Shaowu Liu

Mining permission patterns for contrasting clean and malicious android applications

Abstract An Android application uses a permission system to regulate the access to system resources and users’ privacy-relevant information. Existing works have demonstrated several techniques to study the required permissions declared by the developers, but little attention has been paid towards used permissions. Besides, no specific permission combination is identified to be effective for malware detection. To fill these gaps, we have proposed a novel pattern mining algorithm to identify a set of contrast permission patterns that aim to detect the difference between clean and malicious applications. A benchmark malware dataset and a dataset of 1227 clean applications has been collected by us to evaluate the performance of the proposed algorithm. Valuable findings are obtained by analyzing the returned contrast permission patterns.

K-Complex Detection Using a Hybrid-Synergic Machine Learning Method

Sleep stage identification is the first step in modern sleep disorder diagnostics process. K-complex is an indicator for the sleep stage 2. However, due to the ambiguity of the translation of the medical standards into a computer-based procedure, reliability of automated K-complex detection from the EEG wave is still far from expectation. More specifically, there are some significant barriers to the research of automatic K-complex detection. First, there is no adequate description of K-complex that makes it difficult to develop automatic detection algorithm. Second, human experts only provided the label for whether a whole EEG segment contains K-complex or not, rather than individual labels for each subsegment. These barriers render most pattern recognition algorithms inapplicable in detecting K-complex. In this paper, we attempt to address these two challenges, by designing a new feature extraction method that can transform visual features of the EEG wave with any length into mathematical representation and proposing a hybrid-synergic machine learning method to build a K-complex classifier. The tenfold cross-validation results indicate that both the accuracy and the precision of this proposed model are at least as good as a human expert in K-complex detection.

Contrasting Permission Patterns between Clean and Malicious Android Applications

The Android platform uses a permission system model to allow users and developers to regulate access to private information and system resources required by applications. Permissions have been proved to be useful for inferring behaviors and characteristics of an application. In this paper, a novel method to extract contrasting permission patterns for clean and malicious applications is proposed. Contrary to existing work, both required and used permissions were considered when discovering the patterns. We evaluated our methodology on a clean and a malware dataset, each comprising of 1227 applications. Our empirical results suggest that our permission patterns can capture key differences between clean and malicious applications, which can assist in characterizing these two types of applications.

Identifying Microphone from Noisy Recordings by Using Representative Instance One Class-Classification Approach

Rapid growth of technical developments has created huge challenges for microphone forensics - a sub-category of audio forensic science, because of the availability of numerous digital recording devices and massive amount of recording data. Demand for fast and efficient methods to assure integrity and authenticity of information is becoming more and more important in criminal investigation nowadays. Machine learning has emerged as an important technique to support audio analysis processes of microphone forensic practitioners. However, its application to real life situations using supervised learning is still facing great challenges due to expensiveness in collecting data and updating system. In this paper, we introduce a new machine learning approach which is called One-class Classification (OCC) to be applied to microphone forensics; we demonstrate its capability on a corpus of audio samples collected from several microphones. In addition, we propose a representative instance classification framework (RICF) that can effectively improve performance of OCC algorithms for recording signal with noise. Experiment results and analysis indicate that OCC has the potential to benefit microphone forensic practitioners in developing new tools and techniques for effective and efficient analysis.

Preference Relation-based Markov Random Fields for Recommender Systems

A preference relation-based Top-N recommendation approach is proposed to capture both second-order and higher-order interactions among users and items. Traditionally Top-N recommendation was achieved by predicting the item ratings first, and then inferring the item rankings, based on the assumption of availability of explicit feedback such as ratings, and the assumption that optimizing the ratings is equivalent to optimizing the item rankings. Nevertheless, both assumptions are not always true in real world applications. The proposed approach drops these assumptions by exploiting preference relations, a more practical user feedback. Furthermore, the proposed approach enjoys the representational power of Markov Random Fields thus side information such as item and user attributes can be easily incorporated. Comparing to related work, the proposed approach has the unique property of modeling both second-order and higher-order interactions among users and items. To the best of our knowledge, this is the first time both types of interactions have been captured in preference-relation based methods. Experimental results on public datasets demonstrate that both types of interactions have been properly captured, and significantly improved Top-N recommendation performance has been achieved.

WiseFi: Activity Localization and Recognition on Commodity Off-the-Shelf WiFi Devices

Most recently, activity localization and recognition has increasingly attracted significant attentions due to its broad range of applications to support smart devices. Pioneer systems based on WiFi signals usually require six to eight antennas to localize the activity while the commodity WiFi infrastructure does not meet this requirement. In addition, they also require the priori learning of wireless signals to recognize a pre-defined set of activities. In this paper, we present WiseFi, an activity localization and recognition system by leveraging fine-grained physical layer information on commodity off-the-shelf (COTS) WiFi devices. WiseFi harnesses the amplitude and the phase of Channel State Information (CSI), and the Angle-of-arrival (AOA) of blocked signals to localize and recognize human activity. The intuition behind WiseFi is that whenever the target occludes the incoming wireless signals, the power of AOA will drop in the same direction. Experimental results indicate that WiseFi can achieve comparable performance in activity localization and recognition on COTS WiFi devices.

Parallel bucket sorting on graphics processing units based on convex optimization

We found an interesting relation between convex optimization and sorting problem. We present a parallel algorithm to compute multiple order statistics of the data by minimizing a number of related convex functions. The computed order statistics serve as splitters that group the data into buckets suitable for parallel bitonic sorting. This led us to a parallel bucket sort algorithm, which we implemented for many-core architecture of graphics processing units (GPUs). The proposed sorting method is competitive to the state-of-the-art GPU sorting algorithms and is superior to most of them for long sorting keys.

DPWeVote: differentially private weighted voting protocol for cloud-based decision-making

ABSTRACT With the advent of Industry 4.0, cloud computing techniques have been increasingly adopted by industry practitioners to achieve better workflows. One important application is cloud-based decision-making, in which multiple enterprise partners need to arrive an agreed decision. Such cooperative decision-making problem is sometimes formed as a weighted voting game, in which enterprise partners express ‘YES/NO’ opinions. Nevertheless, existing cryptographic approaches to Cloud-Based Weighted Voting Game have restricted collusion tolerance and heavily rely on trusted servers, which are not always available. In this work, we consider the more realistic scenarios of having semi-honest cloud server/partners and assuming maximal collusion tolerance. To resolve the privacy issues in such scenarios, the DPWeVote protocol is proposed which incorporates Randomized Response technique and consists the following three phases: the Randomized Weights Collection phase, the Randomized Opinions Collection phase, and the Voting Results Release phase. Experiments on synthetic data have demonstrated that the proposed DPWeVote protocol managed to retain an acceptable utility for decision-making while preserving privacy in semi-honest environment.

NotiFi: A ubiquitous WiFi-based abnormal activity detection system

We build an ubiquitous abnormal activity detection system, namely NotiFi, for accurately detecting the abnormal activities on commercial off-the-shelf (COTS) IEEE 802.11 devices. In contrast to the traditional wearable sensor based and computer vision based systems which require additional sensors or enough lighting in line-of-sight (LoS) scenario, we proceed directly with abnormal activity characterization and activity modeling at the WiFi signal level based on Channel State Information (CSI). The intuition of NotiFi is that whenever the human body occludes the wireless signal transmitting from the access point to the receiver, the phase and the amplitude information of Channel State Information (CSI) will change sensitively. By creating a multiple hierarchical Dirichlet processes, NotiFi automatically learns the number of human body activity categories for abnormal detection. Experimental results in three typical indoor environments indicate that NotiFi can achieve satisfactory performance in accuracy, robustness and stability.

Social Spammer Detection: A Multi-Relational Embedding Approach

Since the relation is the main data shape of social networks, social spammer detection desperately needs a relation-dependent but content-independent framework. Some recent detection method transforms the social relations into a set of topological features, such as degree, k-core, etc. However, the multiple heterogeneous relations and the direction within each relation have not been fully explored for identifying social spammers. In this paper, we make an attempt to adopt the Multi-Relational Embedding (MRE) approach for learning latent features of the social network. The MRE model is able to fuse multiple kinds of different relations and also learn two latent vectors for each relation indicating both sending role and receiving role of every user, respectively. Experimental results on a real-world multi-relational social network demonstrate the latent features extracted by our MRE model can improve the detection performance remarkably.