong generalization ability is realized, based on the fine-tuned Convolutional Neural Network (CNN). The regularization technique is also used to improve the robustness of the model. It is tested on Microsoft Malware Classification Challenge dataset. The experimental results show that the proposed 2MFI method for multi-channel feature image visualization has good identification effect and low time consumption when used as the input of the network model. At the same time, the 2MFI-FT method combined with fine-tuned CNN can accurately identify malicious families, and the accuracy on small training sets and large training sets can reach about 98.25% and 99.68% respectively, which provides a feasible solution for effective identification of malicious families.

The traditional model for wind turbine fault prediction is not sensitive to the time sequence data and cannot mine the deep connection between the time series data, resulting in poor generalization ability of the model. To solve this problem, this paper proposes an attention mechanism‐based CNN‐LSTM model. The semantic sensor data annotated by SSN ontology is used as input data. Firstly, CNN extracts features to get high‐level feature representation from input data. Then, the latent time sequence connection of features in different time periods is learned by LSTM. Finally, the output of LSTM is input into the attention mechanism module to obtain more fault‐related target information, which improves the efficiency, accuracy, and generalization ability of the model. In addition, in the data preprocessing stage, the random forest algorithm analyzes the feature correlation degree of the data to get the features of high correlation degree with the wind turbine fault, which further improves the efficiency, accuracy, and generalization ability of the model. The model is validated on the icing fault dataset of No. 21 wind turbine and the yaw dataset of No. 4 wind turbine. The experimental results show that the proposed model has better efficiency, accuracy, and generalization ability than RNN, LSTM, and XGBoost.

Anomaly detection as a kind of intrusion detection is good at detecting the unknown attacks or new attacks, and it has attracted much attention during recent years. In this paper, a new hierarchy anomaly intrusion detection model that combines the fuzzy c-means (FCM) based on genetic algorithm and SVM is proposed. During the process of detecting intrusion, the membership function and the fuzzy interval are applied to it, and the process is extended to soft classification from the previous hard classification. Then a fuzzy error correction sub interval is introduced, so when the detection result of a data instance belongs to this range, the data will be re-detected in order to improve the effectiveness of intrusion detection. Experimental results show that the proposed model can effectively detect the vast majority of network attack types, which provides a feasible solution for solving the problems of false alarm rate and detection rate in anomaly intrusion detection model. Copyright © 2016 John Wiley & Sons, Ltd.