Yoseba K. Penya

N-GRAMS-BASED FILE SIGNATURES FOR MALWARE DETECTION

Malware is any malicious code that has the potential to harm any computer or network. The amount of malware is increasing faster every year and poses a serious security threat. Thus, malware detection is a critical topic in computer security. Currently, signature-based detection is the most extended method for detecting malware. Although this method is still used on most popular commercial computer antivirus software, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new malware. Applying a methodology proven successful in similar problem-domains, we propose the use of ngrams (every substring of a larger string, of a fixed lenght n) as file signatures in order to detect unknown malware whilst keeping low false positive ratio. We show that n-grams signatures provide an effective way to detect unknown malware.

Idea: opcode-sequence-based malware detection

Malware is every malicious code that has the potential to harm any computer or network. The amount of malware is increasing faster every year and poses a serious security threat. Hence, malware detection has become a critical topic in computer security. Currently, signature-based detection is the most extended method within commercial antivirus. Although this method is still used on most popular commercial computer antivirus software, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new variations of known malware. In this paper, we propose a new method to detect variants of known malware families. This method is based on the frequency of appearance of opcode sequences. Furthermore, we describe a method to mine the relevance of each opcode and, thereby, weigh each opcode sequence frequency. We show that this method provides an effective way to detect variants of known malware families.

Evaluating Combined Load Forecasting in Large Power Systems and Smart Grids

We present here a combined aggregative short-term load forecasting method for smart grids, a novel methodology that allows us to obtain a global prognosis by summing up the forecasts on the compounding individual loads. More accurately, we detail here three new approaches, namely bottom-up aggregation (with and without bias correction), top-down aggregation (with and without bias correction), and regressive aggregation. Further, we have devised an experiment to compare their results, evaluating them with two datasets of real data and showing the feasibility of aggregative forecast combinations for smart grids.

Efficient building load forecasting

The arrival of the smart grid paradigm has brought a number of novel initiatives that aim at increasing the level of energy efficiency of buildings such as smart metering or demand side management. Still, all of them demand an accurate load estimation. Short-term load forecasting in buildings presents additional requirements, among others the need of prediction models with simple or non-existing parametrisation processes. We extend a previous work that evaluated a number of algorithms to this end. Herewith we present several improvements including a variable data learning window and diverse learning data weighting combinations that further up improve our results. Finally, we have tested all the algorithms and modalities with four different datasets to show how the results hold up.

Short-term load forecasting in air-conditioned non-residential Buildings

Short-term load forecasting (STLF) has become an essential tool in the electricity sector. It has been classically object of vast research since energy load prediction is known to be non-linear. In a previous work, we focused on non-residential building STLF, an special case of STLF where weather has negligible influence on the load. Now we tackle more modern buildings in which the temperature does alter its energy consumption. This is, we address here fully-HVAC (Heating, Ventilating, and Air Conditioning) ones. Still, in this problem domain, the forecasting method selected must be simple, without tedious trial-and-error configuring or parametrising procedures, work with scarce (or any) training data and be able to predict an evolving demand curve. Following our preceding research, we have avoided the inherent non-linearity by using the work day schedule as day-type classifier. We have evaluated the most popular STLF systems in the literature, namely ARIMA (autoregressive integrated moving average) time series and Neural networks (NN), together with an Autoregressive Model (AR) time series and a Bayesian network (BN), concluding that the autoregressive time series outperforms its counterparts and suffices to fulfil the addressed requirements, even in a 6 day-ahead horizon.

Advanced fault prediction in high-precision foundry production

Microshrinkages are known as probably the most difficult defects to avoid in high-precision foundry due to the large number of factors involved in their apparition. The presence of this failure renders the casting invalid, with the subsequent cost increment. Bayesian networks allow to model the foundry process as a probabilistic constellation of interrelated variables. In this way, after a suitable learning process, the Bayesian network is able to infer causal relationships; in other words, it may guess the value of a variable (for instance, the presence or not of a defect). Against this background, we present here the first microshrinkage prediction system that, upon the basis of a Bayesian network, is able to foresee the apparition of this defect in order to avoid it. Further, we have tested this system in two real foundries and present here the obtained results.

Mechanical properties prediction in high-precision foundry production

Mechanical properties are the attributes of a metal to withstand several forces and tensions. Specifically, ultimate tensile strength is the force a material can resist until it breaks. The only way to examine this mechanical property is the employment of destructive inspections that renders the casting invalid with the subsequent cost increment. In a previous work we showed that modelling the foundry process as a probabilistic constellation of interrelated variables allows Bayesian networks to infer causal relationships. In other words, they may guess the value of a variable (for instance, the value of ultimate tensile strength). Against this background, we present here the first ultimate tensile strength prediction system that, upon the basis of a Bayesian network, is able to foresee the values of this property in order to correct it before the casting is made. Further, we have tested the accuracy and error rate of the system with data of a real foundry.

Optimising Machine-Learning-Based Fault Prediction in Foundry Production

Microshrinkages are known as probably the most difficult defects to avoid in high-precision foundry. The presence of this failure renders the casting invalid, with the subsequent cost increment. Modelling the foundry process as an expert knowledge cloud allows properly-trained machine learning algorithms to foresee the value of a certain variable, in this case the probability that a microshrinkage appears within a casting. Extending previous research that presented outstanding results with a Bayesian-network-based approach, we have adapted and tested an artificial neural network and the K-nearest neighbour algorithm for the same objective. Finally, we compare the obtained results and show that Bayesian networks are more suitable than the rest of the counterparts for the prediction of microshrinkages.

Short-term load forecasting in non-residential Buildings

Short-term load forecasting (STLF) has become an essential tool in the electricity sector. It has been object of vast research since energy load is known to be non-linear and, therefore, very difficult to predict with accuracy. We focus here on non-residential building STLF, an special case of STLF where weather shows smaller influence on the load than in normal scenarios and forecast models, contrary to those on the literature, are required to be simple, avoiding dull and complicated trial-and-error parametrisation or setting-up processes. Under these premises, we have used a two-step methodology comprising a classification and a adjustment steps. Since the non-linearity of the load is associated to the activity in the building, we have demonstrated that the best way to deal with it is using the work day schedule as day-type classifier. Moreover, we have evaluated a number of statistical methods and Artificial Intelligence methods to adjust the typical hourly consumption curve, concluding that an autoregressive time series suffices to fulfil the requirements, even in a 5 day-ahead horizon.

Optimal combinatorial electricity markets

The deregulation of the electricity industry in many countries has created a number of marketplaces in which producers and consumers can operate in order to more effectively manage and meet their energy needs. To this end, this paper develops a new model for electricity retail where end-use customers choose their supplier from competing electricity retailers. The model is based on simultaneous reverse combinatorial auctions, designed as a second-price sealed-bid multi-item auction with supply function bidding. This model prevents strategic bidding and allows the auctioneer to maximise its pay-off. Furthermore, we develop optimal single-item and multi-item algorithms for winner determination in such auctions that are significantly less complex than those currently available in the literature.