Seeing the Unseen: Revealing Mobile Malware Hidden Communications via Energy Consumption and Artificial Intelligence

Size: px
Start display at page:

Download "Seeing the Unseen: Revealing Mobile Malware Hidden Communications via Energy Consumption and Artificial Intelligence"

Transcription

1 Seeing the Unseen: Revealing Mobile Malware Hien Communications via Energy Consumption an Artificial Intelligence Luca Caviglione, Mauro Gaggero, Jean-François Lalane, Wojciech Mazurczyk, Marcin Urbanski To cite this version: Luca Caviglione, Mauro Gaggero, Jean-François Lalane, Wojciech Mazurczyk, Marcin Urbanski. Seeing the Unseen: Revealing Mobile Malware Hien Communications via Energy Consumption an Artificial Intelligence. IEEE Transactions on Information Forensics an Security, Institute of Electrical an Electronics Engineers, 2016, < /TIFS >. <hal > HAL I: hal Submitte on 22 Dec 2015

2 HAL is a multi-isciplinary open access archive for the eposit an issemination of scientific research ocuments, whether they are publishe or not. The ocuments may come from teaching an research institutions in France or abroa, or from public or private research centers. L archive ouverte pluriisciplinaire HAL, est estinée au épôt et à la iffusion e ocuments scientifiques e niveau recherche, publiés ou non, émanant es établissements enseignement et e recherche français ou étrangers, es laboratoires publics ou privés.

3 1 Seeing the Unseen: Revealing Mobile Malware Hien Communications via Energy Consumption an Artificial Intelligence Luca Caviglione, Mauro Gaggero, Jean-François Lalane, Wojciech Mazurczyk, an Marcin Urbański Abstract Moern malware uses avance techniques to hie from static an ynamic analysis tools. To achieve stealthiness when attacking a mobile evice, an effective approach is the use of a covert channel built by two colluing applications to locally exchange ata. Since this process is tightly couple with the use hiing metho, its etection is a challenging task, also worsene by the very low transmission rates. As a consequence, it is important to investigate how to reveal the presence of malicious software by using general inicators such as the energy consume by the evice. In this perspective, the paper aims to spot malware covertly exchanging ata by using two etection methos base on artificial intelligence tools such as neural networks an ecision trees. To verify their effectiveness, seven covert channels have been implemente an teste over a measurement framework using Anroi evices. Experimental results show the feasibility an effectiveness of the propose approach to etect the hien ata exchange between colluing applications. Inex Terms Energy-base malware etection, covert channels, colluing applications, neural networks, ecision trees. I. INTRODUCTION Moern malware uses avance techniques to efeat static analysis tools or live etection systems. Even if esigning a malware is nowaays consiere quite common [1], the most avance programmers try to hie malicious behaviors by using ifferent techniques, such as the repackaging of legitimate applications or the obfuscation/ciphering of coe. Besies, by automating such mechanisms, a single attacker can a malicious coe to several applications that may be sent This research was partially supporte by the Polish National Science Center uner grant no. 2015/18/E/ST7/ L. Caviglione an M. Gaggero are with the Institute of Intelligent Systems for Automation, National Research Council of Italy, Genoa, Italy ( luca.caviglione@ge.issia.cnr.it; mauro.gaggero@cnr.it). J.-F. Lalane is with the INSA Centre Val e Loire, Bourges, France an with the CIDRE team, CentraleSupélec/Inria, Rennes, France ( jean-francois.lalane@insa-cvl.fr). W. Mazurczyk an M. Urbański are with the Warsaw University of Technology, Institute of Telecommunications, Warsaw, Polan ( wmazurczyk@tele.pw.eu.pl; m.urbanski@stu.elka.pw.eu.pl). The source coe of the covert channels an the measurement framework escribe in this paper is available online at c 2015 IEEE. Personal use of this material is permitte. Permission from IEEE must be obtaine for all other uses, in any current or future meia, incluing reprinting/republishing this material for avertising or promotional purposes, creating new collective works, for resale or reistribution to servers or lists, or reuse of any copyrighte component of this work in other works. This article is a post-print version of the paper publishe in IEEE Transactions on Information Forensics an Security with DOI /TIFS to alternative markets. As a consequence, classical signaturebase methos have limite results [2]. One of the most avance mechanisms use by malware to exfiltrate information or to bypass the security frameworks of mobile evices relies upon information-hiing techniques to exchange ata between ifferent processes. Especially, as in the case of smartphones, a local covert channel can be use to setup a communication path between two colluing applications to extract personal information [3], [4]. As it has been observe in [5], mobile evices are particularly prone to hien-communication attacks ue to their variety of harware resources, as they incorporate cameras, GPS, WLAN, Bluetooth, cellular networks, an many sensors. Moreover, malware evelopers turne a significant portion of their attention to mobile evices, leaing to an increase of 10% in mobile malware over the past two years [6]. Therefore there is an urge for research efforts to esign original countermeasures an enable early prevention. Unfortunately, this is very ifficult since the etection strictly epens on the type of covert channel. For instance, exploiting electromagnetic signals to covertly transmit ata is very ifferent from manipulating the statistics of the available RAM to embe secrets [5]. Aitionally, covert channels typically achieve limite banwiths, thus increasing the complexity of fining out whether a hien exchange is ongoing. In this perspective, a promising approach aims at exploiting general information to etect covert channels. A recent ebate has emerge about the possibility of using the power consumption as an inicator to ientify malicious activities. Despite [7] claims that malware cannot be etecte by highlevel applications measuring energy consumption of processes, other works emonstrate that proper power measurements can reveal some threats [8] [10]. In this paper, we show the feasibility of using measurements of the energy consume by a evice to etect malware exploiting a covert channel. To this aim, we have implemente five popular covert channels available in the literature targeting the Anroi platform [4], [11], together with two new ones. Further, we have evelope an experimental setup to quantify the energy consumption of the software components running on a mobile evice. In more etails, we have use measurements provie by the high-level moel of PowerTutor [8] together with values available in the /sys portion of the file system [10], [12]. To perform the etection, we evelope an approach base on two well-known artificial intelligence tools, i.e., neural

4 2 networks [13] an ecision trees [14]. They are able to learn from a set of past collecte energy measurements whether hien communication is present, an then reveal threats. Specifically, two etection methos have been evelope, each one using both neural networks an ecision trees. The first approach requires the solution of a regression problem to preict the future behavior of energy consumption. A hien communication is spotte if the ifference between the actual an preicte consumption excees a certain threshol. The secon metho is base on a classification problem, an provies information on hien communications by using a set of features characterizing the energy behavior of the evice. The consiere artificial intelligence tools have been alreay use to reveal malicious coe [15], [16] or to prevent the execution of hazarous software on Anroi evices [17]. However, no previous works using energy consumption to spot information-hiing-capable malware exist in the literature. To summarize, the main contributions of this paper are: (i) showcase the feasibility of using energy footprints for the etection of malware implementing information-hiing techniques, (ii) the creation of an a-hoc testbe an a hybri measurement metho to characterize seven covert channels, incluing two new implementations, an (iii) the evelopment of two intelligent frameworks to perform the etection with low computational requirements. The rest of this paper is structure as follows. Section II reviews the literature ealing with the etection of malware by using energy measurements. Section III etails the reference scenario an the consiere covert channels, while Section IV escribes the methoology use for the measurements of power consumption. Section V introuces the two etection methos base on neural networks an ecision trees, an Section VI iscusses experimental results. Finally, Section VII conclues the paper. II. RELATED WORKS Anomaly etection using energy footprints has been partially investigate in the literature, primarily for malware an network attacks. However, at best of the authors knowlege, it has never been applie to covert channels. In general, energy-base anomaly etection methos are groupe accoring to how measurements are performe. In more etails, we have the following approaches. 1) System-base [7], [18] [20]: an energy footprint is create by consiering the whole consumption of the evice or some specific sets of applications an/or harware parts. The obtaine ata represents the clean system that serves as a baseline for malware iscovery. 2) Application-base [21]: similarly to the previous case, an energy footprint is create for a well-efine pool of applications (e.g., games), an each one is measure separately. The collecte traces are then compare at runtime against the ata obtaine with a single-process granularity. 3) User-base [22] [24]: an energy footprint is create by analyzing the typical behavior of users an the relate power consumption. This also inclues, for instance, the applications an evice features that are active, as well as their timing statistics. 4) Attack-base [9], [10], [25] [27]: measurements are one while real attacks or malicious malware activities are performe in a controlle environment. The acquire traces form a atabase of energy signatures use for the etection. It is worth noting that methos belonging to the first three groups can potentially eal with unknown threats, while the last one only allows to recognize attacks for which signatures are available. Concerning system-base methos, Jacoby et al. [19] emonstrate how to reveal network attacks by using a battery-base Intrusion Detection System (IDS) analyzing the power consumption an the utilization levels of some critical harware/software components like the CPU. Later, Nash et al. [20] propose to estimate the energy footprint of a esktop computer by using a multiple linear regression moel consiering the CPU loa, rea/write accesses to the storage unit, an network transmissions. To evaluate the presence of malicious activities, the measure parameters are combine with performance ata counters available in the operating system, an the results are compare with ifferent threshols. Such approach was proven to be effective, but its main rawback is the complexity to compute proper numerical values for the neee threshols. Liu et al. [18] propose the VirusMeter tool for Symbian smartphones that computes the energy profile for the whole clean system. The user is alerte by using a heuristic to compare the actual energy consumption with a reference value. Lastly, Hoffman et al. [7] performe comprehensive experiments with both artificial an real-worl malware using observation winows of ifferent lengths. They create energy footprints in a controlle setting for the IEEE 2.11 an 3G harware of a smartphone, an the resulting power consumption was treate as a baseline for etection. Even if such an approach is effective, the main contribution of the work is about the noise level of tools use for measurements: the aitional power consume by a malware is often too small to be etectable with the resolution of many measurement software. Among the techniques using application-base methos, the most notable work has been propose by Kim et al. [21], where the power consumption is monitore to etect malware in Winows Mobile evices. Their proof-of-concept solution is base on the energy footprints of the applications running on the smartphone, which are compare against clean consumption templates. Concerning methos explicitly consiering the behavior of the user, Dixon et al. [22] [24] showe that there is a strong correlation between the battery rain of a mobile evice an the user s location. This can be exploite to etermine the average power consumption for ifferent locations an make the etection of abnormalities more efficient. In fact, instea of consiering the require power only as a function of time, location-specific energy profiles are use as aitional inicators. Regaring attack-base approaches, Buennemeyer et al. [26] investigate the energy signatures of some network threats

5 3 against mobile evices. In more etails, the power consumption of a evice is correlate with IEEE 2.11 activities. If an irregularity is iscovere, it is compare with existing signatures to perform the etection of the attack. Then, each mobile evice exchanges alerts with peers, thus implementing a istribute network IDS. This work has been further extene by moifying the rates at which the battery status is polle, an by consiering the activity of the Bluetooth air interface to increase the performance in terms of correct etections [27]. Moreover, Caviglione an Merlo [9] focuse on how antivirus an network attacks such as port scan an ping floos impact over the battery epletion of ifferent smartphones. They state the nee for green security mechanisms to effectively evelop consumption-base malware etection systems [28]. Curti et al. [25] stuie the energy footprints for benign applications like Skype or YouTube an also for network attacks like Denial of Service. They also provie a power consumption moel for the harware involve in IEEE 2.11 communications allowing to istinguish a normal traffic pattern from a network threat. This work has been further extene by Merlo et al. [10] by analyzing the feasibility of porting the two aforementione approaches on Anroi evices with the aim of eveloping a malware etection framework. Unfortunately, the propose solutions turne out to be unsuitable, mainly ue to implementation issues, which can be overcome by introucing the irect observation of power consumption from the battery harware without the nee to well eeply into the rivers. Literature also inicates that future research irections shoul consier hybri approaches, i.e., the power consumption shoul be enriche with aitional information such as the memory usage. Even if hybri approaches are possible, they are typically implemente in a stanalone fashion [19] or as a part of a larger network-base IDS (see, e.g., [26]). Furthermore, the technology evolves very ynamically, thus stuies performe even few years ago coul quickly become obsolete as functionality an capabilities of moern evices significantly outrun the ol ones. III. COVERT CHANNELS In this section, we escribe how a prototypical malware exploiting a local covert channel to secretly leak sensitive ata has been evelope, an how we have stuie its main characteristics. A. Reference Scenario We consier the typical scenario epicte in Figure 1, where a malware compose of two colluing applications exchanges ata through a local covert channel built within the evice in orer to exfiltrate sensitive information [3], [4], [11]. In more etails, the processccsener has access to the ata but has not the permission to use the network. Instea, the colluing application CCReceiver has access to the network, hence it is able to exfiltrate the receive ata to an external server or a Comman & Control (C&C) facility. Obviously, the communications of theccreceiver towars the C&C coul be etecte, for instance, by inspecting the traffic prouce Fig. 1. Typical communication scenario of two colluing parts of a malware: CCSener an CCReceiver exchange ata through a local covert channel. by the evice. Thus, it is common to use other informationhiing methos to buil a network covert channel within the prouce flow. For instance, some malware uses a TOR client to reach the server anonymously, making classic traffic analysis ineffective [29]. Consequently, analyzing an encrypte flow of information prouce by the CCReceiver oes not help to reveal the presence of a malware, an this is why this paper focuses on the etection of the local covert channel itself. Moreover, we assume that the malware monitors the operations performe by the user in orer to transmit ata when he/she is not active [30]. Inee, waking up the covert channel uring user s activity coul egrae the performances of the evice an reveal the presence of the threat. To this aim, many moern malware elay their activation in orer to be invisible or not rise attention. Thus, even if the triggering of the malware may occur at any time, it is more likely to happen when the user is not active. For example, the families of malware DroiKungFu 1 an 2 inclue a time bomb mechanism that triggers the malicious behavior after a preefine perio of time [31]. With such a protection, a malware woul be running statistically when the smartphone is ile. Therefore, we focus on such low attention-raising hazars operating when the evice is ile since they are the preferre choice to perform attacks an to avoi etection [3]. B. Implemente Covert Channels For experimental purposes we implemente on the Anroi platform seven local covert channels between the processes CCSener an CCReceiver. Five of them have been alreay propose in the literature an they are liste as follows. 1) Type of Intent [11]: the secret receiver registers 256 types of intent listeners an the secret sener encoes ata by choosing an sening an intent of the right type. 2) File Lock [32]: the secret sener communicates by locking a file. The secret receiver also tries to lock the same file an, if it succees, a 0 is inferre. Otherwise, an exception is raise, meaning that the secret sener has locke the file before the secret receiver. In this case, a 1 is receive. 3) System Loa [11]: the secret sener sens a1by burening the CPU of the evice. The secret receiver checks how many clock ticks the sener has got since the previous iteration. If the value is greater than a certain threshol, a 1 is inferre, a 0 otherwise. 4) Volume Settings [32]: the secret ata is encoe into the ringtone volume level of the evice. If the sener can use

6 4 TABLE I MEASURED BANDWIDTHS (IN BITS PER SECOND) FOR THE CONSIDERED COVERT CHANNELS COMPARED TO THE THEORETICAL VALUES. Covert Channel Th. Banwith Meas. Banwith Type of Intent 15K File Size 2K Memory Loa File Lock System Loa Volume Settings Unix Socket Discovery eight levels of volume, it can sen up to three bits per iteration. 5) Unix Socket Discovery [11]: the secret ata is sent by encoing the information within the state of a socket. Specifically, a close socket is equal to 1, while an opene one is equal to 0. Aitionally, we propose the following two new covert channels that up to now were only teste in a theoretical fashion. 6) File Size: the secret sener sets the size of a share file an the secret receiver interprets it as a byte. 7) Memory Loa: the secret receiver acquires the initial memory loa of the secret sener. Then, the secret sener inflates the allocate ata to sen a1or releases memory to sen a 0. Before investigating the relate energy footprints, we conucte a performance evaluation to assess the correctness of the implementation, also in the perspective of removing possible power-hungry bugs that can voi measurements. The literature provies theoretical limits an/or performance evaluations in a very mixe set of testbes an with early implementations of the Anroi operating system an outate smartphones. Thus, we investigate the ata throughput to unerstan whether the available reference values are still vali. For this roun of tests, we use a Samsung Galaxy SIII smartphone. Table I reports the mean bitrate achieve by each covert channel average over repeate trials together with the estimate capacities as provie in the relate references. In more etails, the measure values highly iffer from those provie in the literature. This is mainly ue to changes in the Anroi platform an in the evice rivers, hence confirming the high variability of performances as the result of a tight coupling between covert channels an the harware/software architecture. Besies, the best obtaine throughput is equal to bit/s for the case of the Type of Intent covert channel, while the lowest is 6.43 bit/s for the System Loa metho. At least four methos have similar maximum banwiths, which suggests that we have reache some limits within the Anroi platform. IV. MEASUREMENT METHODOLOGY In this section we present the methoology use to measure the power consumption of the malware base on colluing applications exchanging ata through covert channels. To have reliable ata, we first investigate the literature to fin the Fig. 2. PowerTutor EnergyCollector CCSener collecte measures Anroi kernel monitor processes intents CCReceiver Box iagram of the energy measurement architecture. covert channel most suitable ways to gather information on the power use by applications running on Anroi evices. As pointe out in [10], the energy can be measure at high level using the Anroi APIs or at low level by probing the battery river. Performing measures at low level is a ifficult task, as it requires to patch the battery river to get access to fine-graine ata. Unfortunately, using high-level APIs may lea to values with a poor egree of reliability. For example, [10] an [12] report that high-level ata is not accurate enough to etect some form of network attacks, an also proposes an alternative mechanism efine as mile-level exploiting information store in the /sys portion of the file system such as the instantaneous voltage of the battery. Base on these results, we ecie not to collect lowlevel energy values for two main reasons: this technique requires eep changes in the operating system, thus lacking of portability, an has a non-negligible consumption that can mask the one of the covert channel use by the colluing applications. Instea, to quantify the power epletion we relie upon: (i) high-level energy consumption measures of each process running on the system, for which we use a moifie version of PowerTutor [8], i.e., we evelope a patch to enable the tool to sen ifferent process consumption to a proper ata collector via an Anroi intent; (ii) mile-level energy consumption information acquire by gathering current an voltage values store in /sys. We point out that since our objective is the etection of a threat without recurring to ata relate to the power consume by the network subsystem, our effort of using a mixe high- an mile-level methoology is novel [33]. We evelope a measurement framework both for collecting ata an automatize the experiments. Figure 2 epicts the box iagram an the major interactions among the ifferent subsystems. In particular, the EnergyCollector is the controller of the experiments an is in charge of running repeate trials an collecting ata measure by PowerTutor from APIs an /sys. The latter receives gathere ata each secon through an intent. Obviously, the communication flow between the EnergyCollector an the CCsener/CCreceiver woul not exist on a real system, an is only use to repeat the experiments. Nevertheless, after measuring the overhea, we can assume the impact of intents in terms of aitional power as negligible. For each covert channel, we conucte repeate trials accoring to the following flow: 1) the EnergyCollector waits a ranom time; 2) the EnergyCollector sens an intent to the CCsener to start a covert transmission; 3) CCsener an CCreceiver exchange a message;

7 ) CCreceiver sens an intent to notify the EnergyCollector that the transmission is finishe; 5) the experiment is repeate. The ranom time inserte in the step 1) ensures that the beginning of the covert channel transmission is not known a priori an that two ifferent exchanges are not triggere within a given timeframe. This enables to have an unpreictable behavior, which is more coherent with real-worl use cases (a iscussion on malware ranomly activating is provie in [34] an [35]). The uration of the transmission epens on the type of the covert channel since each one has a ifferent banwith, as iscusse in Section III. offline online Fig. 3. past collecte measurements non-optimize moel actual measurements optimization of the parameters (training phase) optimize moel optimize moel covert channel yes covert channel no Two-step proceure for the etection of covert channels. V. ENERGY CONSUMPTION AND BLACK-BOX MODELING The basic iea of our approach is to etect covert communications among colluing applications by using the energy requirements of the processes running on a evice as a marker. The main benefit is the ecoupling of the etection of the covert channel from its implementation. In fact, hien communications are tightly couple with the aopte carrier an are characterize by a very low bitrate, thus making their spotting very ifficult an poorly generalizable. To etect covert channels, two general problems have to be aresse: (i) eveloping an approximate moel for the power consumption of a process, an (ii) using the obtaine information to recognize whether a covert channel is present. Achieving such goals is challenging, especially ue to the ifferent sources of power rains, e.g., transmissions over air interfaces, memory operations, CPU- or I/O-boun behaviors, an user to kernel space switches [36]. Thus, we propose two general methos base on the black-box moeling approach. The first technique, enote as regression-base etection (RBD), uses a regression fe with past values of the consumption in a clean system to preict its future behavior. Then, if the expecte energy footprint eviates too much from the real one, hien communication is assume present. The secon approach, enote as classification-base etection (CBD), exploits a reuce set of features escribing the energetic behavior of the evice. More specifically, a classification problem is solve to etect covert communications between colluing applications. To this aim, well-known artificial intelligence tools, such as one-hien-layer feeforwar neural networks an binary ecision trees, are use to moel the power consumption. The RBD an CBD approaches are compose by two steps, as shown in Figure 3. First, a moel of the power consumption is constructe base on a set of past collecte measurements. This requires the solution of an optimization problem to fin the best values of the parameters the moel epens upon. Such a step is calle training, an the collecte measures constitute the training set. This may be computationally emaning, but it is usually performe offline an not on the mobile evice. Secon, the optimize moel is use to etect covert communications base on the new, actual measurements of power consumption. This step can be performe online, i.e., at runtime on the evice. A. Neural Networks an Decision Trees In this section, we introuce the tools use to construct the approximate moels of power consumption. Both are employe in the literature to approximate unknown relationships between input an output variables without any a-priori knowlege on the unerlying ynamics. They can be use to solve either regression or classification problems [37]. Regression moels map the input space into a real-value omain. Instea, classifiers map the input space into preefine classes. The relationships between inputs an outputs are learne from the collecte ata an then use to associate an output to new, unseen inputs. Neural networks belong to the family of parametric approximators, as their output significantly epens on the parameters that efine the structure of the moel, whereas ecision trees are usually referre to as nonparametric approximators, i.e., they strongly epen from the available ata an, less significantly, from a reuce set of parameters. As sai, the goal is to approximate an input/output mapping x i y i, where x i R n is the input an y i R m is the corresponing output. The unknown functional relationship between inputs an outputs is approximate by a function γ belonging to a family Γ of parametrize functions, i.e., ỹ i = γ(x i,α) (1) where α R p is a vector of parameters an ỹ i R m is the estimate value of y i. In recent years, the literature of learning from ata has mainly concentrate on the use of nonlinear moels for the approximation of complex systems. In fact, it has been prove from both theoretical an numerical viewpoints, that classical linear moels may be computationally intractable for the approximation of complex functions, especially in the case of high imensionality of the input variables (see, e.g., [38] [40] an the references therein). On the contrary, it has been shown that nonlinear structures have a greater flexibility an guarantee goo approximations with a smaller number of parameters. One-hien-layer feeforwar neural networks are a very popular nonlinear architecture alreay use to moel a variety of systems (see, e.g., [41], [42] an references therein). In this paper we focus on neural networks with sigmoial activation functions. They enjoy the universal approximation property,

8 6 i.e. the ability to approximate any well-behave function with arbitrary precision [43], [44]. The function γ is given by a linear combination of parametrize basis functions, with a certain number of free parameters to be optimize insie. For scalar outputs, we have ( ν q γ(x,α) = c k σ a kj x j +b k )+c 0 k=1 j=1 where σ( ) is the activation function, ν is the number of basis functions (i.e., the neurons) an α col(a k,b k,c k,c 0 ) R p is the vector of free parameters. Concerning binary ecision trees, they are wiely-iffuse moels for learning (see, e.g., [14], [37], [45], [46] an the references therein). The output of the moel is compute via a binary partition of the input space into smaller subsets calle leaves, with sies parallel to the coorinate axes, in which the values of the output are constant. Each split pursues certain performance goals an is repeate until a stopping criterion is met. The partition is calle a tree since the leaves are ae recursively with binary splits to form a tree structure. Two ifferent types of trees exist epening on whether they are use to solve regression or classifications problems. In the case of regression trees, a constant output value is assigne to each leaf, corresponing to the average of the observe output values therein. By contrast, a certain label is assigne to the terminal leaves in classification trees. In both cases, to avoi overfitting, the obtaine tree is usually prune accoring to some regularization costs [37]. In this paper, we focus on binary trees, in which each step of a preiction involves checking the value of only one variable at a time. The functional relation γ in (1) is then approximate by means of a piecewise-constant function over the various partitions. After choosing the family of functions Γ, we nee to fin an element γ Γ capable of reproucing at best the system behavior. This correspons to a training proceure to optimize the parameters on the basis of the available ata. To this purpose, a suitable inex is use to measure the iscrepancy between the estimate moel output ỹ i for a certain value of the parameters an the real measure output values y i. The most use metric is a mean square error (MSE) criterion: the optimal parameter vector α is the one that minimizes the quaratic ifference between the real output variables an the estimate ones, i.e., α min α R p { 1 N } N (y i γ(x i,α)) 2 i=1 where N is the number of samples use for the training. In general, the training phase may be computationally emaning, especially for large values of N. However, many ahoc-evelope proceures are available in the literature (see, e.g., [47], [48]). Usually, they are implemente in efficient software packages, allowing to solve the training problem in a reuce amount of time. B. Regression-Base Detection The RBD metho is compose of two steps: the first consists in moeling the power consume in a clean system, i.e., when no colluing applications performing hien ata exchanges are present in the evice. To this en, a collection of past values of the consumption are use to preict the future ones. The secon step is base on a comparison between the forecast consumption an the actual one. Hien communication is spotte if the expecte energy footprint eviates too much from the real one. In more etails, we efine the following quantities at each sampling time t = 0,1,... Let p t R + be the power consume by a process at time t. Such a quantity is measure an can be consiere as an input. Let w t+1 R + be the preiction of the power neee by the process itself at the next time instant t+1, i.e., it is an output. At least in principle, the consumption of a process at time t+1 may epen on the energy requirements at the previous time instants, from 0 to t. However, to avoi ealing with vectors of increasing imension as the time grows, we consier a faing memory assumption, which consists in assuming that the output of the system (i.e., the power consumption of a process at time t+1) epens only on a finite number q of past inputs [49]. In this perspective, we efine a regression vector (also calle regressor) as the collection of the past input variables from time t q + 1 up to time t, i.e., p t col(p t q+1,p t q+2,...,p t ) R q, where q is a positive constant value. Thus, the training set for the creation of the moel has the form of a set of input/output pairs Σ N { p t,w t+1 } N t=1 where N is the total number of available measures. The goal is to fin a moel that is able to capture, at each time t, the functional relationship between past an future consumption, i.e., the mapping p t w t+1. Thus, equation (1) becomes w t+1 = γ(p t,α) where w t+1 is the estimate output at timet+1 anγ is a function belonging to a family Γ of one-hien-layer feeforwar neural networks or binary ecision trees. Notice that, when the regressor is mae up by long series of past observations, the imensionality of the problem rapily increases, hence the nee of efficient approximators arises. Once the best moel within the class Γ has been foun by the offline training proceure, the secon step of the RBD metho requires the efinition of a etection rule. Specifically, the etection is performe online by feeing at each time step t the traine moel with the past q measurements of the consumption collecte into the regressor p t 1. Then, the estimate consumption w t is compare with the real measure value w t in a time winow moving over time. The same proceure is repeate at the next time steps, an a preiction error e t is efine as follows: e t 1 t w k w k (2) τ k=t τ+1 where τ is a given time horizon. We assume that a covert communication among two colluing applications is present if the preiction error is greater than a certain positive threshol

9 7 ξ. Otherwise, it is consiere absent. The rationale is that the approximate moel, if properly traine, is able to preict the future behavior of the energy consumption of the clean system with a goo level of accuracy. Hence, severe eviations reveals the presence of two processes covertly exchanging ata. Clearly, the performance of the RBD epens on the quality of the approximating moel an on the parameters q, τ, an ξ, which have to be properly tune. We will observe their impact on the quality of etection in a real scenario in Section VI. Notice that the same moel γ can be use to etect covert communications with all the seven covert channel types escribe in Section III since it has been obtaine using measurements obtaine in a clean system. C. Classification-Base Detection The CBD metho consists in solving a classification problem starting from a set of measurements both in the presence an in the absence of colluing applications. It requires the efinition of a set of features representing the power consumption of the evice in a concise, effective manner. More specifically, we focus on three ifferent features characterizing the energetic behavior of a process at each time t, collecte into the vector x t R 3 : (i) the average power consumption from time t λ + 1 to time t, where λ is a positive constant efining a winow of past measurements, (ii) the total variation of the power consumption from time t λ+1 to time t, an (iii) the instantaneous consumption at time t. Thus, we focus on the following vector of features at each time t: ( t ) t f t col p l, p l, p t R 3 (3) l=t λ+1 l=t λ+1 Each vector f t refers to a single measurement an is associate to a certain class k among two possible ones, corresponing to the cases in which covert channels are use to exchanging ata between colluing applications (k = 1) an no covert channels are establishe (k = 0). The training set for the creation of the moel takes on the form of a set of N input/output pairs { } N Σ N f t,g t t=1 where the scalar output g t is equal to k if the input vector f t belongs to the class k. The goal is to fin a moel able to recognize the class containing a given input vector that is not among the N use for the training. As in the case of the RBD metho, we rely upon moels belonging to a certain family Γ of one-hienlayer feeforwar neural networks an binary ecision trees, i.e., equation (1) becomes: g j = γ(f j,α) where g j is the class assigne to the input vector f j by the moel. The output g j must be one of the two possible classes. Clearly, the goal of the classification is to ensure that the assignment of the moel is correct, i.e., the ifference between TABLE II PARAMETERS OF THE RBD AND CBD DETECTION METHODS. Metho Parameter Description q Length of the regressor RBD τ Time winow of the preiction error ξ Threshol of the preiction error CBD λ Time winow for feature construction g j an g j is as small as possible. To this en, as in the case of the RBD, a suitable training phase is performe offline to fin the optimal values of the parameter vector α. Once the best moel within the family Γ has been foun, at each time t the etection whether a covert channel is present is performe online by feeing the traine moel with the vector f t of the current features an analyzing the value of the output g t. Differently from the RBD metho, where the same approximate moel is use to etect covert communications with all the seven techniques introuce in Section III, the CBD approach requires the training of a ifferent moel for each covert channel. We point out that the accuracy of the CBD epens on the quality of the approximating moel an on the parameter λ use to construct the vector of features. Section VI will iscuss its impact on the quality of etection in a real scenario. Notice that the CBD requires the tuning of only this parameter, whereas the RBD relies upon three parameters. Table II summarizes the main parameters of the two consiere etection methos an their meaning. VI. NUMERICAL RESULTS To evaluate the effectiveness of the propose approach, we conucte experimental trials using two ifferent smartphones, i.e., a Samsung Galaxy SIII an a LG Optimus 4X HD P8. We teste the RBD an CBD methos using Matlab with the Neural Networks an Statistics Toolboxes. All the experiments were one on a computer with a 2.5 GHz Intel i7 CPU an 4 GB of RAM. A ataset containing the consumption of all the software components running on the smartphones was generate using the methoology presente in Section IV. In more etails, the consumption was measure with a per-process granularity, both in a clean set-up an when a local covert channel among two processes is create. Preliminary investigations showcase that the overall power consumption of the smartphone is well represente by the energy require by processes with OS-wie ynamics. More specifically, the energy consumption of the process System gave us enough conense information to capture the general tren. Inee, the System process is the core of all mechanisms require to access the low-level rivers of Anroi. It is use for manipulating notifications, isplay, auio, alarms, an telephony, just for naming a few. Therefore, for testing our methos, we relie upon the information provie solely by the processsystem. As sai, we focuse on a scenario in which informationhiing-capable malware increases its stealthiness by acting when the evice is ile, i.e., there is no user activity involve.

10 8 battery rain (%) no cov. ch. time (h) Fig. 4. Battery rain for each type of covert channel uring 3 hours of repeate experiments. As regars the exchange messages, we set a fixe size of 0 bytes, which is large enough to represent the exfiltration of sensitive information such as a bank account or a collection of contacts store in the aress book. Each covert channel was teste by performing ata transmissions starting at ranom time instants. To have a proper statistical relevance, each trial was repeate 10 times. Figure 4 shows the tren of the battery rain for a perio of 3 hours in the presence of colluing applications transmitting ata with the seven implemente covert channels. Results inicate that the most consuming methos are the Volume Settings, the Memory Loa, an the System Loa, whereas the lowest one is the Type of Intent. Even if it is one of the most consuming, the System Loa covert channel is also the one with the smallest bitrate. The performances of the propose etection methos were quantifie by means of the percentage of correct etection of hien communications, efine as follows: = 1 T 1 1 y t ỹ t (4) T t=0 where T is the length of each trial (epenent on the type of use covert channel) an y t an ỹ t enote the actual an spotte hien communications at timet, respectively. In more etails, y t = 1 inicates that two colluing applications are covertly exchanging ata, whereas y t = 0 represents the absence of hien communication. A. RBD Metho A training set compose of 5000 energy consumption measurements was use to optimize the parameters of neural networks an ecision trees for the RBD metho. Such samples were obtaine in a clean system without hien communication between colluing applications. The training was performe using the Levenberg-Marquart algorithm [47] for neural networks an by minimizing the MSE of the preictions compare to the training ata for ecision trees, using the Gini s iversity inex as split criterion [50]. As pointe out in Section V-B, the same approximator was use to etect all the seven implemente covert channels. In orer to etermine the best values of the parameters q, ξ, τ, an ν a thorough simulation campaign was performe. Concerning neural networks, Figure 5(a) reports the percentage of correct etection of each covert channel efine as Neural networks ξ=30, τ=5, ν= (b) Neural networks q=20, ξ=30, τ = Neural networks q=20, τ=5, ν= ξ () Neural networks q=20, ξ=30, ν = τ (f) q (a) ν Decision trees ξ=30, τ = (c) Decision trees q=20, τ =5 ξ (e) Decision trees q=20, ξ=30 q τ Fig. 5. Average percentage of correct etection for each covert channel using the RBD when varying the parameters of neural networks (a, b,, an f) an ecision trees (c, e, an g). in equation (4), average over 10 ifferent trials, when ν is varie from 5 to 50 an the other parameters q, ξ, an τ are fixe to 20, 30, an 20, respectively. Figures 5(b) an 5(c) show the behavior of the average obtaine with neural networks an ecision trees, respectively, when varying the length q of the regressor from 5 to 30 an with the other parameters fixe. Figures 5() an 5(e) epict the average using neural networks an ecision trees, respectively, as a function of the thresholξ use for the etection rule, whereas the other parameters are fixe. Lastly, Figures 5(f) an 5(g) showcase the average obtaine with neural networks an ecision trees, respectively, as a function of the length τ of the time winow use for the etection rule, with the other parameters fixe. (g)

11 9 Neural nets q=20, ξ=30, τ=20, ν=40 Decision trees q=20, ξ=30, τ = Neural networks λ=10 50 (a) 50 (b) Fig. 6. Boxplots of the percentages of correct etection for each covert channel using the RBD with neural networks (a) an ecision trees (b) Neural networks wt wt cov.ch. yes/no (a) t Decision trees wt wt cov.ch. yes/no Fig. 7. Comparison of real an estimate power consumption of the System process for the Volume Settings by using the RBD with neural networks (a) an ecision trees (b). From the obtaine results, it turns out that the percentage of correct etection for neural networks increases with ν up to ν = 40, which is then the best number of activation functions. For larger values, the phenomenon of overfitting is experience, i.e., the number of basis functions is too large for the available ata, an minor fluctuations in the energy measures may be overemphasize, thus resulting into ba etection rates. Concerning the length q of the regressor, the best value turns out to be q = 20. The behavior of neural networks is more affecte by the chosen value if compare to ecision trees, for which all the values of q guarantee almost the same results. Instea, neural networks an ecision trees exhibit the same behavior when varying the threshol ξ for the preiction error (2), for which the best value appears to be ξ = 30. Lastly, the percentage of correct etection grows if the time horizon τ use in (2) increases up to τ = 20, an then remains almost constant. Thus, in the perspective of saving computational time, τ = 20 is the best value. Figure 6 shows the boxplots of the percentages of correct etection for each information-hiing technique compute over 10 ifferent trials by using neural networks an ecision trees with the best values of their parameters, i.e., ν = 40, q = 20, ξ = 30, an τ = 20. We conclue that the performance of neural networks an ecision trees are comparable, i.e., on the average the accuracy of the etection is similar in both cases. The most easily etectable metho appears to be the System Loa covert channel, whereas the metho that is least etectable is the File Size. Figure 7 epicts the measure tren of the consumption of the System process compare with its estimation provie (b) t Neural networks ν =10 λ (b) ν (a) Decision trees λ Fig. 8. Average percentage of correct etection for each covert channel using the CBD when varying the parameters of neural networks (a an b) an ecision trees (c). by neural networks an ecision trees when using the Volume Settings covert channel. The presence or absence of hien communication is enote by high or low values of the binary signal at the bottom of each figure. As it can be seen, the preiction of the energy consumption is more accurate when no covert communication is active, whereas the preiction is not accurate in the presence of colluing applications. The ba preiction when covert channels are present is funamental to spot hien communications. More specifically, neural networks unerestimate the power consumption, whereas ecision trees saturate to a certain value. This is not surprising since the moels have been built using a clean system without colluing applications. B. CBD Metho To test the effectiveness of the CBD metho, we use again a training set mae up of 5000 energy samples. Differently from the RBD, the training was performe both when the colluing applications are active an inactive. Moreover, ifferent approximators were traine for each of the seven implemente covert channels. Since we ha to solve a classification problem, the realvalue output of the neural networks was roune either to 1 or 0 epening on whether hien communication is spotte or not. Concerning ecision trees, we aopte the so-calle classification trees, whose output is irectly one of the classes efine uring the training. The training of neural networks was performe again by using the Levenberg- Marquart algorithm, whereas classification trees were traine by minimizing the MSE of the preictions compare with the traine ata an using the Gini s iversity inex as the split criterion. For the case of neural networks, we varie both the number of neurons ν an the number of time instants λ for the (c)

12 10 95 Neural networks λ=10, ν =10 95 Decision trees λ=10 TABLE III AVERAGE PERCENTAGES OF CORRECT DETECTION FOR THE DIFFERENT DETECTION METHODS AND COVERT CHANNELS Covert channel RBD CBD Neural net. Dec. tree Neural net. Dec. tree 75 (a) 75 (b) Type of Intent File Size Memory Loa File Lock System Loa Volume Settings Unix Socket Fig. 9. Boxplots of the percentages of correct etection for each covert channel using the CBD with neural networks (a) an ecision trees (b) Neural networks (a) t yt ỹt Decision trees Fig. 10. Comparison of the true covert channel activity over time against the estimate one for the Volume Settings by using the CBD with neural networks (a) an ecision trees (b). computation of the features as in (3), in orer to investigate their influence on the accuracy of the etection. Figure 8(a) epicts the percentage of correct etection of each covert channel, average over 10 ifferent trials, when ν is varie from 5 to 30 an λ is fixe to 10. Figure 8(b) presents the average for each information-hiing metho when λ ranges from5to 30 anν equals to 10. It turns out that the number of neurons affects the accuracy of the etection only marginally. Therefore, to save memory an computational time, one might choose ν = 5 or ν = 10. As regars the effect of λ, λ = 5 or λ = 10 appear to be the best choice since a small ecay of performance is experience for large values. Concerning ecision trees, we investigate the effect of the parameter λ on the accuracy of etection. The results are reporte in Figure 8(c) for the average. Also in this case, λ varies from 5 to 30, an the percentage of etection ecreases if λ increases. Hence, optimal values are again λ = 5 or λ = 10. Figure 9 epicts the boxplots of the percentages of correct etection for each covert channel compute over 10 ifferent trials using the approximate moels with the best values of their parameters, i.e., ν = 10 an λ = 10 for neural networks an λ = 10 for ecision trees. In general, neural networks guarantee better performance compare with ecision trees, i.e., on the average the accuracy of the etection is higher an with a lower variance. In all cases, the most easily etectable covert channels are the File Lock an the Volume Settings. Instea, the Memory Loa metho is the most ifficult to etect espite its high consumption. Instea, the System Loa is characterize by the largest ispersion. Figure 10 portraits the estimate covert channel activity (b) t yt ỹt compare to the real one for the Volume Settings metho. As it can be seen, neural networks an ecision trees are able to correctly spot the channel activity most of the time, thus showcasing their effectiveness for run-time or static analysis purposes within the security framework of the evice. C. Comparison Between RBD an CBD To sum up, Table III reports the percentage of correct etection average over 10 trials for all the implemente covert channels for the RBD an CBD methos. In both cases, the System Loa an the Volume Settings are the most easily etectable covert channels. This may be ascribe to the fact that such methos are also the most power-consuming, i.e., their energy footprint is more evient. In this case, the hien communication is correctly spotte 9 times over 10 on the average. The most ifficult methos to etect turns out to be the File Size an the Memory Loa. However, even if lower than the one of the best-performing methos, their average percentage of correct etection is about 65% when using the RBD an 85% for the CBD, which is quite a satisfactory result. The Memory Loa covert channel seems the most ifficult to etect. This behavior is ue to the absence of coe in the System process that allocates memory: this task is one at high level by the Dalvik virtual machine an at low level by the Linux kernel. Accoring to the obtaine results, in general the CBD outperforms the RBD in terms of percentage of correct etection. Moreover, it is worth noting that the RBD has three parameters to be tune, i.e., q, τ, an ξ, instea of only one for the CBD, i.e., λ. As a consequence, the implementation of the CBD in a prouction quality tool shoul be preferre, both in terms of complexity an performance. Concerning the computational effort, the average time for the training was equal to 82.5 secons for the RBD with ν = 40 an q = 20 an to 15.6 secons for the CBD with ν = 10 an λ = 10 when using neural networks. The training times of the two etection methos when using ecision trees with q = 20 an λ = 10 were equal to 1.92 an 0.27 secons, respectively. The higher times of the RBD are mainly ue to the greater imension of the input vector compare to the CBD. In fact, in the first case the imension of the input is equal to the length q = 20 of the regressor, whereas in the secon one it is equal to the number of features, i.e., 3. This also requires a larger number of neurons to obtain satisfactory approximations. In general, neural networks appears to be

13 11 more computationally emaning compare to ecision trees. Nevertheless, the RBD requires the training of only one moel, whereas an approximate moel for each covert channel is require by the CBD, thus resorting to seven ifferent training proceures. The average time to spot the presence of a covert channel for the RBD metho with the best values of the parameters is equal to 0.01 an secons, epening on whether neural networks or ecision trees are use, respectively. As regars the CBD approach, such times when using the best values of the parameters are again equal to 0.01 an secons for neural networks an ecision trees, respectively. In all cases, the online computational effort is very small. Thus, the propose methos appear to be well-suite to being implemente in an online etection framework irectly running on a mobile evice. VII. CONCLUSIONS AND FUTURE WORKS In this paper we have presente a framework base on artificial intelligence tools, such as neural networks an ecision trees, to etect the presence of malware using informationhiing techniques base on power measurements. Specifically, we have focuse on the colluing application scenario, which is characterize by two processes trying to communicate outsie their sanboxes for malicious purposes, for instance, for sensitive ata exfiltration. Two etection methos have been evelope, requiring the solution of regression an classification problems. To verify the effectiveness of our approach, we have implemente seven local covert channels on the Anroi platform, an we have performe an experimental measurement an etection campaign. The obtaine results inicate that both methos are characterize by a goo etection performance an can be use as an accurate IDS software on a moern smartphone to reveal the presence of hazars exploiting information hiing. Future works aim at making our etection framework more effective, for instance by eveloping proper metrics to recognize at runtime the pair of colluing applications. Moreover, part of our ongoing research is evote to unerstan if using aitional information (e.g., activity correlation) coul increase the accuracy of the approach. At the same time, we also work to exten the energy-base etection approach to other threats exploiting information hiing. On the overall, such improvements shoul lea to the evelopment of an application irectly running on a mobile evice to spot the presence of covert communications in real-time. REFERENCES [1] K. Allix, Q. Jerome, T. F. Bissyane, J. Klein, R. State, an Y. le Traon, A forensic analysis of Anroi malware-how is malware written an how it coul be etecte? in Computer Software an Applications Conf., 2014, pp [2] V. Rastogi, Y. Chen, an X. Jiang, Catch me if you can: Evaluating Anroi anti-malware against transformation attacks, IEEE Trans. on Information Forensics an Security, vol. 9, no. 1, pp , Jan [3] J.-F. Lalane an S. Wenzel, Hiing privacy leaks in Anroi applications using low-attention raising covert channels, in Int. Conf. on Availability, Reliability an Security, 2013, pp [4] W. Mazurczyk an L. Caviglione, Steganography in moern smartphones an mitigation techniques, IEEE Communications Surveys & Tutorials, vol. 17, no. 1, pp , [5] W. Mazurczyk an L. Caviglione, Information hiing as a challenge for malware etection, Security & Privacy, vol. 13, no. 2, pp , [6] McAfeeLabs, McAfee labs threat report, August [Online]. Available: [7] J. Hoffmann, S. Neumann, an T. Holz, Mobile malware etection base on energy fingerprints - a ea en? in Research in Attacks, Intrusions, an Defenses. Springer, 2013, pp [8] L. Zhang, B. Tiwana, Z. Qian, Z. Wang, R. P. Dick, Z. M. Mao, an L. Yang, Accurate online power estimation an automatic battery behavior base power moel generation for smartphones, in Proc. Int. Conf. on Harware/Software Coesign an System Synthesis, 2010, pp [9] L. Caviglione an A. Merlo, The energy impact of security mechanisms in moern mobile evices, Network Security, vol. 2012, no. 2, pp , [10] A. Merlo, M. Migliari, an P. Fontanelli, On energy-base profiling of malware in Anroi, in Int. Conf. on High Perf. Computing & Simulation, 2014, pp [11] C. Marforio, H. Ritzorf, A. Francillon, an S. Capkun, Analysis of the communication between colluing applications on moern smartphones, in Proc. Annual Computer Security Applications Conf., 2012, pp. 51. [12] A. Merlo, M. Migliari, an P. Fontanelli, Measuring an estimating power consumption in Anroi to support energy-base intrusion etection, Journal of Computer Security, vol. 23, pp , [13] S. Haykin, Neural Networks, A comprehensive founation. Prentice Hall, [14] L. Breiman, J. Frieman, R. Olshen, an C. Stone, Classification an Regression Trees. Chapman & Hall, [15] A. Bose, X. Hu, K. G. Shin, an T. Park, Behavioral etection of malware on mobile hansets, in Proc. Int. Conf. on Mobile Systems, Applications, an Services, 2008, pp [16] A. Shabtai, R. Moskovitch, Y. Elovici, an C. Glezer, Detection of malicious coe by applying machine learning classifiers on static features: A state-of-the-art survey, Information Security Technical Report, vol. 14, no. 1, pp , [17] A. Shabtai, U. Kanonov, Y. Elovici, C. Glezer, an Y. Weiss, Anromaly: a behavioral malware etection framework for Anroi evices, Journal of Intelligent Information Systems, vol. 38, no. 1, pp , [18] L. Liu, G. Yan, X. Zhang, an S. Chen, VirusMeter: Preventing your cellphone from spies, in Recent Avances in Intrusion Detection, 2009, pp [19] G. Jacoby an N. Davis, Battery-base intrusion etection, in IEEE Global Telecommunications Conf., vol. 4, 2004, pp [20] D. C. Nash, T. L. Martin, D. S. Ha, an M. S. Hsiao, Towars an intrusion etection system for battery exhaustion attacks on mobile computing evices, in IEEE Int. Conf. on Pervasive Computing an Communications Workshops, 2005, pp [21] H. Kim, J. Smith, an K. G. Shin, Detecting energy-greey anomalies an mobile malware variants, in Proc. Int. Conf. on Mobile Systems, Applications, an Services, 2008, pp [22] B. Dixon, Y. Jiang, A. Jaiantilal, an S. Mishra, Location base power analysis to etect malicious coe in smartphones, in Proc. Workshop on Security an Privacy in Smartphones an Mobile Devices, 2011, pp [23] B. Dixon an S. Mishra, Power base malicious coe etection techniques for smartphones, in IEEE Int. Conf. on Trust, Security an Privacy in Computing an Communications, 2013, pp [24] B. Dixon, S. Mishra, an J. Pepin, Time an location power base malicious coe etection techniques for smartphones, in IEEE Int. Symp. on Network Computing an Applications, 2014, pp [25] M. Curti, A. Merlo, M. Migliari, an S. Schiappacasse, Towars energy-aware intrusion etection systems on mobile evices, in Int. Conf. on High Perf. Computing an Simulation, 2013, pp [26] T. K. Buennemeyer, G. Jacoby, W. G. Chiang, R. C. Marchany, an J. G. Tront, Battery-sensing intrusion protection system, in Information Assurance Workshop, 2006, pp [27] T. K. Buennemeyer, T. M. Nelson, M. Gora, R. C. Marchany, an J. G. Tront, Battery polling an trace etermination for bluetooth attack etection in mobile evices, in Information Assurance an Security Workshop, 2007, pp [28] L. Caviglione, A. Merlo, an M. Migliari, What is green security? in Int. Conf. on Information Assurance an Security, 2011, pp

14 12 [29] F.-E. Kioupakis an E. Serrelis, Preparing for malware that uses covert communication channels: The case of Tor-base Anroi malware, in Int. Conf. Information Security an Digital Forensics, 2014, pp [30] P. Faruki, V. Ganmoor, V. Laxmi, M. S. Gaur, an A. Bharmal, AnroSimilar: robust statistical feature signature for Anroi malware etection, in Proc. Int. Conf. on Security of Information an Networks, 2013, pp [31] R. Anriatsimanefitra an V. V. T. Tong, Detection an ientification of Anroi malware base on information flow monitoring, in Int. Conf. on Cyber Security an Clou Computing, 2015, pp [32] R. Schlegel, K. Zhang, X. Zhou, M. Intwala, A. Kapaia, an X. Wang, Souncomber: A stealthy an context-aware soun trojan for smartphones, in NDSS, vol. 11, 2011, pp [33] A. Merlo, M. Migliari, an L. Caviglione, A survey on energy-aware security mechanisms, Pervasive an Mobile Computing, vol. 24, pp. 77, [34] A. Armano, A. Merlo, M. Migliari, an L. Vererame, Breaking an fixing the Anroi launching flow, Computers an Security, vol. 39, pp , [35] A. Armano, A. Merlo, an L. Vererame, An empirical evaluation of the Anroi security framework, in Security an Privacy Protection in Information Processing Systems, ser. IFIP Avances in Information an Communication Technology, L. Janczewski, H. Wolfe, an S. Shenoi, Es. Springer Berlin Heielberg, 2013, vol. 405, pp [36] S. Lee, W. Jung, Y. Chon, an H. Cha, EnTrack: a system facility for analyzing energy consumption of Anroi system services, in Proc. Int. Joint Conf. on Pervasive an Ubiquitous Computing, 2015, pp [37] T. Hastie, R. Tibshirani, an J. Frieman, The Elements of Statistical Learning (2n E.). New York: Springer, [38] R. Zoppoli, T. Parisini, an M. Sanguineti, Approximating networks an extene Ritz metho for the solution of functional optimization problems, J. of Optimization Theory an Applications, vol. 112, pp , [39] M. Gaggero, G. Gnecco, an M. Sanguineti, Dynamic programming an value-function approximation in sequential ecision problems: error analysis an numerical results, Journal of Optimization Theory an Applications, vol. 156, no. 2, pp , [40] M. Gaggero, G. Gnecco, an M. Sanguineti, Approximate ynamic programming for stochastic N-stage optimization with application to optimal consumption uner uncertainty, Computational Optimization an Applications, vol. 58, no. 1, pp , [41] L. Caviglione, Enabling cooperation of consumer evices through peerto-peer overlays, IEEE Trans. Consumer Electronics, vol. 55, no. 2, pp , [42] A. Alessanri, C. Cervellera, an M. Gaggero, Nonlinear preictive control of container flows in maritime intermoal terminals, IEEE Trans. Contr. Syst. Technol., vol. 21, no. 4, pp , [43] K. Hornik, M. Stinchombe, an H. White, Multilayer feeforwar networks are universal approximators, Neural Networks, vol. 2, pp , [44] A. Barron, Universal approximation bouns for superpositions of a sigmoial function, IEEE Trans. Inf. Theory, vol. 39, no. 3, pp , [45] R. A. Berk, Statistical Learning from a Regression Perspective. New York: Springer-Verlag, [46] C. Cervellera, M. Gaggero, an D. Macciò, An analysis base on F- iscrepancy for sampling in regression tree learning, in Proc. Int. Joint Conf. on Neural Networks, 2014, pp [47] D. W. Marquart, An algorithm for least-squares estimation of nonlinear parameters, Journal of the Society for Inustrial & Applie Mathematics, vol. 11, no. 2, pp , [48] P. Werbos, The Roots of Backpropagation: From Orere Derivatives to Neural Networks an Political Forecasting. New York, NY, USA: Wiley-Interscience, [49] A. Sen an M. Srivastava, Regression Analysis - Theory, Methos, an Applications. Springer-Verlag, [50] T. Cover an T. Joy, Elements of Information Theory. Wiley, Luca Caviglione receive the Ph.D. egree in electronics an computer engineering from the University of Genoa, Genoa, Italy. He has been involve in research projects fune by ESA, EU, an MIUR. He is currently a Research Scientist with the Institute of Intelligent Systems for Automation, National Research Council of Italy, Genoa. He is a Work Group Leaer of the Italian IPv6 Task Force, a Contract Professor, an a Professional Engineer. He has authore or co-authore over acaemic publications, an several patents. His current research interests inclue P2P systems, wireless communications, clou architectures, an network security. Dr. Caviglione is involve in the technical program committee of many international conferences an regularly serves as a Reviewer for the major international journals. Since 2011, he has been an Associate Eitor of Transactions on Emerging Telecommunications Technologies (Wiley). Mauro Gaggero receive the B.Sc. an M.Sc. egrees in electronics engineering an the Ph.D. egree in mathematical engineering from the University of Genoa, Genoa, Italy, in 2003, 2005, an 2010, respectively. He was a Post-Doctoral Fellow with the Faculty of Engineering, University of Genoa, in Since 2011, he has been a Research Scientist with the Institute of Intelligent Systems for Automation, National Research Council of Italy, Genoa. His current research interests inclue control an optimization of nonlinear systems, istribute parameter systems, neural networks, an learning from ata. Dr. Gaggero is an Associate Eitor of the European Control Association Conference Eitorial Boar an of the IEEE Control Systems Society Conference Eitorial Boar. Jean-François Lalane receive the Ph.D. egree in computer science from Inria, Sophia- Antipolis, France, within the Mascotte Project (CNRS/Inria/UNSA) in He is currently an Associate Professor with the INSA Centre Val e Loire, in the Laboratoire Informatique e l Université Orléans (LIFO). He is also temporarily associate with Inria in the CIDRE team. During the Ph.D., his research interests focuse on the combinatorial optimization for optical an satellite networks. Since 2005, he has been working on security of operating systems, C-embee software (incluing smart cars), an Anroi applications. Currently, he is intereste in mobile software security. Prof. Lalane actively participates to the release of open-source software in orer to make security experiments reproucible. Wojciech Mazurczyk (SM 13) receive the B.Sc., M.Sc., Ph.D. (with honors), an D.Sc. (habilitation) egrees in telecommunications from the Warsaw University of Technology (WUT), Warsaw, Polan, in 2003, 2004, 2009, an 2014, respectively. He is currently an Associate Professor with the Institute of Telecommunications at WUT, where he is the Hea of the Bio-inspire Security Research Group (bsrg.tele.pw.eu.pl). His research interests inclue bio-inspire cybersecurity an networking, information hiing, an network security. Prof. Mazurczyk is involve in the technical program commitee of many international conferences, incluing IEEE INFOCOM, IEEE GLOBECOM, IEEE ICC, an ACSAC. Also, he serves as a Reviewer for the major international magazines an journals. Since 2013, he is an Associate Technical Eitor of the IEEE Communications Magazine (IEEE Comsoc). Marcin Urbański receive the B.Eng. in computer science from the Warsaw University of Technology (WUT), Warsaw, Polan, in He currently works at the Norwegian University of Science an Technology, Tronheim, Norway, where he is implementing applications for interactive lectures. His research interests inclue steganography an mobile software security.

State of Louisiana Office of Information Technology. Change Management Plan

State of Louisiana Office of Information Technology. Change Management Plan State of Louisiana Office of Information Technology Change Management Plan Table of Contents Change Management Overview Change Management Plan Key Consierations Organizational Transition Stages Change

More information

INFLUENCE OF GPS TECHNOLOGY ON COST CONTROL AND MAINTENANCE OF VEHICLES

INFLUENCE OF GPS TECHNOLOGY ON COST CONTROL AND MAINTENANCE OF VEHICLES 1 st Logistics International Conference Belgrae, Serbia 28-30 November 2013 INFLUENCE OF GPS TECHNOLOGY ON COST CONTROL AND MAINTENANCE OF VEHICLES Goran N. Raoičić * University of Niš, Faculty of Mechanical

More information

A Data Placement Strategy in Scientific Cloud Workflows

A Data Placement Strategy in Scientific Cloud Workflows A Data Placement Strategy in Scientific Clou Workflows Dong Yuan, Yun Yang, Xiao Liu, Jinjun Chen Faculty of Information an Communication Technologies, Swinburne University of Technology Hawthorn, Melbourne,

More information

Stock Market Value Prediction Using Neural Networks

Stock Market Value Prediction Using Neural Networks Stock Market Value Preiction Using Neural Networks Mahi Pakaman Naeini IT & Computer Engineering Department Islamic Aza University Paran Branch e-mail: m.pakaman@ece.ut.ac.ir Hamireza Taremian Engineering

More information

Data Center Power System Reliability Beyond the 9 s: A Practical Approach

Data Center Power System Reliability Beyond the 9 s: A Practical Approach Data Center Power System Reliability Beyon the 9 s: A Practical Approach Bill Brown, P.E., Square D Critical Power Competency Center. Abstract Reliability has always been the focus of mission-critical

More information

Cross-Over Analysis Using T-Tests

Cross-Over Analysis Using T-Tests Chapter 35 Cross-Over Analysis Using -ests Introuction his proceure analyzes ata from a two-treatment, two-perio (x) cross-over esign. he response is assume to be a continuous ranom variable that follows

More information

Improving Emulation Throughput for Multi-Project SoC Designs

Improving Emulation Throughput for Multi-Project SoC Designs Improving Emulation Throhput for Multi-Project SoC Designs By Frank Schirrmeister, Caence Design Systems As esign sizes grow, so, too, oes the verification effort. Inee, verification has become the biggest

More information

Modelling and Resolving Software Dependencies

Modelling and Resolving Software Dependencies June 15, 2005 Abstract Many Linux istributions an other moern operating systems feature the explicit eclaration of (often complex) epenency relationships between the pieces of software

More information

Firewall Design: Consistency, Completeness, and Compactness

Firewall Design: Consistency, Completeness, and Compactness C IS COS YS TE MS Firewall Design: Consistency, Completeness, an Compactness Mohame G. Goua an Xiang-Yang Alex Liu Department of Computer Sciences The University of Texas at Austin Austin, Texas 78712-1188,

More information

A Universal Sensor Control Architecture Considering Robot Dynamics

A Universal Sensor Control Architecture Considering Robot Dynamics International Conference on Multisensor Fusion an Integration for Intelligent Systems (MFI2001) Baen-Baen, Germany, August 2001 A Universal Sensor Control Architecture Consiering Robot Dynamics Frierich

More information

Optimizing Multiple Stock Trading Rules using Genetic Algorithms

Optimizing Multiple Stock Trading Rules using Genetic Algorithms Optimizing Multiple Stock Traing Rules using Genetic Algorithms Ariano Simões, Rui Neves, Nuno Horta Instituto as Telecomunicações, Instituto Superior Técnico Av. Rovisco Pais, 040-00 Lisboa, Portugal.

More information

View Synthesis by Image Mapping and Interpolation

View Synthesis by Image Mapping and Interpolation View Synthesis by Image Mapping an Interpolation Farris J. Halim Jesse S. Jin, School of Computer Science & Engineering, University of New South Wales Syney, NSW 05, Australia Basser epartment of Computer

More information

Unsteady Flow Visualization by Animating Evenly-Spaced Streamlines

Unsteady Flow Visualization by Animating Evenly-Spaced Streamlines EUROGRAPHICS 2000 / M. Gross an F.R.A. Hopgoo Volume 19, (2000), Number 3 (Guest Eitors) Unsteay Flow Visualization by Animating Evenly-Space Bruno Jobar an Wilfri Lefer Université u Littoral Côte Opale,

More information

This post is not eligible for sponsorship and applicants must be eligible to work in the UK under present visa arrangements.

This post is not eligible for sponsorship and applicants must be eligible to work in the UK under present visa arrangements. WMG 7.60 per hour Ref: WMG005/15 Fixe Term Contract: 4 Weeks Full Time to be unertaken in summer 2015 (with the possibility of a further 4 weeks employment, applicants must therefore be available for the

More information

Modeling and Predicting Popularity Dynamics via Reinforced Poisson Processes

Modeling and Predicting Popularity Dynamics via Reinforced Poisson Processes Proceeings of the Twenty-Eighth AAAI Conference on Artificial Intelligence Moeling an Preicting Popularity Dynamics via Reinforce Poisson Processes Huawei Shen 1, Dashun Wang 2, Chaoming Song 3, Albert-László

More information

Optimal Energy Commitments with Storage and Intermittent Supply

Optimal Energy Commitments with Storage and Intermittent Supply Submitte to Operations Research manuscript OPRE-2009-09-406 Optimal Energy Commitments with Storage an Intermittent Supply Jae Ho Kim Department of Electrical Engineering, Princeton University, Princeton,

More information

Security Vulnerabilities and Solutions for Packet Sampling

Security Vulnerabilities and Solutions for Packet Sampling Security Vulnerabilities an Solutions for Packet Sampling Sharon Golberg an Jennifer Rexfor Princeton University, Princeton, NJ, USA 08544 {golbe, jrex}@princeton.eu Abstract Packet sampling supports a

More information

Towards a Framework for Enterprise Architecture Frameworks Comparison and Selection

Towards a Framework for Enterprise Architecture Frameworks Comparison and Selection Towars a Framework for Enterprise Frameworks Comparison an Selection Saber Aballah Faculty of Computers an Information, Cairo University Saber_aballah@hotmail.com Abstract A number of Enterprise Frameworks

More information

ISSN: 2277-3754 ISO 9001:2008 Certified International Journal of Engineering and Innovative Technology (IJEIT) Volume 3, Issue 12, June 2014

ISSN: 2277-3754 ISO 9001:2008 Certified International Journal of Engineering and Innovative Technology (IJEIT) Volume 3, Issue 12, June 2014 ISSN: 77-754 ISO 900:008 Certifie International Journal of Engineering an Innovative echnology (IJEI) Volume, Issue, June 04 Manufacturing process with isruption uner Quaratic Deman for Deteriorating Inventory

More information

Detecting Possibly Fraudulent or Error-Prone Survey Data Using Benford s Law

Detecting Possibly Fraudulent or Error-Prone Survey Data Using Benford s Law Detecting Possibly Frauulent or Error-Prone Survey Data Using Benfor s Law Davi Swanson, Moon Jung Cho, John Eltinge U.S. Bureau of Labor Statistics 2 Massachusetts Ave., NE, Room 3650, Washington, DC

More information

How To Segmentate An Insurance Customer In An Insurance Business

How To Segmentate An Insurance Customer In An Insurance Business International Journal of Database Theory an Application, pp.25-36 http://x.oi.org/10.14257/ijta.2014.7.1.03 A Case Stuy of Applying SOM in Market Segmentation of Automobile Insurance Customers Vahi Golmah

More information

A New Evaluation Measure for Information Retrieval Systems

A New Evaluation Measure for Information Retrieval Systems A New Evaluation Measure for Information Retrieval Systems Martin Mehlitz martin.mehlitz@ai-labor.e Christian Bauckhage Deutsche Telekom Laboratories christian.bauckhage@telekom.e Jérôme Kunegis jerome.kunegis@ai-labor.e

More information

Achieving quality audio testing for mobile phones

Achieving quality audio testing for mobile phones Test & Measurement Achieving quality auio testing for mobile phones The auio capabilities of a cellular hanset provie the funamental interface between the user an the raio transceiver. Just as RF testing

More information

RUNESTONE, an International Student Collaboration Project

RUNESTONE, an International Student Collaboration Project RUNESTONE, an International Stuent Collaboration Project Mats Daniels 1, Marian Petre 2, Vicki Almstrum 3, Lars Asplun 1, Christina Björkman 1, Carl Erickson 4, Bruce Klein 4, an Mary Last 4 1 Department

More information

Unbalanced Power Flow Analysis in a Micro Grid

Unbalanced Power Flow Analysis in a Micro Grid International Journal of Emerging Technology an Avance Engineering Unbalance Power Flow Analysis in a Micro Gri Thai Hau Vo 1, Mingyu Liao 2, Tianhui Liu 3, Anushree 4, Jayashri Ravishankar 5, Toan Phung

More information

ThroughputScheduler: Learning to Schedule on Heterogeneous Hadoop Clusters

ThroughputScheduler: Learning to Schedule on Heterogeneous Hadoop Clusters ThroughputScheuler: Learning to Scheule on Heterogeneous Haoop Clusters Shehar Gupta, Christian Fritz, Bob Price, Roger Hoover, an Johan e Kleer Palo Alto Research Center, Palo Alto, CA, USA {sgupta, cfritz,

More information

10.2 Systems of Linear Equations: Matrices

10.2 Systems of Linear Equations: Matrices SECTION 0.2 Systems of Linear Equations: Matrices 7 0.2 Systems of Linear Equations: Matrices OBJECTIVES Write the Augmente Matrix of a System of Linear Equations 2 Write the System from the Augmente Matrix

More information

FAST JOINING AND REPAIRING OF SANDWICH MATERIALS WITH DETACHABLE MECHANICAL CONNECTION TECHNOLOGY

FAST JOINING AND REPAIRING OF SANDWICH MATERIALS WITH DETACHABLE MECHANICAL CONNECTION TECHNOLOGY FAST JOINING AND REPAIRING OF SANDWICH MATERIALS WITH DETACHABLE MECHANICAL CONNECTION TECHNOLOGY Jörg Felhusen an Sivakumara K. Krishnamoorthy RWTH Aachen University, Chair an Insitute for Engineering

More information

The one-year non-life insurance risk

The one-year non-life insurance risk The one-year non-life insurance risk Ohlsson, Esbjörn & Lauzeningks, Jan Abstract With few exceptions, the literature on non-life insurance reserve risk has been evote to the ultimo risk, the risk in the

More information

Enterprise Resource Planning

Enterprise Resource Planning Enterprise Resource Planning MPC 6 th Eition Chapter 1a McGraw-Hill/Irwin Copyright 2011 by The McGraw-Hill Companies, Inc. All rights reserve. Enterprise Resource Planning A comprehensive software approach

More information

Game Theoretic Modeling of Cooperation among Service Providers in Mobile Cloud Computing Environments

Game Theoretic Modeling of Cooperation among Service Providers in Mobile Cloud Computing Environments 2012 IEEE Wireless Communications an Networking Conference: Services, Applications, an Business Game Theoretic Moeling of Cooperation among Service Proviers in Mobile Clou Computing Environments Dusit

More information

Minimum-Energy Broadcast in All-Wireless Networks: NP-Completeness and Distribution Issues

Minimum-Energy Broadcast in All-Wireless Networks: NP-Completeness and Distribution Issues Minimum-Energy Broacast in All-Wireless Networks: NP-Completeness an Distribution Issues Mario Čagal LCA-EPFL CH-05 Lausanne Switzerlan mario.cagal@epfl.ch Jean-Pierre Hubaux LCA-EPFL CH-05 Lausanne Switzerlan

More information

Lecture L25-3D Rigid Body Kinematics

Lecture L25-3D Rigid Body Kinematics J. Peraire, S. Winall 16.07 Dynamics Fall 2008 Version 2.0 Lecture L25-3D Rigi Boy Kinematics In this lecture, we consier the motion of a 3D rigi boy. We shall see that in the general three-imensional

More information

An intertemporal model of the real exchange rate, stock market, and international debt dynamics: policy simulations

An intertemporal model of the real exchange rate, stock market, and international debt dynamics: policy simulations This page may be remove to conceal the ientities of the authors An intertemporal moel of the real exchange rate, stock market, an international ebt ynamics: policy simulations Saziye Gazioglu an W. Davi

More information

An Introduction to Event-triggered and Self-triggered Control

An Introduction to Event-triggered and Self-triggered Control An Introuction to Event-triggere an Self-triggere Control W.P.M.H. Heemels K.H. Johansson P. Tabuaa Abstract Recent evelopments in computer an communication technologies have le to a new type of large-scale

More information

On Adaboost and Optimal Betting Strategies

On Adaboost and Optimal Betting Strategies On Aaboost an Optimal Betting Strategies Pasquale Malacaria 1 an Fabrizio Smerali 1 1 School of Electronic Engineering an Computer Science, Queen Mary University of Lonon, Lonon, UK Abstract We explore

More information

A Generalization of Sauer s Lemma to Classes of Large-Margin Functions

A Generalization of Sauer s Lemma to Classes of Large-Margin Functions A Generalization of Sauer s Lemma to Classes of Large-Margin Functions Joel Ratsaby University College Lonon Gower Street, Lonon WC1E 6BT, Unite Kingom J.Ratsaby@cs.ucl.ac.uk, WWW home page: http://www.cs.ucl.ac.uk/staff/j.ratsaby/

More information

MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.436J/15.085J Fall 2008 Lecture 14 10/27/2008 MOMENT GENERATING FUNCTIONS

MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.436J/15.085J Fall 2008 Lecture 14 10/27/2008 MOMENT GENERATING FUNCTIONS MASSACHUSETTS INSTITUTE OF TECHNOLOGY 6.436J/15.085J Fall 2008 Lecture 14 10/27/2008 MOMENT GENERATING FUNCTIONS Contents 1. Moment generating functions 2. Sum of a ranom number of ranom variables 3. Transforms

More information

Hybrid Model Predictive Control Applied to Production-Inventory Systems

Hybrid Model Predictive Control Applied to Production-Inventory Systems Preprint of paper to appear in the 18th IFAC Worl Congress, August 28 - Sept. 2, 211, Milan, Italy Hybri Moel Preictive Control Applie to Prouction-Inventory Systems Naresh N. Nanola Daniel E. Rivera Control

More information

Improving Direct Marketing Profitability with Neural Networks

Improving Direct Marketing Profitability with Neural Networks Volume 9 o.5, September 011 Improving Direct Marketing Profitability with eural etworks Zaiyong Tang Salem State University Salem, MA 01970 ABSTRACT Data mining in irect marketing aims at ientifying the

More information

Supporting Adaptive Workflows in Advanced Application Environments

Supporting Adaptive Workflows in Advanced Application Environments Supporting aptive Workflows in vance pplication Environments Manfre Reichert, lemens Hensinger, Peter Daam Department Databases an Information Systems University of Ulm, D-89069 Ulm, Germany Email: {reichert,

More information

Product Differentiation for Software-as-a-Service Providers

Product Differentiation for Software-as-a-Service Providers University of Augsburg Prof. Dr. Hans Ulrich Buhl Research Center Finance & Information Management Department of Information Systems Engineering & Financial Management Discussion Paper WI-99 Prouct Differentiation

More information

JON HOLTAN. if P&C Insurance Ltd., Oslo, Norway ABSTRACT

JON HOLTAN. if P&C Insurance Ltd., Oslo, Norway ABSTRACT OPTIMAL INSURANCE COVERAGE UNDER BONUS-MALUS CONTRACTS BY JON HOLTAN if P&C Insurance Lt., Oslo, Norway ABSTRACT The paper analyses the questions: Shoul or shoul not an iniviual buy insurance? An if so,

More information

An Alternative Approach of Operating a Passive RFID Device Embedded on Metallic Implants

An Alternative Approach of Operating a Passive RFID Device Embedded on Metallic Implants An Alternative Approach of Operating a Passive RFID Device Embee on Metallic Implants Xiaoyu Liu, Ravi Yalamanchili, Ajay Ogirala an Marlin Mickle RFID Center of Excellence, Department of Electrical an

More information

Bellini: Ferrying Application Traffic Flows through Geo-distributed Datacenters in the Cloud

Bellini: Ferrying Application Traffic Flows through Geo-distributed Datacenters in the Cloud Bellini: Ferrying Application Traffic Flows through Geo-istribute Datacenters in the Clou Zimu Liu, Yuan Feng, an Baochun Li Department of Electrical an Computer Engineering, University of Toronto Department

More information

GPRS performance estimation in GSM circuit switched services and GPRS shared resource systems *

GPRS performance estimation in GSM circuit switched services and GPRS shared resource systems * GPRS performance estimation in GSM circuit switche serices an GPRS share resource systems * Shaoji i an Sen-Gusta Häggman Helsinki Uniersity of Technology, Institute of Raio ommunications, ommunications

More information

MSc. Econ: MATHEMATICAL STATISTICS, 1995 MAXIMUM-LIKELIHOOD ESTIMATION

MSc. Econ: MATHEMATICAL STATISTICS, 1995 MAXIMUM-LIKELIHOOD ESTIMATION MAXIMUM-LIKELIHOOD ESTIMATION The General Theory of M-L Estimation In orer to erive an M-L estimator, we are boun to make an assumption about the functional form of the istribution which generates the

More information

Ch 10. Arithmetic Average Options and Asian Opitons

Ch 10. Arithmetic Average Options and Asian Opitons Ch 10. Arithmetic Average Options an Asian Opitons I. Asian Option an the Analytic Pricing Formula II. Binomial Tree Moel to Price Average Options III. Combination of Arithmetic Average an Reset Options

More information

Different approaches for the equalization of automotive sound systems

Different approaches for the equalization of automotive sound systems Auio Engineering Society Convention Paper Presente at the 112th Convention 2002 May 10 13 Munich, Germany This convention paper has been reprouce from the author's avance manuscript, without eiting, corrections,

More information

Heat-And-Mass Transfer Relationship to Determine Shear Stress in Tubular Membrane Systems Ratkovich, Nicolas Rios; Nopens, Ingmar

Heat-And-Mass Transfer Relationship to Determine Shear Stress in Tubular Membrane Systems Ratkovich, Nicolas Rios; Nopens, Ingmar Aalborg Universitet Heat-An-Mass Transfer Relationship to Determine Shear Stress in Tubular Membrane Systems Ratkovich, Nicolas Rios; Nopens, Ingmar Publishe in: International Journal of Heat an Mass Transfer

More information

zupdate: Updating Data Center Networks with Zero Loss

zupdate: Updating Data Center Networks with Zero Loss zupate: Upating Data Center Networks with Zero Loss Hongqiang Harry Liu Yale University hongqiang.liu@yale.eu Lihua Yuan Microsoft lyuan@microsoft.com Xin Wu Duke University xinwu@cs.uke.eu Roger Wattenhofer

More information

IMPROVING ADAPTIVE GAME AI WITH EVOLUTIONARY LEARNING

IMPROVING ADAPTIVE GAME AI WITH EVOLUTIONARY LEARNING IMPROVING ADAPTIVE GAME AI WITH EVOLUTIONARY LEARNING Marc Ponsen Lehigh University / Computer cience & Engineering 19 Memorial Drive West Bethlehem, PA 18015-3084 UA mjp304@lehigh.eu Pieter pronck Maastricht

More information

Predicting Television Ratings and Its Application to Taiwan Cable TV Channels

Predicting Television Ratings and Its Application to Taiwan Cable TV Channels 2n International Symposium on Computer, Communication, Control an Automation (3CA 2013) Preicting Television Ratings an Its Application to Taiwan Cable TV Channels Hui-Ling Huang Department of Biological

More information

Cost Efficient Datacenter Selection for Cloud Services

Cost Efficient Datacenter Selection for Cloud Services Cost Efficient Datacenter Selection for Clou Services Hong u, Baochun Li henryxu, bli@eecg.toronto.eu Department of Electrical an Computer Engineering University of Toronto Abstract Many clou services

More information

HOST SELECTION METHODOLOGY IN CLOUD COMPUTING ENVIRONMENT

HOST SELECTION METHODOLOGY IN CLOUD COMPUTING ENVIRONMENT International Journal of Avance Research in Computer Engineering & Technology (IJARCET) HOST SELECTION METHODOLOGY IN CLOUD COMPUTING ENVIRONMENT Pawan Kumar, Pijush Kanti Dutta Pramanik Computer Science

More information

Calibration of the broad band UV Radiometer

Calibration of the broad band UV Radiometer Calibration of the broa ban UV Raiometer Marian Morys an Daniel Berger Solar Light Co., Philaelphia, PA 19126 ABSTRACT Mounting concern about the ozone layer epletion an the potential ultraviolet exposure

More information

BOSCH. CAN Specification. Version 2.0. 1991, Robert Bosch GmbH, Postfach 30 02 40, D-70442 Stuttgart

BOSCH. CAN Specification. Version 2.0. 1991, Robert Bosch GmbH, Postfach 30 02 40, D-70442 Stuttgart CAN Specification Version 2.0 1991, Robert Bosch GmbH, Postfach 30 02 40, D-70442 Stuttgart CAN Specification 2.0 page 1 Recital The acceptance an introuction of serial communication to more an more applications

More information

A Theory of Exchange Rates and the Term Structure of Interest Rates

A Theory of Exchange Rates and the Term Structure of Interest Rates Review of Development Economics, 17(1), 74 87, 013 DOI:10.1111/roe.1016 A Theory of Exchange Rates an the Term Structure of Interest Rates Hyoung-Seok Lim an Masao Ogaki* Abstract This paper efines the

More information

Performance And Analysis Of Risk Assessment Methodologies In Information Security

Performance And Analysis Of Risk Assessment Methodologies In Information Security International Journal of Computer Trens an Technology (IJCTT) volume 4 Issue 10 October 2013 Performance An Analysis Of Risk Assessment ologies In Information Security K.V.D.Kiran #1, Saikrishna Mukkamala

More information

5 Isotope effects on vibrational relaxation and hydrogen-bond dynamics in water

5 Isotope effects on vibrational relaxation and hydrogen-bond dynamics in water 5 Isotope effects on vibrational relaxation an hyrogen-bon ynamics in water Pump probe experiments HDO issolve in liqui H O show the spectral ynamics an the vibrational relaxation of the OD stretch vibration.

More information

A Blame-Based Approach to Generating Proposals for Handling Inconsistency in Software Requirements

A Blame-Based Approach to Generating Proposals for Handling Inconsistency in Software Requirements International Journal of nowlege an Systems Science, 3(), -7, January-March 0 A lame-ase Approach to Generating Proposals for Hanling Inconsistency in Software Requirements eian Mu, Peking University,

More information

Consumer Referrals. Maria Arbatskaya and Hideo Konishi. October 28, 2014

Consumer Referrals. Maria Arbatskaya and Hideo Konishi. October 28, 2014 Consumer Referrals Maria Arbatskaya an Hieo Konishi October 28, 2014 Abstract In many inustries, rms rewar their customers for making referrals. We analyze the optimal policy mix of price, avertising intensity,

More information

How To Understand The Structure Of A Can (Can)

How To Understand The Structure Of A Can (Can) Thi t t ith F M k 4 0 4 BOSCH CAN Specification Version 2.0 1991, Robert Bosch GmbH, Postfach 50, D-7000 Stuttgart 1 The ocument as a whole may be copie an istribute without restrictions. However, the

More information

How To Predict A Call Capacity In A Voip System

How To Predict A Call Capacity In A Voip System Paper Preictive Moeling in a VoIP System Ana-Maria Simionovici a, Alexanru-Arian Tantar a, Pascal Bouvry a, an Loic Dielot b a Computer Science an Communications University of Luxembourg, Luxembourg b

More information

Trace IP Packets by Flexible Deterministic Packet Marking (FDPM)

Trace IP Packets by Flexible Deterministic Packet Marking (FDPM) Trace P Packets by Flexible Deterministic Packet Marking (F) Yang Xiang an Wanlei Zhou School of nformation Technology Deakin University Melbourne, Australia {yxi, wanlei}@eakin.eu.au Abstract- Currently

More information

Optimal Control Policy of a Production and Inventory System for multi-product in Segmented Market

Optimal Control Policy of a Production and Inventory System for multi-product in Segmented Market RATIO MATHEMATICA 25 (2013), 29 46 ISSN:1592-7415 Optimal Control Policy of a Prouction an Inventory System for multi-prouct in Segmente Market Kuleep Chauhary, Yogener Singh, P. C. Jha Department of Operational

More information

DIFFRACTION AND INTERFERENCE

DIFFRACTION AND INTERFERENCE DIFFRACTION AND INTERFERENCE In this experiment you will emonstrate the wave nature of light by investigating how it bens aroun eges an how it interferes constructively an estructively. You will observe

More information

Sustainability Through the Market: Making Markets Work for Everyone q

Sustainability Through the Market: Making Markets Work for Everyone q www.corporate-env-strategy.com Sustainability an the Market Sustainability Through the Market: Making Markets Work for Everyone q Peter White Sustainable evelopment is about ensuring a better quality of

More information

Measures of distance between samples: Euclidean

Measures of distance between samples: Euclidean 4- Chapter 4 Measures of istance between samples: Eucliean We will be talking a lot about istances in this book. The concept of istance between two samples or between two variables is funamental in multivariate

More information

Minimizing Makespan in Flow Shop Scheduling Using a Network Approach

Minimizing Makespan in Flow Shop Scheduling Using a Network Approach Minimizing Makespan in Flow Shop Scheuling Using a Network Approach Amin Sahraeian Department of Inustrial Engineering, Payame Noor University, Asaluyeh, Iran 1 Introuction Prouction systems can be ivie

More information

Hull, Chapter 11 + Sections 17.1 and 17.2 Additional reference: John Cox and Mark Rubinstein, Options Markets, Chapter 5

Hull, Chapter 11 + Sections 17.1 and 17.2 Additional reference: John Cox and Mark Rubinstein, Options Markets, Chapter 5 Binomial Moel Hull, Chapter 11 + ections 17.1 an 17.2 Aitional reference: John Cox an Mark Rubinstein, Options Markets, Chapter 5 1. One-Perio Binomial Moel Creating synthetic options (replicating options)

More information

Option Pricing for Inventory Management and Control

Option Pricing for Inventory Management and Control Option Pricing for Inventory Management an Control Bryant Angelos, McKay Heasley, an Jeffrey Humpherys Abstract We explore the use of option contracts as a means of managing an controlling inventories

More information

The most common model to support workforce management of telephone call centers is

The most common model to support workforce management of telephone call centers is Designing a Call Center with Impatient Customers O. Garnett A. Manelbaum M. Reiman Davison Faculty of Inustrial Engineering an Management, Technion, Haifa 32000, Israel Davison Faculty of Inustrial Engineering

More information

Sensor Network Localization from Local Connectivity : Performance Analysis for the MDS-MAP Algorithm

Sensor Network Localization from Local Connectivity : Performance Analysis for the MDS-MAP Algorithm Sensor Network Localization from Local Connectivity : Performance Analysis for the MDS-MAP Algorithm Sewoong Oh an Anrea Montanari Electrical Engineering an Statistics Department Stanfor University, Stanfor,

More information

MODELLING OF TWO STRATEGIES IN INVENTORY CONTROL SYSTEM WITH RANDOM LEAD TIME AND DEMAND

MODELLING OF TWO STRATEGIES IN INVENTORY CONTROL SYSTEM WITH RANDOM LEAD TIME AND DEMAND art I. robobabilystic Moels Computer Moelling an New echnologies 27 Vol. No. 2-3 ransport an elecommunication Institute omonosova iga V-9 atvia MOEING OF WO AEGIE IN INVENOY CONO YEM WIH ANOM EA IME AN

More information

A New Pricing Model for Competitive Telecommunications Services Using Congestion Discounts

A New Pricing Model for Competitive Telecommunications Services Using Congestion Discounts A New Pricing Moel for Competitive Telecommunications Services Using Congestion Discounts N. Keon an G. Ananalingam Department of Systems Engineering University of Pennsylvania Philaelphia, PA 19104-6315

More information

Performance Analysis of Bandwidth Allocations for Multi-Services Mobile Wireless Cellular Networks *

Performance Analysis of Bandwidth Allocations for Multi-Services Mobile Wireless Cellular Networks * erformance Analysis of Banwith Allocations for Multi-Serices Mobile Wireless Cellular Networs * Lizhong Li Bin Li Bo Li Xi-Ren Cao Department of Computer Science Department of Electrical an Electronic

More information

Search Advertising Based Promotion Strategies for Online Retailers

Search Advertising Based Promotion Strategies for Online Retailers Search Avertising Base Promotion Strategies for Online Retailers Amit Mehra The Inian School of Business yeraba, Inia Amit Mehra@isb.eu ABSTRACT Web site aresses of small on line retailers are often unknown

More information

Professional Level Options Module, Paper P4(SGP)

Professional Level Options Module, Paper P4(SGP) Answers Professional Level Options Moule, Paper P4(SGP) Avance Financial Management (Singapore) December 2007 Answers Tutorial note: These moel answers are consierably longer an more etaile than woul be

More information

CALCULATION INSTRUCTIONS

CALCULATION INSTRUCTIONS Energy Saving Guarantee Contract ppenix 8 CLCULTION INSTRUCTIONS Calculation Instructions for the Determination of the Energy Costs aseline, the nnual mounts of Savings an the Remuneration 1 asics ll prices

More information

Malawi Television White Spaces (TVWS) Pilot Network Performance Analysis

Malawi Television White Spaces (TVWS) Pilot Network Performance Analysis Journal of Wireless Networking an Communications 2014, 4(1): 26-32 DOI: 10.5923/j.jwnc.20140401.04 Malawi Television White Spaces (TVWS) Pilot Network Performance Analysis C. Mikeka 1,*, M. Thoi 1, J.

More information

A Comparison of Performance Measures for Online Algorithms

A Comparison of Performance Measures for Online Algorithms A Comparison of Performance Measures for Online Algorithms Joan Boyar 1, Sany Irani 2, an Kim S. Larsen 1 1 Department of Mathematics an Computer Science, University of Southern Denmark, Campusvej 55,

More information

Forecasting and Staffing Call Centers with Multiple Interdependent Uncertain Arrival Streams

Forecasting and Staffing Call Centers with Multiple Interdependent Uncertain Arrival Streams Forecasting an Staffing Call Centers with Multiple Interepenent Uncertain Arrival Streams Han Ye Department of Statistics an Operations Research, University of North Carolina, Chapel Hill, NC 27599, hanye@email.unc.eu

More information

The higher education factor: The role of higher education in the hiring and promotion practices in the fire service. By Nick Geis.

The higher education factor: The role of higher education in the hiring and promotion practices in the fire service. By Nick Geis. The higher eucation factor: The role of higher eucation in the hiring an promotion practices in the fire service. By Nick Geis Spring 2012 A paper submitte to the faculty of The University of North Carolina

More information

Software Diversity for Information Security

Software Diversity for Information Security for Information Security Pei-yu Chen, Gaurav Kataria an Ramayya Krishnan,3 Heinz School, Tepper School an 3 Cylab Carnegie Mellon University Abstract: In this paper we analyze a software iversification-base

More information

Definition of the spin current: The angular spin current and its physical consequences

Definition of the spin current: The angular spin current and its physical consequences Definition of the spin current: The angular spin current an its physical consequences Qing-feng Sun 1, * an X. C. Xie 2,3 1 Beijing National Lab for Conense Matter Physics an Institute of Physics, Chinese

More information

How To Price Internet Access In A Broaban Service Charge On A Per Unit Basis

How To Price Internet Access In A Broaban Service Charge On A Per Unit Basis iqui Pricing for Digital Infrastructure Services Subhajyoti Banyopahyay * an sing Kenneth Cheng Department of Decision an Information Sciences Warrington College of Business Aministration University of

More information

Safety Stock or Excess Capacity: Trade-offs under Supply Risk

Safety Stock or Excess Capacity: Trade-offs under Supply Risk Safety Stock or Excess Capacity: Trae-offs uner Supply Risk Aahaar Chaturvei Victor Martínez-e-Albéniz IESE Business School, University of Navarra Av. Pearson, 08034 Barcelona, Spain achaturvei@iese.eu

More information

SEC Issues Proposed Guidance to Fund Boards Relating to Best Execution and Soft Dollars

SEC Issues Proposed Guidance to Fund Boards Relating to Best Execution and Soft Dollars September 2008 / Issue 21 A legal upate from Dechert s Financial Services Group SEC Issues Propose Guiance to Fun Boars Relating to Best Execution an Soft Dollars The Securities an Exchange Commission

More information

Risk Management for Derivatives

Risk Management for Derivatives Risk Management or Derivatives he Greeks are coming the Greeks are coming! Managing risk is important to a large number o iniviuals an institutions he most unamental aspect o business is a process where

More information

Rural Development Tools: What Are They and Where Do You Use Them?

Rural Development Tools: What Are They and Where Do You Use Them? Faculty Paper Series Faculty Paper 00-09 June, 2000 Rural Development Tools: What Are They an Where Do You Use Them? By Dennis U. Fisher Professor an Extension Economist -fisher@tamu.eu Juith I. Stallmann

More information

A NATIONAL MEASUREMENT GOOD PRACTICE GUIDE. No.107. Guide to the calibration and testing of torque transducers

A NATIONAL MEASUREMENT GOOD PRACTICE GUIDE. No.107. Guide to the calibration and testing of torque transducers A NATIONAL MEASUREMENT GOOD PRACTICE GUIDE No.107 Guie to the calibration an testing of torque transucers Goo Practice Guie 107 Measurement Goo Practice Guie No.107 Guie to the calibration an testing of

More information

Innovation Union means: More jobs, improved lives, better society

Innovation Union means: More jobs, improved lives, better society The project follows the Lisbon an Gothenburg Agenas, an supports the EU 2020 Strategy, in particular SMART Growth an the Innovation Union: Innovation Union means: More jobs, improve lives, better society

More information

Chapter 9 AIRPORT SYSTEM PLANNING

Chapter 9 AIRPORT SYSTEM PLANNING Chapter 9 AIRPORT SYSTEM PLANNING. Photo creit Dorn McGrath, Jr Contents Page The Planning Process................................................... 189 Airport Master Planning..............................................

More information

Lagrangian and Hamiltonian Mechanics

Lagrangian and Hamiltonian Mechanics Lagrangian an Hamiltonian Mechanics D.G. Simpson, Ph.D. Department of Physical Sciences an Engineering Prince George s Community College December 5, 007 Introuction In this course we have been stuying

More information

Energy Cost Optimization for Geographically Distributed Heterogeneous Data Centers

Energy Cost Optimization for Geographically Distributed Heterogeneous Data Centers Energy Cost Optimization for Geographically Distribute Heterogeneous Data Centers Eric Jonari, Mark A. Oxley, Sueep Pasricha, Anthony A. Maciejewski, Howar Jay Siegel Abstract The proliferation of istribute

More information

Low-Complexity and Distributed Energy Minimization in Multi-hop Wireless Networks

Low-Complexity and Distributed Energy Minimization in Multi-hop Wireless Networks Low-Complexity an Distribute Energy inimization in ulti-hop Wireless Networks Longbi Lin, Xiaojun Lin, an Ness B. Shroff Center for Wireless Systems an Applications (CWSA) School of Electrical an Computer

More information

Mandate-Based Health Reform and the Labor Market: Evidence from the Massachusetts Reform

Mandate-Based Health Reform and the Labor Market: Evidence from the Massachusetts Reform Manate-Base Health Reform an the Labor Market: Evience from the Massachusetts Reform Jonathan T. Kolsta Wharton School, University of Pennsylvania an NBER Amana E. Kowalski Department of Economics, Yale

More information

SCADA (Supervisory Control and Data Acquisition) systems

SCADA (Supervisory Control and Data Acquisition) systems Proceeings of the 2013 Feerate Conference on Computer Science an Information Systems pp. 1423 1428 Improving security in SCADA systems through firewall policy analysis Onrej Rysavy Jaroslav Rab Miroslav

More information

arxiv:1309.1857v3 [gr-qc] 7 Mar 2014

arxiv:1309.1857v3 [gr-qc] 7 Mar 2014 Generalize holographic equipartition for Friemann-Robertson-Walker universes Wen-Yuan Ai, Hua Chen, Xian-Ru Hu, an Jian-Bo Deng Institute of Theoretical Physics, LanZhou University, Lanzhou 730000, P.

More information