To implement structural hybrid simulation independent of the control system of any testing equipment in civil engineering, an external command control approach is put forward. Several setup technologies and the corres...To implement structural hybrid simulation independent of the control system of any testing equipment in civil engineering, an external command control approach is put forward. Several setup technologies and the corresponding API approaches are investigated to simultaneously combine numerical simulation with physical testing. Hybrid program technology is put forward and described in detail, using Visual C++ program to effectively and accurately control testing equipment and MATLAB program to implement numerical simulation with easy extension. The control program of testing equipment and numerical simulation program are integrated by calling MATLAB engine in Visual C++. A hybrid simulation about a full-scale six-story masonry structure is carried out. The testing results manifest that the external command control approach has the versatility because of simple hardware connection and control program independent on control software of testing equipment; powerful program function of Visual C++ and flexible program of MATLAB are integrated by hybrid program technology; hybrid simulation system provides a realistic and cost-effective testing platform that enables earthquake engineer researchers to accurately and efficiently capture the seismic performance of large or complex structures without having to carry out physical testing of the entire structure.展开更多
针对目前恶意软件检测分类方法在特征提取、检测准确率等方面面临的挑战,提出一种基于API分组重构与图像表示的恶意软件检测分类方法。首先,对恶意软件调用的API类别统一编号,将API指令序列中相同编号的API聚合为同一API组,根据恶意软...针对目前恶意软件检测分类方法在特征提取、检测准确率等方面面临的挑战,提出一种基于API分组重构与图像表示的恶意软件检测分类方法。首先,对恶意软件调用的API类别统一编号,将API指令序列中相同编号的API聚合为同一API组,根据恶意软件运行时各类API的首次调用顺序对API组重排序,将各API组的条目数记录为该类API对软件样本的贡献度。经分组重构后,各API组按序组织,其顺序为软件样本调用各类API的顺序。各API组内部有序,其内部各API的排列顺序即为软件样本对单个API的调用顺序。有序化的API分组有助于API指令序列信息的图像化表达。基于重组的API指令序列提取API编号作为全局特征列表、API贡献度作为局部特征列表、API顺序索引作为时序特征列表,对特征列表进行标准化与零填充,转化为统一尺寸的特征数组。其中,API编号能清晰地标识API类别,API贡献度可以表征该API的调用频繁程度,API顺序索引可区分各API被调用的顺序。然后,分别用3类特征数组填充RGB图像的3个通道,生成3通道的API编号贡献度及顺序索引特征图像(Feature image of API code devotion and sequential index,FimgCDS)。最后,将Fimg CDS特征图像输入自主构建的轻量型恶意软件特征图像卷积神经网络(malware feature image convolutional neural network,MficNN)分类器,实现对恶意软件的检测与分类。实验结果表明,本文方法在两类数据集上的检测分类准确率分别为98.66%和98.35%,具有较高的恶意软件检测分类性能指标和检测分类速度。展开更多
针对基于Android应用程序申请权限的检测过于粗粒度的问题,提出了基于敏感应用程序编程接口(application program interface,API)配对的恶意应用检测方法。通过反编译应用程序提取危险权限对应的敏感API,将敏感API两两配对分别构建恶意...针对基于Android应用程序申请权限的检测过于粗粒度的问题,提出了基于敏感应用程序编程接口(application program interface,API)配对的恶意应用检测方法。通过反编译应用程序提取危险权限对应的敏感API,将敏感API两两配对分别构建恶意应用无向图与良性应用无向图,再根据恶意应用和良性应用在敏感API调用上的差异分配相同边不同的权重,以此检测Android恶意应用。实验结果表明,提出的方法可以有效地检测出Android恶意应用程序,具有现实意义。展开更多
传统的勒索软件动态检测方法需要收集较长时间的软件行为,难以满足勒索软件及时检测的需求.本文从勒索软件及时检测的角度出发,提出了“勒索软件检测关键时间段(Critical Time Periods for Ransomware Detection,CTP)”的概念,并基于CT...传统的勒索软件动态检测方法需要收集较长时间的软件行为,难以满足勒索软件及时检测的需求.本文从勒索软件及时检测的角度出发,提出了“勒索软件检测关键时间段(Critical Time Periods for Ransomware Detection,CTP)”的概念,并基于CTP的要求提出了一种基于应用程序编程接口(Application Programming Interface,API)短序列的勒索软件早期检测方法(Ransomware Early Detection Method based on short API Sequence,REDMS).REDMS以软件在CTP内执行时所调用的API短序列为分析对象,通过n-gram模型和词频-逆文档频率算法对采集到的API短序列进行计算以生成特征向量,然后运用机器学习算法建立检测模型对勒索软件进行早期检测.实验结果显示,REDMS在API采集时段为前7s且使用随机森林算法时,分别能以98.2%、96.7%的准确率检测出已知和未知的勒索软件样本.展开更多
基金Funded by National Natural Science Foundation of China under the Grant No.90715036Open Project of Jiangsu Key Laboratory of Structural Engineering (Grant No.ZD1004)Project of the Priority Academic Program Development of Jiangsu Higher Education Institutions (PAPD)
文摘To implement structural hybrid simulation independent of the control system of any testing equipment in civil engineering, an external command control approach is put forward. Several setup technologies and the corresponding API approaches are investigated to simultaneously combine numerical simulation with physical testing. Hybrid program technology is put forward and described in detail, using Visual C++ program to effectively and accurately control testing equipment and MATLAB program to implement numerical simulation with easy extension. The control program of testing equipment and numerical simulation program are integrated by calling MATLAB engine in Visual C++. A hybrid simulation about a full-scale six-story masonry structure is carried out. The testing results manifest that the external command control approach has the versatility because of simple hardware connection and control program independent on control software of testing equipment; powerful program function of Visual C++ and flexible program of MATLAB are integrated by hybrid program technology; hybrid simulation system provides a realistic and cost-effective testing platform that enables earthquake engineer researchers to accurately and efficiently capture the seismic performance of large or complex structures without having to carry out physical testing of the entire structure.
文摘针对目前恶意软件检测分类方法在特征提取、检测准确率等方面面临的挑战,提出一种基于API分组重构与图像表示的恶意软件检测分类方法。首先,对恶意软件调用的API类别统一编号,将API指令序列中相同编号的API聚合为同一API组,根据恶意软件运行时各类API的首次调用顺序对API组重排序,将各API组的条目数记录为该类API对软件样本的贡献度。经分组重构后,各API组按序组织,其顺序为软件样本调用各类API的顺序。各API组内部有序,其内部各API的排列顺序即为软件样本对单个API的调用顺序。有序化的API分组有助于API指令序列信息的图像化表达。基于重组的API指令序列提取API编号作为全局特征列表、API贡献度作为局部特征列表、API顺序索引作为时序特征列表,对特征列表进行标准化与零填充,转化为统一尺寸的特征数组。其中,API编号能清晰地标识API类别,API贡献度可以表征该API的调用频繁程度,API顺序索引可区分各API被调用的顺序。然后,分别用3类特征数组填充RGB图像的3个通道,生成3通道的API编号贡献度及顺序索引特征图像(Feature image of API code devotion and sequential index,FimgCDS)。最后,将Fimg CDS特征图像输入自主构建的轻量型恶意软件特征图像卷积神经网络(malware feature image convolutional neural network,MficNN)分类器,实现对恶意软件的检测与分类。实验结果表明,本文方法在两类数据集上的检测分类准确率分别为98.66%和98.35%,具有较高的恶意软件检测分类性能指标和检测分类速度。
文摘针对基于Android应用程序申请权限的检测过于粗粒度的问题,提出了基于敏感应用程序编程接口(application program interface,API)配对的恶意应用检测方法。通过反编译应用程序提取危险权限对应的敏感API,将敏感API两两配对分别构建恶意应用无向图与良性应用无向图,再根据恶意应用和良性应用在敏感API调用上的差异分配相同边不同的权重,以此检测Android恶意应用。实验结果表明,提出的方法可以有效地检测出Android恶意应用程序,具有现实意义。
文摘传统的勒索软件动态检测方法需要收集较长时间的软件行为,难以满足勒索软件及时检测的需求.本文从勒索软件及时检测的角度出发,提出了“勒索软件检测关键时间段(Critical Time Periods for Ransomware Detection,CTP)”的概念,并基于CTP的要求提出了一种基于应用程序编程接口(Application Programming Interface,API)短序列的勒索软件早期检测方法(Ransomware Early Detection Method based on short API Sequence,REDMS).REDMS以软件在CTP内执行时所调用的API短序列为分析对象,通过n-gram模型和词频-逆文档频率算法对采集到的API短序列进行计算以生成特征向量,然后运用机器学习算法建立检测模型对勒索软件进行早期检测.实验结果显示,REDMS在API采集时段为前7s且使用随机森林算法时,分别能以98.2%、96.7%的准确率检测出已知和未知的勒索软件样本.
