Serdar Boztas

Nonbinary sequences with perfect and nearly perfect autocorrelations

The design of pseudorandom sequences with optimal correlation properties forms a crucial part of communications and radar engineering. Perfect autocorrelation sequences are however exceedingly rare. We discuss a technique that yields examples of such designs over enlarged PSK (PSK+) alphabets. We also design nearly perfect autocorrelation sequences over enlarged QAM (QAM+) alphabets, compatible with contemporary wireless transmission standards.

Pattern recognition techniques for the classification of malware packers

Packing is the most common obfuscation method used by malware writers to hinder malware detection and analysis. There has been a dramatic increase in the number of new packers and variants of existing ones combined with packers employing increasingly sophisticated anti-unpacker tricks and obfuscation methods. This makes it difficult, costly and time-consuming for antivirus (AV) researchers to carry out the traditional static packer identification and classification methods which are mainly based on the packers byte signature. In this paper1, we present a simple, yet fast and effective packer classification framework that applies pattern recognition techniques on automatically extracted randomness profiles of packers. This system can be run without AV researchers manual input. We test various statistical classification algorithms, including k-Nearest Neighbor, Best-first Decision Tree, Sequential Minimal Optimization and Naive Bayes. We test these algorithms on a large data set that consists of clean packed files and 17,336 real malware samples. Experimental results demonstrate that our packer classification system achieves extremely high effectiveness (> 99%). The experiments also confirm that the randomness profile used in the system is a very strong feature for packer classification. It can be applied with high accuracy on real malware samples.

On Independence and Sensitivity of Statistical Randomness Tests

Statistical randomness testing has significant importance in analyzing the quality of random number generators. In this study, we focus on the independence of randomness tests and its effect on the coverage of test suites. We experimentally observe that frequency, overlapping template, longest run of ones, random walk height and maximum order complexity tests are correlated for short sequences. We also proposed the concept of sensitivity, where we analyze the effect of simple transformations on output p-values. We claim that whenever the effect is significant, the composition of the transformation and the test may be included to the suite as a new test.

Entropy of the Retina Template

We compare two vessel extraction methods for creation of a retina template, using a database of 20 images of normal retinas. Each vessel in a well defined region is represented by a three dimensional feature, from which a retina template is built. Based on the sample distributions, we propose a preliminary theoretical model to predict the entropy of a retina template. We analyse by experimental and theoretical means the entropy present, and infer that entropy from our retina template compares sufficiently favourably with that of a minutia-based fingerprint template to warrant further study.

Community Detection in Bipartite Networks Using Random Walks

Community detection plays a crucial role in many complex networks, including the increasingly important class of bipartite networks. Modularity-based community detection algorithms for bipartite networks are hampered by their well known resolution limit. Unfortunately, the high-performing random walk based algorithm Infomap, which does not have the same constraint, cannot be applied to bipartite networks.To overcome this we integrate the projection method for bipartite networks based on common neighbors similarity into Infomap, to acquire a weighted one mode network that can be clustered by the random walks technique. We also compare results obtained from this process with results in the literature. We illustrate the proposed method on four real bipartite networks, showing that the random walks technique is more effective than the modularity technique in finding communities from bipartite networks as well.

On the Aperiodic Correlation Function of Galois Ring m-Sequences

We define Gauss-like sums over the Galois Ring GR(4, r) and bound them using the Cauchy-Schwarz inequality. These sums are then used to obtain an upper bound on the aperiodic correlation function of quadriphase m-sequences constructed from GR(4, r).Our first bound ?1 has a simple derivation and is better than the previous upper bound of Shanbag et. al. for small values of N. We then make use of a result of Shanbag et. al. to improve our bound which gives rise to a bound ?improved which is better than the bound of Shanbag et. al.These results can be used as a benchmark while searching for the best phases--termed auto-optimal phases--of such quadriphase sequences for use in spread spectrum communication systems. The bounds can also be applied to many other classes of non binary sequences.

On the relative abundance of nonbinary sequences with perfect autocorrelations

The design of pseudorandom sequences with optimal correlation properties forms a crucial part of communications and radar engineering. Perfect autocorrelation sequences are however very rare. We recall a technique that yields examples of nonbinary sequences with perfect autocorrelation over enlarged PSK (PSK+) alphabets. It turns out that there are a large number of existing sequence constructions that we can utilize yield perfect correlation sequences, and that this affords a large number of choices for the length and alphabet of such sequences. We have also considered sequences with ideal autocorrelation with respect to their LPI/LPD properties and obtained initial results in this direction.

On Transmission Scheduling in Wireless Networks

In the 1990s Chlamtac and Farago introduced a transmission scheduling (TS) algorithm for wireless networks, called the (proper robust scheduling) PRS algorithm, later generalized to ML-PRS by Boztas to support a set of multipriority users, each with different transmission characteristics. More recently, this concept has been extended to TSMA (time spread multiple access) protocols-TDMA style protocols which are independent of network topology, subject to some global constraints, such as number of users, and maximum degree of the graph representing connectivity of the wireless network. We propose two improvements to TSMA protocols in this paper. The first one uses constant weight codes to reduce PRS framelength. The second one uses the coset structure of Galois fields to improve the ML-PRS algorithm by supporting more lower priority users for roughly comparable framelength

Constacyclic codes and constacyclic DFTs

We discuss the encoding/decoding of constacyclic codes by means of a constacyclic DFT. The constacyclic DFT can be applied to codes over finite fields as well as finite rings. We can also apply the constacyclic DFT to the decoding of cyclic codes by means of a structure theorem that decomposes cyclic codes into constacyclic codes.

Graph Based Framework for Malicious Insider Threat Detection

While most security projects have focused on fending off attacks coming from outside the organizational boundaries, a real threat has arisen from the people who are inside those perimeter protections. Insider threats have shown their power by hugely affecting national security, financial stability, and the privacy of many thousands of people. What is in the news is the tip of the iceberg, with much more going on under the radar, and some threats never being detected. We propose a hybrid framework based on graphical analysis and anomaly detection approaches, to combat this severe cyber security threat. Our framework analyzes heterogeneous data in isolating possible malicious users hiding behind others. Empirical results reveal this framework to be effective in distinguishing the majority of users who demonstrate typical behavior from the minority of users who show suspicious behavior.