Structural Entropy and Metamorphic Malware by Donabelle BaysaMetamorphic malware is capable of changing its internal structure without altering its functionality. A common signature is nonexistent in highly metamorphic malware. Consequently, such malware may remain undetected even under emulation and signature scanning combined.In this project, we use the concept of structural entropy to analyze variations in the complexity of data within a file. The process consists of two stages, namely, file segmentation and sequence comparison. In the file segmentation stage, we use entropy measurements and wavelet analysis to segment a file. The second stage measures the similarity of files by computing the edit distance between sequence segments. We apply this technique to the metamorphic detection problem and show that we can obtain strong results in certain challenging cases.
ACKNOWLEDGMENTSMy sincere appreciation is due to my advisor, Dr. Mark Stamp, for his guidance and encouragement throughout the project. I consider it an honor to have worked with a professor who possesses true passion for teaching.
Field observations on territorial behavior of the fish P. flavicauda were made for a total of 200 hours at Heron Island, Great Barrier Reef. Specimens 6 cm or more in length restricted their movements to areas of approximately 2 m over at least a 5-month period. Distribution of the fish was highly correlated (r = 0.89) with the amount of interface between sand and dead coral. Such areas provided algae in close proximity to shelter. Observations of agonistic behavior showed that P. flavicauda usually responded agonistically to 38 species of 12 families, but not to 16 other species of 6 families. Apparently competitors for algae elicit an agonistic response from P. flavicauda, while carnivores do not. Maps locating the positions of agosnistic encounters indicate that the entire home range is defended as a territory. The effectiveness of the agonistic behavior was indicated when, following the removal of 6 specimens of P. flavicauda, there was an increase in algal-feeding fishes seen within their territories. Implications, of these results for out understanding of interspecific territoriality are discussed.
scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.