Browsing by Author "Wang, Chi-Wei"

Now showing 1 - 12 of 12

Can Malware Be Exterminated by Better Understanding Its Roots?
(2014-11-01)
Cho, Michael Cheng Yi
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng
;
Wang, Chi-Wei
;
資訊工程學系
CLINICAL GENOMICS IDENTIFIES THE EXPRESSION OF HUMAN OVARIAN CARCINOMA
(2009-09-01)
Tsai, Meng-Hsiun
;
Huang, Steve G.
;
Tsaur, Shyh-Chang
;
Hung, Yao-Ching
;
Chiu, Sheng-Hsiung
Background: Human ovarian carcinoma is a silent killer. Most patients with human ovarian carcinoma are diagnosed in the advanced stages. Currently, no effective means of early detection are available. identifying genes that distinguish early cancers from normal tissue may provide insight to the initiation and progression of ovarian cancer. Methods: A large-scale gene expression profiling using 9,600 genes-complementary DNA array to study ovarian tumors was conducted. We analyzed 13 benign tumors, 22 invasive cancers (seven stage I and 15 stage III), and 16 normal ovaries. Cluster analysis revealed two major groups: the early-stage cluster that included 13 benign tumors and seven stage I cancers; and the late-stage cluster that included all stage III cancers. Results: There were 433 upregulated and 60 downregulated genes from the early-stage cluster, and 395 upregulated and 101 downregulated genes from the late-stage cluster. These genes showed altered functions for tumor/cancers, functions such as cell growth, cell cycle control, differentiation, signaling, apoptosis, ion transport, and morphogenesis. of most interest is the downregulation of nuclear receptor proteins. Differentially expressed genes between early-stage cluster and late-stage clusters were identified. We found 90 genes preferentially overly expressed and 165 genes relatively downregulated at late-stage cancers. The advanced cancer appears differently from early-stage cancer in cell growth, cell adhesion, hormone activity, morphology, and cell-cell signaling compared with benign or early-stage cancer. of particular interest are enzymes corresponding to pteridine biosynthesis, reported for the first time in this study. Real-time reverse transcription polymerase chain reaction showed that GCH1, KRT18, H3F3A, and MYBL2 were overly expressed in all cancer tissues, while MDFI, ARP3BETA, COL16A1, and MLN discriminated late-stage from early-stage cancers. Conclusion: The microarray provides valuable resources for comparing expression profiles of cancers at various stages and helps research the diagnosis and mechanism of ovarian cancer. [International journal of Gerontology 2009; 3(3): 163-169]
Cloudebug: A Programmable Online Malware Testbed
(2014-07-01)
Wang, Chi-Wei
;
Wang, Chia-Wei
;
Hsieh, Chu-An
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
Virtual machines for malware analysis in current cloud-based debugging services are not easily accessible or operable by end users. Cloudebug allows users to operate its VM directly in the cloud.
Combating Software Piracy in Public Clouds
(2015-10-01)
Wang, Chia-Wei
;
Cho, Michael Cheng Yi
;
Wang, Chi-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
CodeMist is an innovative security framework that leverages both passive and active approaches to prevent piracy of cloud-based rental software.
Divergence Detector: A Fine-grained Approach to Detecting VM-Awareness Malware
(2013)
Hsu, Chia-Wei
;
Shih, Fan-Syun
;
Wang, Chi-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
Virtualized execution has become an effective mechanism to analyze malware in a dynamic way. To conceal its malicious behaviors, VM-aware malware probes the execution environment for analysis-resistance. These malware programs hide their malicious behaviors if they are launched in a virtual machine (VM). VM awareness becomes a barrier for malware analysis due to the concealment of malicious behaviors. In this paper, we discover that uncertain factors have significant influence on the effectiveness of malware detection. To cope with the problems, a new VM-aware detection scheme, namely Divergence Detector, is proposed to address the swindle of the evolved malware. Unlike conventional schemes, the Divergence Detector reduces the uncertain factors at instruction level, and can detect the divergence of multi-execution traces across heterogeneous virtual machines. The proposed Divergence Detector is implemented across the three commonly used VM platforms, that is, QEMU, Bochs and Xen. It compares the code coverage of the execution traces on various VM platforms to discover the deviation of behavior, thereby precisely detecting the VM-awareness. We will formally predict the effectiveness of Divergence Detector by constructing a mathematic model, which shows the maximum false positive rate is exponentially decreased with respect to the number of multi-executions. Representative samples utilizing seven types of commonly used VM-aware techniques were also employed for evaluation. The evaluation results indicate that the maximum false positive rate complies with our prediction. The uncertain factors play the major role in the VM-awareness detection. To reduce uncertain factors causing false positives, a method is proposed for VM-aware detection. The Divergence Detector can also enable the identification of new types of malware since the benign programs do not need to be aware of execution environment.
DROIT plus : Taint Tracking for Storage Access on Android
(2017-09-01)
Hsu, Chia-Wei
;
Chang, Chia-Huei
;
Wang, Chi-Wei
;
Shieh, Shiuhpyng
;
資訊工程學系
The leakage of sensitive data has been a major concern in Android ecosystem. Analysts therefore propose dynamical taint tracking to effectively track the data flow of accessed data. However, the off-the-shelf taint tracking systems lack byte-granularity support for storage tracking. In this paper, we propose DROIT+ which uses the fine-grained storage tracking technique to track data flow among Android storages. DROIT+ is able to reveal the composition of data flows. Storage tracking on Android is difficult since data flows of apps may span heterogeneous media including memory, SD cards, NAND Flash, and network adapters. To capture a whole picture of data flows in storage, we formally define data flow and propose our method from both logical and physical perspectives. The method has also been implemented as an extension to the proposed tracking system, DROIT. Two case studies and two benchmark tools are used for the evaluation in terms of storage tracking ability, network tracking ability, and efficiency, respectively. The result shows that DROIT+ provides a better coverage using byte-granularity taint tracking.
DT-Track: Using DNS-Timing Side Channel for Mobile User Tracking
(2019-01-01)
Lin, Chun-Han
;
Lee, Shan-Hsin
;
Huang, Hsiu-Chuan
;
Wang, Chi-Wei
;
Hsu, Chia-Wei
Targeted advertising is a form of online advertising that is directed towards audiences with certain traits. User tracking is useful to provide tailored web content or online advertisement. However, in the case without user online identities, targeted advertising becomes difficult. The challenge gets even higher in a mobile environment as the mobile user roams from one location to another location. In this paper, we propose a third-party web tracking scheme, named DT-Track, which can stealthily track users via the proposed side channel on DNS. The side channel is built on top of the cache existence of DNS records, which are commonly used.
Enhancing device efficiencies of solid-state white light-emitting electrochemical cells by employing waveguide coupling
(2015-01-01)
Cheng, Chia-Yu
;
Wang, Chi-Wei
;
Cheng, Jing-Rong
;
Chen, Hsiao-Fan
;
Yeh, Yun-Shiuan
Solid-state white light-emitting electrochemical cells (LECs) have received intense scientific attention owing to their potential applications in display and lighting. Although device efficiencies of white LECs have been significantly improved in recent years, further improvements are still required for their practical applications. In this work, we demonstrate the enhancement of device efficiencies of white LECs by employing waveguide coupling. Two transparent photoresist (TPR) layers doped with TiO2 nanoparticles (NPs) are inserted between the indium tin oxide (ITO) layer and the glass substrate. By tuning the doping concentration of 25 nm TiO2 NPs in the upper TPR layer to adjust the refractive index, effective waveguide coupling between the ITO layer and the lower TPR layer can be achieved. Since the lower TPR layer contains 250 nm TiO2 NPs, electroluminescence (EL) outcoupled from the ITO layer can be scattered and redirected into the forward direction. Furthermore, the EL trapped in the glass substrate can also transmit into the lower TPR layer and then is scattered to the forward direction. When the EL trapped in the ITO layer and the glass substrate can be effectively recycled into the forward direction, the peak external quantum efficiency and power efficiency obtained in white LECs employing waveguide coupling are up to 19.4% and 34.1 lm W-1, respectively. These efficiencies are among the highest reported for white LECs and thus confirm that waveguide coupling would be useful for realizing highly efficient white LECs. In addition to the enhanced device efficiencies, improved color migration of EL spectra, which is desired for lighting applications, can be obtained in white LECs with scattering waveguide layers since EL of different angles can be mixed in the forward direction.
Light-Weight CSRF Protection by Labeling User-Created Contents
(2013)
Sung, Yin-Chang
;
Cho, Michael Cheng Yi
;
Wang, Chi-Wei
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng Winston
Cross-site request forgery (CSRF/XSRF) is a serious vulnerability in Web 2.0 environment. With CSRF, an adversary can spoof the payload of an HTTP request and entice the victim's browser to transmit an HTTP request to the web server. Consequently, the server cannot determine legitimacy of the HTTP request. This paper presents a light-weight CSRF prevention method by introducing a quarantine system to inspect suspicious scripts on the server-side. Instead of using script filtering and rewriting approach, this scheme is based on a new labeling mechanism (we called it Content Box) which enables the web server to distinguish the malicious requests from the harmless requests without the need to modify the user created contents (UCCs). Consequently, a malicious request can be blocked when it attempts to access critical web services that was defined by the web administrator. To demonstrate the effectiveness of the proposed scheme, the proposed scheme was implemented and the performance was evaluated.
MrKIP: Rootkit Recognition With Kernel Function Invocation Pattern
(2015-03-01)
Wang, Chi-Wei
;
Chen, Chong-Kuan
;
Wang, Chia-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
Existing mechanisms tracing user-level activities such as system calls and APIs can be circumvented by the kernel-level rootkits. In this paper, a novel system, MrKIP, is proposed to recognize rootkits based on their kernel-level activities. Our scheme semiautomatically generates suitable locations for analysts to implement checkpoints, which are used to profile kernel-space activities. Then, collected rootkits are executed in an emulator with these checkpoints for behavior profiling. The collected behaviors are clustered and used for model construction. The constructed model can be used to recognize new variants of rootkit families. Our scheme differs from conventional tracers due to its ability to cover kernel-space malware and the whole-system scope. In addition, monitoring at the kernel level raises high barrier for malware to evade, since all tasks are eventually executed through the basic kernel functions.
ProbeBuilder: Uncovering Opaque Kernel Data Structures for Automatic Probe Construction
(2016-09-10)
Wang, Chi-Wei
;
Wang, Chia-Wei
;
Shieh, Shiuhpyng
;
資訊工程學系
;
Department of Computer Science
VM-based inspection tools generally implement probes in the hypervisor to monitor events and the state of kernel of the guest system. The most important function of a probe is to carve information of interest out of the memory of the guest when it is triggered. Implementing probes for a closed-source OS demands manually reverse-engineering the undocumented code/data structures in the kernel binary image. Furthermore, the reverse-engineering result is often non-reusable between OS versions or even kernel updates due to the rapid change of these structures. In this paper, we propose ProbeBuilder, a system automating the process to inference kernel data structures. Based on dynamic execution, ProbeBuilder searches for data structures matching the "pointer-offset-pointer" pattern in guest memory. The sequences of these offsets, which are referred to as dereferences, are then verified by ProbeBuilder with instruction evidence that traverse them. The experiment on Windows kernel shows that ProbeBuilder efficiently narrows thousands of choices for kernel-level probes down to dozens. The finding allows analysts to quickly implement probes, facilitating rapid development/update of inspection tools for different OSes. With these features, ProbeBuilder is the first system capable of automatically generating practical probes that extracts information through dereferences to opaque kernel data structures.
Solid-state white light-emitting electrochemical cells based on scattering red color conversion layers
(2015-01-01)
Lin, Guan-Rung
;
Cheng, Jing-Rong
;
Wang, Chi-Wei
;
Sarma, Monima
;
Chen, Hsiao-Fan
Solid-state white light-emitting electrochemical cells (LECs) based on ionic transition metal complexes are capable of generating efficient white electroluminescence (EL). Recently, blue-emitting LECs combined with embedded red color conversion layers (CCLs), which were inserted between indium tin oxide (ITO) and a glass substrate, have been reported to offer an external quantum efficiency (EQE) >12%. However, the output spectrum of EL from such white LECs changed with time due to the altered microcavity effect when the recombination zone was moving. Furthermore, the device efficiency should be further improved to realize practical applications. In this work, TiO2 nanoparticles (NPs) of two sizes are incorporated into red CCLs to improve device performance. Large NPs (250 nm) can scatter and redirect the light passing through red CCLs and further enhance the extracted light. Small NPs (25 nm) increase the refractive index of red CCLs and raise the amount of light intensity in the evanescent tail of the waveguide mode near the ITO layer. Therefore, more trapped light in the evanescent tail of the waveguide mode can be recycled to the external mode by scattering. The peak EQE and power efficiency of white LECs employing scattering red CCLs reach 20.0% and 39.5 lm W-1, respectively. Furthermore, with scattering NPs to average the EL in different directions, white EL is almost invariant with time. These results show that blue-emitting LECs combined with scattering red CCLs would be effective to provide efficient and stable white EL.