Metamorphic malicious code behavior detection using probabilistic inference methods

Existing antivirus programs detect malicious code based on fixed signatures; therefore, they have limitations in detecting metamorphic malicious code that lacks signature information or possesses circumventing code inserted into it. Research on the methods for detecting this type of metamorphic malicious code primarily focuses on techniques that can detect code based on behavioral similarity to known malicious code. However, these techniques measure the degree of similarity with existing malicious code using API function call patterns. Therefore, they have certain disadvantages, such as low accuracy and large detection times. In this paper, we propose a method which can overcome the limitations of existing methods by using the FP-Growth algorithm, a data mining technique, and the Markov Logic Networks algorithm, a probabilistic inference method. To perform a comparative evaluation of the proposed method's malicious code behavior detection, we performed inference experiments using malicious code with an inserted code for random malicious behavior. We performed experiments to select optimal weights for each inference rule to improve our malicious code behavior inferences’ accuracy. The results of experiments, in which we performed a comparative evaluation with the General Bayesian Network, showed that the proposed method had an 8% higher classification performance.     

认知诊断测验中的项目功能差异检测方法比较

检测项目功能差异(DIF)是认知诊断测验中很重要的问题。首先将逻辑斯蒂克回归法(LR)引入认知诊断测验DIF检测, 然后将LR法与MH法和Wald检验法的DIF检验效果进行比较。在比较中同时考察了匹配变量、DIF种类、DIF大小和受测者人数的影响。结果表明：(1) LR法在认知诊断测验DIF检测中, 检验力较高, 一类错误率较低。(2) LR法在检测认知诊断测验的DIF时, 不受认知诊断方法的影响。(3) LR法可以有效区分一致性DIF和非一致性DIF, 并有较高检验力和较低一类错误率。(4)采用知识状态作为匹配变量, 能够得到较理想的检验力和一类错误率。(5) DIF越大, 受测者人数越多, 统计检验力越高, 但一类错误率不受影响。     

Driving on familiar roads: Automaticity and inattention blindness

This paper describes our research into the processes that govern driver attention and behavior in familiar, well-practiced situations. The experiment examined the effects of extended practice on inattention blindness and detection of changes to the driving environment in a high-fidelity driving simulator. Participants were paid to drive a simulated road regularly over 3 months of testing. A range of measures, including detection task performance and driving performance, were collected over the course of 20 sessions. Performance from a yoked Control Group who experienced the same road scenarios in a single session was also measured. The data showed changes in what drivers reported noticing indicative of inattention blindness, and declining ratings of mental demand suggesting that many participants were “driving without awareness”. Extended practice also resulted in increased sensitivity for detecting changes to road features associated with vehicle guidance and improved performance on an embedded vehicle detection task (detection of a specific vehicle type). The data provide new light on a “tandem model” of driver behavior that includes both explicit and implicit processes involved in driving performance. The findings also suggest reasons drivers are most likely to crash at locations very near their homes.     

Attentional enhancement opposite a peripheral flash revealed using change blindness

We describe a new method for mapping spatial attentionthat reveals a pooling of attention in the hemifield opposite a peripheralflash. Our method exploits the fact that a brief full-field blank caninterfere with the detection of changes in a scene that occur during theblank. Attending to the location of a change, however, can overcome thischange blindness, so that changes are detected. The likelihood of detecting anew element in a scene therefore provides a measure of the occurrence ofattention at that element's location. Using this measure, we mappedhow attention changes in response to a task-irrelevant peripheral cue. Underconditions of visual fixation, change detection was above chance across theentire visual area tested. In addition, a "hot spot" ofattention (corresponding to near-perfect change detection) elongated alongthe cue-fixation axis, such that performance improved not only at the cuedlocation but also in the opposite hemifield.     

Detecting anonymous attacks in wireless communication medium using adaptive grasshopper optimization algorithm

Intrusion Detection Systems (IDSs) is a system that monitors network traffic for suspicious activity and issues alert when such activity is revealed. Moreover, the existing IDSs-based methods are based on outdated attacks that unable to identify modern attacks or malicious trends. For this reason, in this study we developed a new multi-swarm adaptive grasshopper optimization algorithm to utilize adaptation mechanism in a group of swarms based on fuzzy logic to protect against sophisticated attacks. The proposed (MSAGOA) technique has the capability of global optimization and rapid convergence that are used to attain optimal feature subsets to identify attack types on IDS datasets. In the MSAGOA technique, learning engine as Extreme learning Machine, Naive Bayes, Random Forest and Decision Tree is applied as a fitness function to select the highly discriminating features and to maximize classification performance. Afterward, select the best classifier which works as a fitness function in our approach to measure the performance in terms of accuracy, detection rate, and false alarm rate. The simulations are performed on three IDS datasets such as NSL-KDD, AWID-ATK-R, and NGIDS-DS. The experimental results demonstrated that MSAGOA method has performed better and obtained high detection rate of 99.86%, accuracy of 99.89% in NSL-KDD and high detection rate of 98.73%, accuracy of 99.67% in AWID-ATK-R and detection rate of 89.50%, accuracy of 90.23% in NGIDS-DS. In addition, the performance is compared with several other existing techniques to show the efficacy of the proposed approach.     

Cross-cultural effects on detecting multiple sources of driving hazard: Evidence from the deceleration detection flicker test

Collision rates in Malaysia are much higher than the UK; do these reflect poorer hazard perception skill or does exposure to hazardous events improve hazard detection ability? The deceleration detection flicker test (DDFT) was used to investigate the effect of experience and cross-cultural differences between Malaysian and UK drivers in their ability to detect the deceleration of a lead vehicle while simultaneously identifying any secondary hazards in side roads. Matched groups of participants with lower or higher levels of experience were recruited from the University of Nottingham in the UK and Malaysia. Malaysian drivers were significantly less accurate than UK drivers in detecting the deceleration of lead vehicles on urban roads, and significantly less accurate in detecting the presence of secondary hazards across all road types. Experienced drivers were significantly faster than novices in detecting decelerations of the lead vehicle, and were significantly more accurate in detecting the presence of secondary hazards. The study concludes that high exposure to hazardous events on the road in Malaysia does not yield expertise in this hazard perception task, although the DDFT does differentiate experience cross-culturally.     

结合选择题与主观题信息的两阶段作弊甄别方法

为提高对高分作弊者和低抄袭比例作弊者的检验力,模拟600名考生的作答,设置3种抄袭比例（60%,80%和100%）和3种抄袭源能力（能力百分等级为60%,80%和100%）,设计两阶段作弊甄别法,第一阶段使用lz指数筛选个人拟合差的异常考生,第二阶段针对这些异常考生使用ω指数进行精确甄别。结果表明该法对高分作弊者和低抄袭比例作弊者的检验力优于仅使用答案抄袭检测法。     

Does symmetry structure facilitate the depth separation between stereoscopically overlapped dot planes?

In the present study, we dealt with the problem of whether a symmetrical structure can influence the discrimination of the depth separation of overlapped dot planes. We investigated this problem with the use of both direct and indirect methods. In the direct method, we presented three or two overlapped dot planes consisting of symmetrical or random dots. The subjects were required to discriminate three overlapped from two overlapped planes. In the indirect method, the subjects were required to discriminate the depth positions of a target dot (or a pair of dots) that disappeared during stimulus presentation. Our results, obtained in three experiments, showed that the discrimination performance improved and reached a perfect level in the direct method and a modest plateau level in the indirect method with increasing relative disparity between the two outer planes, irrespective of whether the dot pattern had a symmetrical structure or not. These results suggest that a detection process for symmetry structure on a two-dimensional plane in three-dimensional space will not have a direct or an indirect connection (e.g., via a feedback loop) to a process involved in the depth separation.     

Real-time detection of drivers’ texting and eating behavior based on vehicle dynamics

With rapid advancement in cellphones and intelligent in-vehicle technologies along with driver’s inclination to multitasking, crashes due to distracted driving had become a growing safety concern in our road network. Some previous studies attempted to detect distracted driving behaviors in real-time to mitigate their adverse consequences. However, these studies mainly focused on detecting either visual or cognitive distractions only, while most of the real-life distracting tasks involve driver’s visual, cognitive, and physical workload, simultaneously. Additionally, previous studies frequently used eye, head, or face tracking data, although current vehicles are not commonly equipped with technologies to acquire such data. Also those data are comparatively difficult to acquire in real-time during traffic monitoring operations. To address the above issues, this study focused on developing algorithms for detecting distraction tasks that involve simultaneous visual, cognitive, and physical workload using only vehicle dynamics data. Specifically, algorithms were developed to detect driving behaviors under two distraction tasks – texting and eating. Experiment was designed to include the two distracted driving scenarios and a control with multiple runs for each. A medium fidelity driving simulator was used for acquiring vehicle dynamics data for each scenario and each run. Several data mining techniques were explored in this study to investigate their performance in detecting distraction. Among them, the performance of two linear (linear discriminant analysis and logistic regression) and two nonlinear models (support vector machines and random forests) is reported in this article. Random forests algorithms had the best performance, which detected texting and eating distraction with an accuracy of 85.38% and 81.26%, respectively. This study may provide useful guidance to successful development and implementation of distracted driver detection algorithms in connected vehicle environment, as well as to auto manufacturers interested in integrating distraction detection systems in their vehicles.     

Approximations to the distribution of a test statistic in covariance structure analysis: A comprehensive study

In structural equation modelling (SEM), a robust adjustment to the test statistic or to its reference distribution is needed when its null distribution deviates from a χ² distribution, which usually arises when data do not follow a multivariate normal distribution. Unfortunately, existing studies on this issue typically focus on only a few methods and neglect the majority of alternative methods in statistics. Existing simulation studies typically consider only non-normal distributions of data that either satisfy asymptotic robustness or lead to an asymptotic scaled χ² distribution. In this work we conduct a comprehensive study that involves both typical methods in SEM and less well-known methods from the statistics literature. We also propose the use of several novel non-normal data distributions that are qualitatively different from the non-normal distributions widely used in existing studies. We found that several under-studied methods give the best performance under specific conditions, but the Satorra–Bentler method remains the most viable method for most situations.     

Accounting for Missing Correlation Coefficients in Fixed-Effects MASEM

Meta-analytic structural equation modeling (MASEM) is increasingly applied to advance theories by synthesizing existing findings. MASEM essentially consists of two stages. In Stage 1, a pooled correlation matrix is estimated based on the reported correlation coefficients in the individual studies. In Stage 2, a structural model (such as a path model) is fitted to explain the pooled correlations. Frequently, the individual studies do not provide all the correlation coefficients between the research variables. In this study, we modify the currently optimal MASEM-method to deal with missing correlation coefficients, and compare its performance with existing methods. This study is the first to evaluate the performance of fixed-effects MASEM methods under different levels of missing correlation coefficients. We found that the often used univariate methods performed very poorly, while the multivariate methods performed well overall.     

A method to improve the hazard perception of young novice drivers based on Bandura’s observational learning theory: Supplement to expert commentary training

Compared with experienced drivers, young novice drivers are more likely to have traffic accidents. The main reasons are that they lack experience, their hazard perception is weak, and their visual search strategy is underdeveloped. Research shows that hazard perception training can improve the visual search strategy of young novice drivers and enhance their hazard perception ability. We propose that a driver's visual search behaviour, like any other action, can be developed by observing the behaviour of a role model. In an experiment based on a driving simulator, we clustered the visual search paths of 20 experienced drivers, selected the drivers with the best visual search behaviour, and obtained visual search path video footage to produce hazard perception training videos. Using these videos, we applied Bandura’s observation learning theory to train 20 young novice drivers. We call this approach “training based on experienced drivers' performance”. To determine the effects of training based on experienced drivers' performance, 20 young novice drivers were given the usual expert commentary training, and 20 young drivers were given no training. The results showed that training based on experienced drivers' performance and expert commentary training had positive effects on the average speed of young novice drivers through hazard sections. Compared with untrained young novice drivers, trained young novice drivers decreased their speed in response to dangerous road sections. Compared with young novice drivers who received expert commentary training and those who did not receive training, young novice drivers who received training based on experienced drivers' performance showed significant improvements in visual search. These results suggest that training based on experienced drivers' performance can help young novice drivers improve their hazard perception, especially in visual aspects. This training method can complement existing training methods for young novice drivers.     

大学英语四、六级考试分数等值研究

对现有的大学英语四、六级考试分数等值模式中存在的若干问题进行了深入的分析,并提出了新的解决方案——一个基于铆题设计和两参数IRT模型的解决方案。主要包括：（1）用两参数逻辑斯蒂模型替代原来的Rasch模型,以改进题目模型的适合性;（2）用共同题目的等值设计取代原来的共同被试等值设计,解决共同被试等值设计中,等值考生的动机水平难以控制的难题;（3）建立专用的等值用题库,并且一次性完成其中铆题的预测和参数标定工作,以解决原来等值模式中存在的误差累积问题。同时,由于铆题的保密工作难度较小,因此,等值专用题库对保证等值结果的可靠性也具有重大意义;（4）本文还对新的分数等值方案进行了真实的考试数据等值计算实验,并得到了一个令人满意的分数等值结果。     

Feature selection using Ant Colony Optimization (ACO) and Road Sign Detection and Recognition (RSDR) system

Road Sign Detection and Recognition (RSDR) is aimed to enable drivers maintain basic functionality with the aim of identifying and notifying driver through the existing restrictions so that the process is a success on the present widened road. Examples for RSDR include ‘traffic light ahead’ or ‘pedestrian crossing’ signs. An innovative RSDR system has been introduced which comprises of pre-processing, edge detection, feature extraction, features selection and Ensemble Fuzzy Support Vector Machine (EFSVM) classifier. Feature selection is carried out successfully by deployment of Ant Colony Optimization (ACO) algorithm to determine most prominent and definitive features. These features are then fed into the ensemble SVM to enable both road side traffic detection as well as recognition. Suggested system’s performance is analyzed and evaluated with respect to road signs having a capable recognition rate.     

How cyclist behavior affects bicycle accident configurations?

In many major cities, bicycle usage is on the increase and cycling safety is becoming a critical issue. Most of the existing studies are based on police data which understate both single-bicycle accidents as well as cyclist victims. In France, an estimation based on a road trauma database reveals that cyclists are 8 times more likely to be injured per hour spent on the road compared to motorists. To give a full picture of cycling accidents, as well as to understand how cyclist behavior interacts with other factors in causing accidents, we surveyed all injured cyclists in the period 2009–2011, as identified in a medical database of road trauma victims in a French territorial “départment” (the Rhône, capital city Lyon).Using classification methods we build a typology of 17 recurring configurations of cycling collisions and single-bicycle accidents: 7 concern utilitarian riding (commuting…), 3 concern recreational riding and 7 concern cycling as a sporting activity. A Multiple Correspondence Analysis (MCA) is then used to check the consistency of this typology, and to gain additional insight on road user behavior by projection of supplementary variables.External factors contributing to cycling accidents, such as “bad weather” (13%) or “riding at night” (14%), roadway configuration such as “cycling infrastructure” (16%) or “intersections” (25%), and cyclist behavior such as “alcohol consumption” (5%) or “speed” (25%) are discriminatory variables that interact in many accident configurations. This study shows how road user behavior-influences each step in the chain of events leading to an accident. In the discussion of study results, some recommendations are made to public authorities aimed at improving cyclist safety.     

Acquisition and retention of a letter-detection skill

In two experiments, we examined the acquisition and retention of a letter-detection skill with a consistent-mapping procedure. In Experiment 1, subjects were trained from 0 to 4 sessions at detecting the letter H in displays containing random letters, and retesting occurred after a 1-month delay. Performance improved and in some cases became more automatic, and the performance level was maintained over the retention interval. When tested with a prose passage, the high error rate on the word THE was eliminated after training and after the retention interval, regardless of the amount of training. In Experiment 2, two subjects were given 12 sessions of training followed by a retention test 6 months later. For 1 subject there was also a retention test 15 months after acquisition. Performance improved dramatically with training, and substantial but not complete automaticity was achieved. Performance on the retention tests was close to the final acquisition level. The surprising lack of forgetting in this study was contrasted with the substantial forgetting typically found in studies of verbal learning.     

A comparison of maximum covariance and K-means cluster analysis in classifying cases into known taxon groups

Maximum covariance (MAXCOV) is a method for determining whether a group of 3 or more indicators marks 1 continuous or 2 discrete latent distributions of individuals. Although the circumstances under which MAXCOV is effective in detecting latent taxa have been specified, its efficiency in classifying cases into groups has not been assessed, and few studies have compared its performance with that of cluster analysis. In the present Monte Carlo study, the classification efficiencies of MAXCOV and the k-means algorithm were compared across ranges of sample size, effect size, indicator number, taxon base rate, and within-groups covariance. When the impact of these parameters was minimized, k-means classified more data points correctly than MAXCOV. However, when the effects of all parameters were increased concurrently, MAXCOV outperformed k-means.     

Pedestrian detection using a moving camera: A novel framework for foreground detection

While background subtraction techniques have been widely applied to detect moving objects in a video stream captured by a static camera, detecting moving objects using a moving camera still represents a challenging task. In this context, pedestrian detection using a camera placed on the top of a vehicle’s windshield has been rarely investigated. This is mainly due to the background ego-motion. Since the scene captured by the camera seems in motion, it is very difficult to distinguish the moving pedestrians from the others that belong to the static part of the scene. For this reason, a compensation step is needed to suppress the ego-motion. This paper presents a study on the main challenges facing pedestrian detection systems as well as methods proposed to handle these challenges. A novel trajectory classification framework for detecting pedestrians even in challenging real-world environments is proposed. The proposed method models the background motion between two consecutive frames in order to compensate the camera motion. Then, it defines a classification process that differentiates between the background and the foreground in the frame. Using the defined foreground, we consequently identify the presence of pedestrians in the scene. The proposed method was validated on a public benchmark dataset: CVC-14 containing both visible and far infrared video sequences in day and night times. Experimental results confirm the effectiveness of the proposed approach in capturing the dynamic aspect between frames and therefore detecting the presence of pedestrians in the scene.     

Perceptual learning and recognition confusion reveal the underlying relationships among the six basic emotions

The six basic emotions (disgust, anger, fear, happiness, sadness, and surprise) have long been considered discrete categories that serve as the primary units of the emotion system. Yet recent evidence indicated underlying connections among them. Here we tested the underlying relationships among the six basic emotions using a perceptual learning procedure. This technique has the potential of causally changing participants’ emotion detection ability. We found that training on detecting a facial expression improved the performance not only on the trained expression but also on other expressions. Such a transfer effect was consistently demonstrated between disgust and anger detection as well as between fear and surprise detection in two experiments (Experiment 1A, n?=?70; Experiment 1B, n?=?42). Notably, training on any of the six emotions could improve happiness detection, while sadness detection could only be improved by training on sadness itself, suggesting the uniqueness of happiness and sadness. In an emotion recognition test using a large sample of Chinese participants (n?=?1748), the confusion between disgust and anger as well as between fear and surprise was further confirmed. Taken together, our study demonstrates that the “basic” emotions share some common psychological components, which might be the more basic units of the emotion system.