We propose two novel techniques for reducing the workload for malware analysis. The first technique is restricted instruction, which accelerates finding the longest common subsequence (LCS) between machine code instruction sequences of malware. The second technique is probabilistic disassembly, which can find the most probable disassembly result of a binary stream without a clue, such as debug symbols or the information of import functions. By combining the two proposals and our generic unpacker, we built an automatic malware classification system. Given an unknown malware program, the system enables malware analysts to find the most similar known malware program to this unknown one, and even estimate different/common instructions. In one of our experiments, we classified 3,233 malware samples in the wild and concluded that 75% of the samples belong to the seven largest clusters. As a result, only seven samples, one from each cluster, were required to be analyzed in order to reveal the functionality of the rest of the 75%, showing a great increase in efficiency of analysis.

BACKGROUND: Predicting intrinsically disordered proteins is important in structural biology because they are thought to carry out various cellular functions even though they have no stable three-dimensional structure. We know the structures of far more ordered proteins than disordered proteins. The structural distribution of proteins in nature can therefore be inferred to differ from that of proteins whose structures have been determined experimentally. We know many more protein sequences than we do protein structures, and many of the known sequences can be expected to be those of disordered proteins. Thus it would be efficient to use the information of structure-unknown proteins in order to avoid training data sparseness. We propose a novel method for predicting which proteins are mostly disordered by using spectral graph transducer and training with a huge amount of structure-unknown sequences as well as structure-known sequences. RESULTS: When the proposed method was evaluated on data that included 82 disordered proteins and 526 ordered proteins, its sensitivity was 0.723 and its specificity was 0.977. It resulted in a Matthews correlation coefficient 0.202 points higher than that obtained using FoldIndex, 0.221 points higher than that obtained using the method based on plotting hydrophobicity against the number of contacts and 0.07 points higher than that obtained using support vector machines (SVMs). To examine robustness against training data sparseness, we investigated the correlation between two results obtained when the method was trained on different datasets and tested on the same dataset. The correlation coefficient for the proposed method is 0.14 higher than that for the method using SVMs. When the proposed SGT-based method was compared with four per-residue predictors (VL3, GlobPlot, DISOPRED2 and IUPred (long)), its sensitivity was 0.834 for disordered proteins, which is 0.052-0.523 higher than that of the per-residue predictors, and its specificity was 0.991 for ordered proteins, which is 0.036-0.153 higher than that of the per-residue predictors. The proposed method was also evaluated on data that included 417 partially disordered proteins. It predicted the frequency of disordered proteins to be 1.95% for the proteins with 5%-10% disordered sequences, 1.46% for the proteins with 10%-20% disordered sequences and 16.57% for proteins with 20%-40% disordered sequences. CONCLUSION: The proposed method, which utilizes the information of structure-unknown data, predicts disordered proteins more accurately than other methods and is less affected by training data sparseness.

To achieve effective load balancing and a robust Grid environment, extended load forecast for computational resources is increasingly required. Thus, this paper proposes a method of predicting network and CPU load variance within a wide range, from several minutes to over a week. This is the widest range of prediction of the existing algorithms in the load of computational resources for the Grid environment. The distinctiveness of our algorithm is in using seasonal load variation for both load variance and one-step-ahead prediction. We apply seasonal fluctuation in CPU load to network load variation especially for network load variance prediction. Furthermore, the Markov model-based meta-predictor is used for one-step-ahead prediction, which is sensitive to late trends. The results of the experiments demonstrate that our algorithm gives a good curve for expected 8-day-long load variance, and makes accurate one-step-ahead predictions. The mean error rate for one-step-ahead predictions is 9.4% in the case of network load, and 6.2% in the case of CPU load. Moreover, the least mean error rate for wider range forecasts is 5.5% for network load variation, and 3.6% for CPU load variation.

The paper describes a fast and robust image registration method that can be used to create a panoramic image/video from video sequences. To estimate alignment parameters for image registration, the method computes pseudo motion vectors that are rough estimates of optical flows at each selected pixel. Using the proposed method, we implemented a software system that can, with a low-cost PC, create and display panoramic images/videos in real time.

No abstract available.

A methodology for generating an optimum software quality classification tree using software complexity metrics to discriminate between high-quality modules and low-quality modules is proposed. The process of tree generation is an application of the AIC (Akaike Information Criterion) procedures to the binomial distribution. AIC procedures are based on maximum likelihood estimation and the least number of complexity metrics. It is an improvement of the software quality classification tree generation method proposed by Porter and Selby (1990) from the viewpoint that the complexity metrics are minimized. The problems of their method are that the software quality prediction model is unstable because it reflects observational errors in real data too much and there is no objective criterion for determining whether the discrimination is appropriate or not at a deep nesting level of the classification tree when the number of sample modules gets smaller. To solve these problems a new metric is introduced and its validity is theoretically and experimentally verified. In our examples, complexity metrics written in C language, such as lines of source code, Halstead's (1977) software science, McCabe's (976) cyclomatic number, Henry and Kafura's (1981) fan-in/out and Howatt and Baker's (1989) scope number, are investigated. Our experiments with a medium-sized piece of software (85 thousand lines of source code; 562 samples) show that the software quality classification tree generated by our new metric identifies the target class of the observed modules more efficiently using the minimum number of complexity metrics without any significant decrease of the correct classification ratio (76%->72%) than the conventional classification tree.

This paper presents a beat tracking system that processes acoustic signals of music and recognizes temporal positions of beats in time. Musical beat tracking is needed by various multimedia applications such as video editing, audio editing, and stage lighting control. Previous systems were not able to deal with acoustic signals that contained sounds of various instruments, especially drums. They dealt with either MIDI signals or acoustic signals played on a few instruments, and in the latter case, did not work in real time. Our system deals with popular music in which drums maintain the beat. Because our system examines multiple hypotheses in parallel, it can follow beats without losing track of them, even if some hypotheses become wrong. Our system has been implemented on a parallel computer, the Fujitsu AP1000. In our experiment, the system correctly tracked beats in 27 out of 30 commercially distributed popular songs.

The purpose of this paper is to propose and evaluate a new scheme, called the Preceding Activation Scheme with Graph Unfolding, which translates a FORTRAN program into a dataflow graph and executes it efficiently. The problems in restructuring a FORTRAN program into a dataflow graph are that (1) a FORTRAN program is not written in a single assignment rule and (2) it has an explicit control flow. These problems result in little parallelism because many gate-operations, such as T/F gates, are introduced in the dataflow graph to synchronize the data movement. Therefore, discarding these gate-operations is the key to exposing parallelism in a FORTRAN program. In this paper, the preceding activation scheme with graph unfolding is proposed to discard these gate-operations. Then, the result of the performance evaluation by the -Harray- software simulator is presented. It is shown that the execution speed with the proposed scheme for flow graphs without backward branches is about 1.5 times as fast as that with the extended activation scheme which initiates the execution only after it is confirmed that a basic block will be selected at a conditional branch. Moreover, the execution speed is 2.7 times as fast as that with the extended activation scheme if a flow graph including backward branches are unfolded by the proposed scheme.

This paper proposes a parallel processing system -Harray- for scientific computations. Data flow computers are expected to obtain the high performance because they can extract parallelism fully from a program. However, they have many problems, such as the difficulty of controlling the sequence of execution. The -Harray- system is an array processor which adapts two levels of control mechanism; data flow execution in each processor and control flow between processors, in order to take full advantage of both mechanisms. A task which is assigned to a processor is called a “macro-block”. Three types of macro-blocking and three types of activation schemes for the macro-block which initiates its execution are introduced in order to attain the high performance. Moreover, a hardware synchronization mechanism is used to reduce synchronization overhead and to gain the liner speedup of the -Harray- system.

This paper is concerned with the problem of analyzing ordinary Fortran-like programs to determine how many of their operations could be performed simultaneously. Algorithms are presented for handling arithmetic assignment statements, DO loops and IF statement trees. The height of the parse trees of arithmetic expressions is reduced by distribution of multiplication over addition as well as the use of associativity and commutativity. DO loops are analyzed in terms of their index sets and subscript forms. Some general underlying assumptions about machine organization are also given. In terms of several measures which are defined, the results of experimental analyses are presented. About 20 Fortran IV programs consisting of nearly 1000 source cards were analyzed. Evidence is given that for very simple Fortran programs 16 processors could be effectively used operating simultaneously in a parallel or pipeline fashion. Thus, for medium or large size Fortran programs, machines consisting of multiples of a basic 16 processor unit could be used.