Proceedings International Conference on Multi Agent Systems (Cat. No.98EX160), 1998
Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform t... more Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform tasks by themselves due to insufficient resources. Solutions to such problems include passing tasks to others or agent migration to remote hosts. We propose agent cloning as a more comprehensive approach to the problem of local agent overloads. According to our paradigm, agents may clone, pass tasks to others, die or merge.
We address the semantic gap problem in behavioral monitoring by using hierarchical behavior graph... more We address the semantic gap problem in behavioral monitoring by using hierarchical behavior graphs to infer high-level behaviors from myriad low-level events. Our experimental system traces the execution of a process, performing data-flow analysis to identify meaningful actions such as "proxying", "keystroke logging", "data leaking", and "downloading and executing a program" from complex combinations of rudimentary system calls. To preemptively address evasive malware behavior, our specifications are carefully crafted to detect alternative sequences of events that achieve the same high-level goal. We tested eleven benign programs, variants from seven malicious bot families, four trojans, and three mass-mailing worms and found that we were able to thoroughly identify high-level behaviors across this diverse code base. Moreover, we effectively distinguished malicious execution of high-level behaviors from benign by identifying remotely-initiated actions.
Malicious software (or malware) has become a growing threat as malware writers have learned that ... more Malicious software (or malware) has become a growing threat as malware writers have learned that signaturebased detectors can be easily evaded by "packing" the malicious payload in layers of compression or encryption. State-of-the-art malware detectors have adopted both static and dynamic techinques to recover the payload of packed malware, but unfortunately such techniques are highly ineffective. In this paper we propose a new technique, called OmniUnpack, to monitor the execution of a program in real-time and to detect when the program has removed the various layers of packing. OmniUnpack aids malware detection by directly providing to the detector the unpacked malicious payload. Experimental results demonstrate the effectiveness of our approach. OmniUnpack is able to deal with both known and unknown packing algorithms and introduces a low overhead (at most 11% for packed benign programs).
IEEE/ACM International Conference on Computer Aided Design. ICCAD 2001. IEEE/ACM Digest of Technical Papers (Cat. No.01CH37281), 2001
Computing the set of states reachable in one step from a given set of states, i.e. image computat... more Computing the set of states reachable in one step from a given set of states, i.e. image computation, is a crucial step in several symbolic verification algorithms, including model checking and reachability analysis. So far, the best methods for quantification scheduling in image computation, with a conjunctively partitioned transition relation, have been restricted to a linear schedule. This results in a loss of flexibility during image computation. We view image computation as a problem of constructing an optimal parse tree for the image set. The optimality of a parse tree is defined by the largest BDD that is encountered during the computation of the tree. We present dynamic and static versions of a new algorithm, VarScore, which exploits the flexibility offered by the parse tree approach to the image computation. We show by extensive experimentation that our techniques outperform the best known techniques so far.
In the Internet, mobile code is ubiquitous and includes such examples as browser plug-ins, Java a... more In the Internet, mobile code is ubiquitous and includes such examples as browser plug-ins, Java applets, and document macros. In this paper, we address an important vulnerability in mobile code security that exists in remote execution systems such as Condor, Globus, and SETI@Home. These systems schedule user jobs for execution on remote idle machines. However, they send most of their
Proceedings of the 27th international conference on Software engineering - ICSE '05, 2005
We argue that finding vulnerabilities in software components is different from finding exploits a... more We argue that finding vulnerabilities in software components is different from finding exploits against them. Exploits that compromise security often use several low-level details of the component, such as layouts of stack frames. Existing software analysis tools, while effective at identifying vulnerabilities, fail to model low-level details, and are hence unsuitable for exploit-finding.
In a general discrete-time market model with proportional transaction costs, we derive new expect... more In a general discrete-time market model with proportional transaction costs, we derive new expectation representations of the range of arbitrage-free prices of an arbitrary American option. The upper bound of this range is called the upper hedging price, and is the smallest initial wealth needed to construct a self-financing portfolio whose value dominates the option payoff at all times. A
In the -period binomial tree model, we provide fast algorithms to compute very accurate lower and... more In the -period binomial tree model, we provide fast algorithms to compute very accurate lower and upper bounds on the value of a European-style Asian option. These algorithms are inspired by the continuous-time analysis of Rogers and Shi (12). Specifically we consider lower bounds that are given by grouping stock-price paths in the tree according to the value of a
Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform t... more Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform tasks by themselves due to insufficient resources. Solutions to such problems include passing tasks to others or agent migration to remote hosts. We propose agent cloning as a more comprehensive approach to the problem of local agent overloads. Agent cloning subsumes task transfer and agent mobility. According
Autonomous Agents & Multiagent Systems/International Conference on Autonomous Agents, 1998
Note: OCR errors may be found in this Reference List extracted from the full text article. ACM ha... more Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references. ... K. Decker, K. Sycara, and M. Williamson. Middle-agents for the internet. In Proceeding ...
... Valuing Moving Barrier Options by LCG Rogers and O. Zane A technique for calibrating deriva... more ... Valuing Moving Barrier Options by LCG Rogers and O. Zane A technique for calibrating derivative security pricing models: numerical solution of an inverse problem by R. Lagnado and S. Osher Valuation of mortgage backed securities using Brownian bridges to reduce ...
... For example in Jouini & Kallal [17] the “near-martingale” measures are those under which ... more ... For example in Jouini & Kallal [17] the “near-martingale” measures are those under which some process (appropriately discounted) that lies between ... The stock price process is denoted by S, which means Sk is the stock price random variable at time k, and S(u) is the stock price ...
With the explosive growth of the internet, autonomous agents will increasingly need strategies fo... more With the explosive growth of the internet, autonomous agents will increasingly need strategies for efficiently retrieving information. The time an agent (or server) takes to answer a query issued to it is often a random variable, whose distribution can be estimated by collecting statistics. When an agent A sends a query to another agent B and the query has not completed in some period of time, agent A faces the dilemma of whether to continue waiting or reissue the query (to agent B or to a different one). When some information is available about the probability distribution of the query completion time of the agents, it is possible to devise schemes for agents to reissue queries in such a way that the expected query completion time is reduced significantly. We design such schemes for various models of query-answering agents. Where meaningful, we take into account the cost of sending a query to an agent.
Autonomous Agents & Multiagent Systems/Agent Theories, Architectures, and Languages, 1998
Agents in a multi-agent system may face situations where tasks overload their computational capac... more Agents in a multi-agent system may face situations where tasks overload their computational capacities. Usually, this problem is solved by passing tasks to others or agent migration to remote hosts. We propose agent cloning as a more comprehensive approach to balancing local agent overloads. According to our paradigm, agents may clone, pass tasks to others, die or merge. We discuss
Proceedings International Conference on Multi Agent Systems (Cat. No.98EX160), 1998
Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform t... more Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform tasks by themselves due to insufficient resources. Solutions to such problems include passing tasks to others or agent migration to remote hosts. We propose agent cloning as a more comprehensive approach to the problem of local agent overloads. According to our paradigm, agents may clone, pass tasks to others, die or merge.
We address the semantic gap problem in behavioral monitoring by using hierarchical behavior graph... more We address the semantic gap problem in behavioral monitoring by using hierarchical behavior graphs to infer high-level behaviors from myriad low-level events. Our experimental system traces the execution of a process, performing data-flow analysis to identify meaningful actions such as "proxying", "keystroke logging", "data leaking", and "downloading and executing a program" from complex combinations of rudimentary system calls. To preemptively address evasive malware behavior, our specifications are carefully crafted to detect alternative sequences of events that achieve the same high-level goal. We tested eleven benign programs, variants from seven malicious bot families, four trojans, and three mass-mailing worms and found that we were able to thoroughly identify high-level behaviors across this diverse code base. Moreover, we effectively distinguished malicious execution of high-level behaviors from benign by identifying remotely-initiated actions.
Malicious software (or malware) has become a growing threat as malware writers have learned that ... more Malicious software (or malware) has become a growing threat as malware writers have learned that signaturebased detectors can be easily evaded by "packing" the malicious payload in layers of compression or encryption. State-of-the-art malware detectors have adopted both static and dynamic techinques to recover the payload of packed malware, but unfortunately such techniques are highly ineffective. In this paper we propose a new technique, called OmniUnpack, to monitor the execution of a program in real-time and to detect when the program has removed the various layers of packing. OmniUnpack aids malware detection by directly providing to the detector the unpacked malicious payload. Experimental results demonstrate the effectiveness of our approach. OmniUnpack is able to deal with both known and unknown packing algorithms and introduces a low overhead (at most 11% for packed benign programs).
IEEE/ACM International Conference on Computer Aided Design. ICCAD 2001. IEEE/ACM Digest of Technical Papers (Cat. No.01CH37281), 2001
Computing the set of states reachable in one step from a given set of states, i.e. image computat... more Computing the set of states reachable in one step from a given set of states, i.e. image computation, is a crucial step in several symbolic verification algorithms, including model checking and reachability analysis. So far, the best methods for quantification scheduling in image computation, with a conjunctively partitioned transition relation, have been restricted to a linear schedule. This results in a loss of flexibility during image computation. We view image computation as a problem of constructing an optimal parse tree for the image set. The optimality of a parse tree is defined by the largest BDD that is encountered during the computation of the tree. We present dynamic and static versions of a new algorithm, VarScore, which exploits the flexibility offered by the parse tree approach to the image computation. We show by extensive experimentation that our techniques outperform the best known techniques so far.
In the Internet, mobile code is ubiquitous and includes such examples as browser plug-ins, Java a... more In the Internet, mobile code is ubiquitous and includes such examples as browser plug-ins, Java applets, and document macros. In this paper, we address an important vulnerability in mobile code security that exists in remote execution systems such as Condor, Globus, and SETI@Home. These systems schedule user jobs for execution on remote idle machines. However, they send most of their
Proceedings of the 27th international conference on Software engineering - ICSE '05, 2005
We argue that finding vulnerabilities in software components is different from finding exploits a... more We argue that finding vulnerabilities in software components is different from finding exploits against them. Exploits that compromise security often use several low-level details of the component, such as layouts of stack frames. Existing software analysis tools, while effective at identifying vulnerabilities, fail to model low-level details, and are hence unsuitable for exploit-finding.
In a general discrete-time market model with proportional transaction costs, we derive new expect... more In a general discrete-time market model with proportional transaction costs, we derive new expectation representations of the range of arbitrage-free prices of an arbitrary American option. The upper bound of this range is called the upper hedging price, and is the smallest initial wealth needed to construct a self-financing portfolio whose value dominates the option payoff at all times. A
In the -period binomial tree model, we provide fast algorithms to compute very accurate lower and... more In the -period binomial tree model, we provide fast algorithms to compute very accurate lower and upper bounds on the value of a European-style Asian option. These algorithms are inspired by the continuous-time analysis of Rogers and Shi (12). Specifically we consider lower bounds that are given by grouping stock-price paths in the tree according to the value of a
Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform t... more Multi-agent systems are subject to performance bottlenecks in cases where agents cannot perform tasks by themselves due to insufficient resources. Solutions to such problems include passing tasks to others or agent migration to remote hosts. We propose agent cloning as a more comprehensive approach to the problem of local agent overloads. Agent cloning subsumes task transfer and agent mobility. According
Autonomous Agents & Multiagent Systems/International Conference on Autonomous Agents, 1998
Note: OCR errors may be found in this Reference List extracted from the full text article. ACM ha... more Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references. ... K. Decker, K. Sycara, and M. Williamson. Middle-agents for the internet. In Proceeding ...
... Valuing Moving Barrier Options by LCG Rogers and O. Zane A technique for calibrating deriva... more ... Valuing Moving Barrier Options by LCG Rogers and O. Zane A technique for calibrating derivative security pricing models: numerical solution of an inverse problem by R. Lagnado and S. Osher Valuation of mortgage backed securities using Brownian bridges to reduce ...
... For example in Jouini & Kallal [17] the “near-martingale” measures are those under which ... more ... For example in Jouini & Kallal [17] the “near-martingale” measures are those under which some process (appropriately discounted) that lies between ... The stock price process is denoted by S, which means Sk is the stock price random variable at time k, and S(u) is the stock price ...
With the explosive growth of the internet, autonomous agents will increasingly need strategies fo... more With the explosive growth of the internet, autonomous agents will increasingly need strategies for efficiently retrieving information. The time an agent (or server) takes to answer a query issued to it is often a random variable, whose distribution can be estimated by collecting statistics. When an agent A sends a query to another agent B and the query has not completed in some period of time, agent A faces the dilemma of whether to continue waiting or reissue the query (to agent B or to a different one). When some information is available about the probability distribution of the query completion time of the agents, it is possible to devise schemes for agents to reissue queries in such a way that the expected query completion time is reduced significantly. We design such schemes for various models of query-answering agents. Where meaningful, we take into account the cost of sending a query to an agent.
Autonomous Agents & Multiagent Systems/Agent Theories, Architectures, and Languages, 1998
Agents in a multi-agent system may face situations where tasks overload their computational capac... more Agents in a multi-agent system may face situations where tasks overload their computational capacities. Usually, this problem is solved by passing tasks to others or agent migration to remote hosts. We propose agent cloning as a more comprehensive approach to balancing local agent overloads. According to our paradigm, agents may clone, pass tasks to others, die or merge. We discuss
Uploads
Papers by Somesh Jha