Abstract To overcome the significant challenges posed by new variants of malware to conventional detection techniques, such as low automation, reliance on expert knowledge, and inadequate capability to detect unknown threats in existing memory analysis methods, this paper designs an intelligent detection algorithm for malicious memory segments based on a one-dimensional convolutional network. This algorithm takes raw memory byte sequences as input, referred to as memory segments, and employs a one-dimensional convolutional neural network to automatically learn their deep features and inherent relationships. This approach facilitates an end-to-end automated analysis from data to detection, thereby eliminating the need for complex manual feature engineering. Experimental results show that the designed algorithm achieves a maximum accuracy of 98.28%, precision of 98.94%, recall of 97.6%, F1-score of 0.9826, and AUC value of 0.9972 on the test set, showcasing outstanding detection performance and generalization capability for malicious memory segments. This research offers a novel and effective method for efficient and accurate memory-based malware detection, which can significantly enhance proactive security defense capabilities.

In scenarios with aleatoric uncertainties, the reward got by an agent when executing the same action in the same state is random, which can reduce the stability and convergence speed of the reinforcement algorithms. However, in most scenarios, reward functions have regularity, and their expectations are determined, which can be got through models or sample statistics. This paper discusses the distribution relationship between reward functions and value functions in scenarios with aleatoric uncertainties and proves the feasibility of using reward expectations for reinforcement learning. Finally, experiments show that algorithms have better stability and convergence speed when using reward expectations than random rewards.

Steganographic security is the research focus of steganography. Current steganography research emphasizes on the design of steganography algorithms, but the theoretical research about steganographic security measure is relatively lagging. This paper proposes a feasible image steganographic security measure based on high dimensional KL divergence. It is proved that steganographic security measure of higher dimensional KL divergence is more accurate. The correlation between neighborhood pixels is analyzed from the principle in imaging process and content characteristics, and it is concluded that 9-dimensional probability statistics are effective enough to be used as steganographic security measure. Then in order to reduce the computational complexity of high dimensional probability statistics and improve the feasibility of the security measure method, a security measure dimension reduction scheme is proposed by applying gradient to describe image textures. Experiments show that the proposed steganographic security measure method is feasible and effective and more accurate than measure method based on 4-dimensional probability statistics.

Summary Computers are indispensable to modern human society. Often, computers host multiple programs running simultaneously. However, among those programs, some maybe more time critical than others to users. Consequently, users would hope those time‐critical programs to finish their execution as soon as possible. Generally speaking, the course of program execution includes cooperative operation of CPU, memory, and hard disk. For CPU operation, modern computer systems have the ability to adjust the CPU scheduling sequence according to program priority. Nevertheless, most of them do not have effective ways to provide memory management and disk operation based on program priority. Consequently, it is hard to speed up the execution of prioritized programs as users would expect. The Linux operating system has been widely used in recent years. Even though it still does not support fully‐prioritized memory management and disk operation. Previously, based on the default Linux disk scheduler, complete fair queuing (CFQ), we proposed a new disk scheduling algorithm called prioritized CFQ (PCFQ) to provide fully‐prioritized disk operation. PCFQ had demonstrated good performance improvement for programs with high priority. In this paper, we report our effort to integrate PCFQ with prioritized memory management as a whole in the Linux operating system. With the cooperation between prioritized memory management and prioritized disk operation, our system further enhanced the performance that PCFQ achieved by up to 62.08%. Experimental results also showed that, compared with the current Linux system, our design can lift the performance of individual prioritized programs by up to 76.63% when there was one prioritized program on the system. The number went up to 82.45% when the system hosted three programs with high priority. Concurrency and Computation: Practice and Experience .Copyright © 2014 John Wiley & Sons, Ltd.

Buggy device drivers are a major threat to the reliability of their host operating system. There have been myriad attempts to protect the kernel, but most of them either required driver modifications or incur substantial performance overhead. This paper describes an isolated device driver execution system called SIDE (Streamlined Isolated Driver Execution), which focuses specifically on unmodified device drivers and strives to avoid changing the existing kernel code as much as possible. SIDE exploits virtual memory hardware to set up a device driver execution environment that is compatible with existing device drivers and yet is fully isolated from the kernel. SIDE is able to run an unmodified device driver for a Gigabit Ethernet NIC and the latency and throughput penalty is kept under 1% when augmented with a set of performance optimizations designed to reduce the number of protection domain crossings between an isolated device driver and the kernel.

Virtual Machine (VM) cloning is to create a replica of a source virtual machine (parent virtual machine); the replica, also called child virtual machine, owns exactly the same executing status as parent virtual machine. Fast live cloning guarantees that, during the period of cloning, the services running on the parent virtual machine observe no performance degradation. There are three important goals for fast live cloning: reducing the total cloning time, minimizing the suspension time of the parent virtual machine, and maximizing resource sharing between the parent virtual machine and the child virtual machine. This paper exploits Copy-on-Write (CoW) mechanism fully to minimize the time of duplicating active main memory and secondary storage of the parent virtual machine. As a result, out experiments show that the total cloning time of a virtual machine on Xen virtual machine monitor can be confined within several hundred milliseconds and the downtime of parent virtual machine is limited to tens of milliseconds, close to VMM’s scheduling interval. Experiments also show that the parent virtual machine highly shares memory with the child virtual machine as long as both virtual machines continue executing the same applications.

A new compressed video secure steganography (CVSS) algorithm is proposed. In the algorithm, embedding and detection operations are both executed entirely in the compressed domain, with no need for the decompression process. The new criteria employing statistical invisibility of contiguous frames is used to adjust the embedding strategy and capacity, which increases the security of proposed algorithm. Therefore, the collusion resistant properties are obtained. Video steganalysis with closed loop feedback manner is design as a checker to find out obvious bugs. Experimental results showed this scheme can be applied on compressed video steganography with high security properties.

In this paper, we describe a whole-system live migration scheme, which transfers the whole system run-time state, including CPU state, memory data, and local disk storage, of the virtual machine (VM). To minimize the downtime caused by migrating large disk storage data and keep data integrity and consistency, we propose a three-phase migration (TPM) algorithm. To facilitate the migration back to initial source machine, we use an incremental migration (IM) algorithm to reduce the amount of the data to be migrated. Block-bitmap is used to track all the write accesses to the local disk storage during the migration. Synchronization of the local disk storage in the migration is performed according to the block-bitmap. Experiments show that our algorithms work well even when I/O-intensive workloads are running in the migrated VM. The downtime of the migration is around 100 milliseconds, close to shared-storage migration. Total migration time is greatly reduced using IM. The block-bitmap based synchronization mechanism is simple and effective. Performance overhead of recording all the writes on migrated VM is very low.

This paper explores two multiclass steganalysis schemes to recognize stego algorithms in use. First of all, Xuan's universal steganalysis is improved to distinguish cover and stego images by the means of applying Bhattacharyya distance to select the most important features. Then, more attentions are paid to design two schemes to recognize stego algorithms with respect to accuracy, reliability and the decision-making cost. Experimental works show that the proposed schemes have satisfactory performance on Jpeg steganography like Jsteg, F5, Outguess and MB2.

The capsule-centric object-oriented (OO) UML-RT framework is being widely applied in modeling large-scale complex systems. Like general UML, it is important to have software patterns to cope with the complexity in the software structure and the constant changes in requirements. However, there are not yet adequate and explicit discussions on the application of software patterns in UML-RT, and it is difficult and unnecessary to develop UML-RT patterns from the scratch. In this paper, we present some suggestions to transform the widely used UML design patterns into UML-RT compliant patterns while keeping as much of the applicability, functionality and flexibility of the original patterns as possible.

UML-RT has been widely used in modeling complex embedded/real-time systems. Designers of such complex systems, however, also need a sound, systematic, and practical software process that can guide the whole development phase. In this paper, we describe a mapping between COMET and UML-RT that effectively maps COMET objects and models into UML-RT prototypes and software structures. Furthermore, based on the mapping relationship, we present a new software process that derives from COMET to address the issues of designing complex systems specifically for UML-RT. Finally, a practical example that applies this process using the UML-RT compliant CASE tool, Rational Rose Real Time, is fully discussed in order to demonstrate the applicability of the mapping and the software process.