Sharif Digital Repository

Sophisticated and targeted malwares, which today are known as Advanced Persistent Threats (APTs), use multi-step, distributed, hybrid and low-level patterns to leak and exfiltrate information, manipulate data, or prevent progression of a program or mission. Since current intrusion detection systems (IDSs) and alert correlation systems do not correlate low-level operating system events with network events and use alert correlation instead of event correlation, the intruders use low and hybrid events in order to distribute the attack vector, hide malwares behaviors, and therefore make detection difficult for such detection systems. In this paper, a new approach for detecting hybrid and... 

Targeted cyber attacks, which today are known as Advanced Persistent Threats (APTs), use low and slow patterns to bypass intrusion detection and alert correlation systems. Since most of the attack detection approaches use a short time-window, the slow APTs abuse this weakness to escape from the detection systems. In these situations, the intruders increase the time of attacks and move as slowly as possible by some tricks such as using sleeper and wake up functions and make detection difficult for such detection systems. In addition, low APTs use trusted subjects or agents to conceal any footprint and abnormalities in the victim system by some tricks such as code injection and stealing... 

Service Identification is one of the most important phases in serviceoriented development methodologies. Although several service identification methods tried to identify services automatically or semi-automatically, various aspects of business domain are not taken into account simultaneously. To overcome this issue, three strategies from three different aspects of business domain are combined for semi-automated identification of services in this article. At first, the tasks interconnections within the business processes are considered. Then, based on the common supporting requirements, another tasks dependency has been determined and finally, regarding the significant impact of data in... 

Static malware detection approaches are time-consuming and cannot deal with code obfuscation techniques. Dynamic malware detection approaches, on the other hand, address these two challenges, however, suffer from behavioral ambiguity, such as the system calls obfuscation. In this paper, we introduce Markhor, a dynamic and behavior-based malware detection approach. Markhor uses system call data dependency and system call control dependency sequences to create a weighted list of malicious patterns. The list is then used to determine the malicious processes. Next, the similarity of a file system call sequences to a malicious pattern is extracted based on a fuzzy algorithm and the file nature is... 

Static malware detection approaches are time-consuming and cannot deal with code obfuscation techniques. Dynamic malware detection approaches, on the other hand, address these two challenges, however, suffer from behavioral ambiguity, such as the system calls obfuscation. In this paper, we introduce Markhor, a dynamic and behavior-based malware detection approach. Markhor uses system call data dependency and system call control dependency sequences to create a weighted list of malicious patterns. The list is then used to determine the malicious processes. Next, the similarity of a file system call sequences to a malicious pattern is extracted based on a fuzzy algorithm and the file nature is... 

Despite the numerous researches in Stress Corrosion Cracking (SCC) risk of austenitic stainless steels in aqueous chloride solution, no formulation or reliable method for prediction of time to failure as a result of SCC has yet been defined. In this paper, the capability of artificial neural network for estimation of the time to failure for SCC of 304 stainless steel in aqueous chloride solution together with sensitivity analysis has been expressed. The output results showed that artificial neural network can predict the time to failure for about 74% of the variance of SCC experimental data. Furthermore, the sensitivity analysis also demonstrated the effects of input parameters (Temperature,... 

Energy use in buildings contributes a large part in global energy demand. To reduce energy use in this group of consumers, specially in cold seasons, an automatic control technique is proposed. In this paper, a model predictive controller (MPC) is employed to minimize the boiler activation time. The method uses the building model and incorporates the weather forecast data to act on the actuator in an optimal fashion while treating the user comfort constraints. This technique, as a part, can be embedded into the building energy management system. The building model parameters are obtained via an online identification process using unscented kalman filter (UKF). This identification is... 

This paper proposes a multi-unit building model, in which the parameters are obtained via an online identification process. The identification process is carried out on-the-fly so it can update the best model of the building units. A model predictive controller (MPC) is also employed that uses the prediction of the building model, as well as the weather forecast data and acts on the heating boiler in an optimal fashion. In addition, since the controller is designed for a multi-unit building, it is crucial to estimate the amount of the delay that takes the hot flow to reach the units. This paper presents a very simple method for the delay identification based on unscented kalman filter. For... 

A large portion of the railway bridge stock in many countries is comprised of masonry arch bridges. During recent years, more attention has been paid to the maintenance of such structures. Rehabilitation and retrofitting methods have been proposed to enhance the performance of masonry arch bridges and extend their service life. Because a large portion of forces exerted on such structures comes from the railway track and passing trains, structural elements are added to the track to reduce the forces transmitted to bridges. One such element is the ballast mat, which, according to suppliers, has a positive impact on the structural performance of the track. This paper tries to assess the effects... 

In this paper, we present an MPEG-2 video decoder implemented in our ODYSSEY design methodology. We start with an ASIP tailored to the JPEG decompression algorithm. We extend that ASIP by required software routines such that the extended ASIP can now perform MPEG2 decoding while still benefiting from hardware units common between JPEG and MPEG2. This demonstrates the ability of our approach in extending an already manufactured ASIP, which was tailored to a given application, such that it implements new, yet related applications. The implementation platform is a VirtexII-Pro FPGA. The hardware part is implemented in VHDL, and the software runs on a PowerPC processor. Experimental results show...