Sessions - Integrated Design and Process Technology

Tutorials
Please see detailed schedule for time and place information. Also see www.sdpsnet.org
Bhavani M. Thuraisingham
SDPS Fellow
Data Mining for Malware
Detection
Data mining is the process of posing various queries
and extracting useful and often previously unknown and
unexpected information, patterns, and trends from large
quantities of data, generally stored in databases. Data
mining has evolved from multiple technologies including
data management, data warehousing, machine learning and
statistical reasoning. Much progress has also been made on
building data mining tools based on a variety of techniques
for numerous applications. These applications include those
for marketing and sales, healthcare, medical, financial,
e-commerce, multimedia and more recently for security.
In this tutorial, we describe the data mining the tools we have
developed for malware detection. Malware, also known as
malicious software, is developed by hackers to steal data
and identity, cause harm to computers and deny legitimate
services to users, among others. Malware has plagued the
society and the software industry for almost four decades.
Malware includes virus, worms, Trojan horses, time and logic
bombs, botnets and spyware. In this tutorial, we describe our
data mining tools for email worm detection, remote exploit
detection, botnet detection, and for detecting malicious
executables. In addition we will discuss stream mining for
malware detection as well as our approaches for insider
threat detection, adaptable malware detection, real-time
data mining for suspicious event detection and firewall policy
management.
An email worm spreads through infected email messages.
The worm may be carried by an attachment, or the email may
contain links to an infected website. When the user opens
the attachment, or clicks the link, the host gets infected
immediately. We have developed tools on applying data
mining techniques for intrusion email worm detection. We
use both Support Vector Machine (SVM) and Naïve Bayes
(NB) data mining techniques.
Malicious code is a great threat to computers and computer
society. Numerous kinds of malicious codes wander in the
wild. Some of them are mobile, such as worms, and spread
through the internet causing damage to millions of computers
worldwide. Other kinds of malicious codes are static, such as
viruses, but sometimes deadlier than its mobile counterpart.
One popular technique followed by the anti-virus community to
detect malicious code is “signature detection”. This technique
matches the executables against a unique telltale string or
byte pattern called signature, which is used as an identifier
for a particular malicious code. A zero-day attack is an attack
whose pattern is previously unknown. We are developing a
number of data mining tools for malicious code detection that
do not depend on the signature of the malware. Our hybrid
feature retrieval model will be described in the tutorial.
“
Dr. Radmilla Juric
OWL/SWRL enabled
ontologies and reasoning and
its applicability in software
engineering
The Web Ontology Language (OWL) has become a W3C
recommendation in 2004, followed by the Semantic Web
Rule Language (SWRL). We can build OWL ontologies
by common ontology editors and perform reasoning upon
them, using SWRL, which has been supported by various
reasoners. Traditionally, we can represent knowledge in
OWL because, as in classical AI, both ontology and rule
languages are similar and powerful first order logic formalisms
in knowledge representation. In this tutorial we would like to
discuss possibilities of exploiting the power of OWL/SWRL
enabled ontologies in Software Engineering, for the purpose
of creating computational environments which address the
needs of modern software applications: from mobility and
pervasiveness of computational spaces to their applicability
across domains: education, healthcare, military, commerce,
governance etc. We would specifically look at:
• The power of OWL/SWRL enabled ontologies in the
creation of software solutions which address a range of
problems: interoperability in software systems, decision
making and its algorithms, recommender systems and
their techniques, information overload, retrievals and
search engines.
• The role of OWL/SWRL inference mechanisms in software
applications outside the AI conception of ‘intelligence’.
We would create OWL/SWRL inferences on an ad-hoc
basis and according to the application requirements and
the application context and situation awareness.
• The possibility of assessing new ways of creating
‘intelligence’ by joining OWL/SWRL with methods of
mining, filtering, ranking, tagging, semantic annotations
and similar.
• The consensus and practices of creating efficient OWL
models which should secure reasoning upon its concepts,
Now, in discussing the relation of science to the
scientific culture of society, the first thing that
comes to mind immediately is, of course, the most
obvious thing, which is the application of science.
The applications are culture too.
Richard P. Feynman, Nobel Laureate
From The Pleasure of Finding Things Out, P. 98, Puplished by
Carl Feynman and Michelle Feynman, 1999.
SDPS 2012
22