One common vector of malware is JavaScript in Adobe Acrobat (PDF) files. In this thesis, we investigate using near-miss clone detectors to find this malware. We start by collecting a set of PDF files containing JavaScript malware and a set with clean JavaScript from the VirusTotal repository. We use the NiCad clone detector to find the classes of clones in a small subset of the malicious PDF files. We evaluate how clone classes can be used to find similar malicious files in the rest of the malicious collection while avoiding files in the benign collection. Our results show that a 10% subset training set produced 75% detection of previously known malware with 0% false positives. We also used the NiCad as a pattern matcher for reflexive calls common in JavaScript malware. Our results show a 57% detection of malicious collection with no false positives. When the two experiments’ results are combined, the total coverage of malware rises to 85% and maintains 100% precision. The results are heavily affected by the third-party PDF to JavaScript extractor used. When only successfully extracted PDFs are considered, recall increases to 99% and precision remains at 100%. / Thesis (Master, Electrical & Computer Engineering) -- Queen's University, 2013-09-30 11:50:15.156

An infectious cDNA clone of Vero cell adapted Beaudette strain of IBV was constructed using in vitro assembly of cDNA fragments. The entire genome of IBV was RT-PCR amplified into seven fragments, with each piece overlapping about 10 nucleotides. The fragments were ligated and transcribed to synthesize RNA, which was transfected into BHK-21 cells. These cells were then overlaid onto IBV susceptible Vero cells. After five days transfection, the virus was successfully rescued from the transfected cells. The cDNA clone from our laboratory strain has a five nucleotide insertion not present in the originally sequenced virus, resulting in total genome size of 27,613 nucleotides. The infectious cDNA clone was further manipulated to demonstrate its potential as a gene transfer vector, by replacing the ORF5a open reading frame with enhanced green fluorescent protein. The recombinant infectious cDNA clone was also successfully rescued after three days transfection of BHK-21 cells followed by co-culturing with Vero cells. This study showed that the 5a protein, whose function is not known, is not necessary for in vitro IBV replication. This study also showed that the 5a ORF is a good candidate for an insertion site of recombinant genes for the development of IBV infectious cDNA clone as a gene transfer vector.

An infectious cDNA clone of Vero cell adapted Beaudette strain of IBV was constructed using in vitro assembly of cDNA fragments. The entire genome of IBV was RT-PCR amplified into seven fragments, with each piece overlapping about 10 nucleotides. The fragments were ligated and transcribed to synthesize RNA, which was transfected into BHK-21 cells. These cells were then overlaid onto IBV susceptible Vero cells. After five days transfection, the virus was successfully rescued from the transfected cells. The cDNA clone from our laboratory strain has a five nucleotide insertion not present in the originally sequenced virus, resulting in total genome size of 27,613 nucleotides. The infectious cDNA clone was further manipulated to demonstrate its potential as a gene transfer vector, by replacing the ORF5a open reading frame with enhanced green fluorescent protein. The recombinant infectious cDNA clone was also successfully rescued after three days transfection of BHK-21 cells followed by co-culturing with Vero cells. This study showed that the 5a protein, whose function is not known, is not necessary for in vitro IBV replication. This study also showed that the 5a ORF is a good candidate for an insertion site of recombinant genes for the development of IBV infectious cDNA clone as a gene transfer vector.

In this thesis, we present an approach for identifying near-miss interaction clones in reverse-engineered UML behavioural models. Our goal is to identify patterns of interaction ("conversations") that can be used to characterize and abstract the run-time behaviour of web applications and other interactive systems. In order to leverage robust near-miss code clone technology, our approach is text-based, working on the level of XMI, the standard interchange serialization for UML. Behavioural model clone detection presents several challenges - first, it is not clear how to break a continuous stream of interaction between lifelines (lifelines represent the objects or actors in the system) into meaningful conversational units. Second, unlike programming languages, the XMI text representation for UML is highly non-local, using attributes to reference information in the model file remotely. In this work we use a set of contextualizing source transformations on the XMI text representation to reveal the hidden hierarchical structure of the model and granularize behavioural interactions into conversational units. Then we adapt NiCad, a near-miss code clone detection tool, to help us identify conversational clones in reverse-engineered behavioural models. These conversational clones are then analysed to find worrisome patterns of security access violations. / Thesis (Master, Computing) -- Queen's University, 2014-03-03 19:36:25.776

The web of the future will require automated tagging of equivalent or similar services in support of service discovery and the selection of appropriate alternatives in case of failure. Code similarity detection tools, or clone detectors, provide a mature and scalable method of identifying these kinds of similarities and can be used to assist in this problem. However, they require a set of units to be compared; something to which the most popular description language, WSDL (Web Service Description Language), does not lend itself. First, each WSDL description can contain more than one operation description, which does not provide the granularity we need to compare services on the operation level. Secondly, these operation descriptions are mixed together throughout the file, often sharing some common elements. This thesis describes a technique for extracting the elements of each operation description and consolidating them into a self-contained unit using TXL, a source transformation language. These units, referred to as Web Service Cells or WSCells (pronounced “wizzles”), can then be used by similarity detectors to search for similarities. We describe a modified architecture to the NICAD clone detector to support the creation of WSCells, and the implementation of a special WSDL extractor we used to emulate this modification in its absence. / Thesis (Master, Computing) -- Queen's University, 2011-10-04 09:33:36.932

Two identical or similar code fragments form a clone pair. Previous studies have identified cloning as a risky practice. Therefore, a developer needs to be aware of any clone pairs so as to properly propagate any changes between clones. A clone pair experiences many changes during the creation and maintenance of software systems. A change can either maintain or remove the similarity between clones in a clone pair. If a change maintains the similarity between clones, the clone pair is left in a consistent state. However, if a change makes the clones no longer similar, the clone pair is left in an inconsistent state. The set of states and changes experienced by clone pairs over time form an evolution history known as a clone genealogy. In this thesis, we provide a formal definition of clone genealogies, and perform two case studies to examine clone genealogies. In the first study, we examine clone genealogies to identify fault-prone “patterns” of states and changes. We also build prediction models using clone metrics from one snapshot and compare them to models that include historical evolutionary information about code clones. We examine three long-lived software systems and identify clones using Simian and CCFinder clone detection tools. The results show that there is a relationship between the size of the clone and the time interval between changes and fault-proneness of a clone pair. Additionally, we show that adding evolutionary information increases the precision, recall, and F-Measure of fault prediction models by up to 26%. In our second study, we define 8 types of late propagation and compare them to other forms of clone evolution. Our results not only verify that late propagation is more harmful to software systems, but also establish that some specific cases of late propagations are more harmful than others. Specifically, two cases are most risky: (1) when a clone experiences inconsistent changes and then a re-synchronizing change without any modification to the other clone in a clone pair; and (2) when two clones undergo an inconsistent modification followed by a re-synchronizing change that modifies both the clones in a clone pair. / Thesis (Master, Electrical & Computer Engineering) -- Queen's University, 2012-01-31 11:39:10.503

Clonal cell lines were isolated from mammary gland tissue epithelial cell cultures of lactating cows. Early passage clonal bovine mammary epithelial cells (clone LMH17) gave rise to several established cell lines (MAC-T lines) after being cotransfected with plasmids containing the temperature sensitive mutant SV40 large T antigen gene (pBAPSV40TtsA58) and the bacterial phosphotransferase gene (pSV2-neo). Unlike other cell types which were transformed after being transfected with SV40, MAC-T cells maintained many characteristics of non-transformed cells: MAC-T cells were serum and anchorage dependent, showed contact inhibition, and were not tumorigenic in immunodeficient mice. However, Southern transfer analysis revealed an integrated SV40 gene and cells showed no senescence after 50 passages. These cells are morphologically indistinguishable from parental LMH17 cells and retain the typical morphology of mammary epithelial cells. Positive cytokeratin immunostaining and the absence of vimentin staining indicated that these cells were epithelial in origin. / MAC-T cells grew rapidly on plastic substratum with a doubling time of approximately 17 hours and became differentiated when grown on floating collagen gels in the presence of prolactin. The differentiated phenotype was characterized to include (1) the ability to form secretory domes with a lumen from a pavement of columnar cells; (2) increased casein mRNA abundance; (3) increased alpha S and beta casein secretion; (4) increased number and size of casein secretory vesicles; and (5) increased lactose synthesis and secretion.

The Semantic Web is an endeavour to enhance the web with the ability to represent knowledge. The knowledge is expressed through what are called ontologies. In order to make ontologies useful, it is important to be able to match the knowledge represented in different ontologies. This task is commonly known as ontology alignment. Ontology alignment has been studied, but it remains an open problem with an annual competition dedicated to measure alignment tools' performance. Many alignment tools are computationally heavy, require training, or are useful in a specific field of study. We propose an ontology alignment method, NeCO, that builds on clone detection techniques to align ontologies. NeCO inherits the clone detection features, and it is light-weight, does not require training, and is useful for any ontology. / Thesis (Master, Computing) -- Queen's University, 2014-01-29 14:38:52.873

A restricted version of the Galois connection between polymorphisms and invariants, called Pol−CInv, is studied, where the invariant relations are restricted to so-called clausal relations. In this context, the relationship of maximal C-clones and maximal clones is investigated. It is shown that, with the exception of one special case occurring for Boolean domains, maximal C-clones are never maximal clones. / Wir untersuchen eine eingeschränkte Variante der Galoisverbindung zwischen Polymorphismen und invarianten Relationen, bezeichnet mit Pol−CInv, wobei die invarianten Relationen auf sogenannte klausale Relationen beschränkt werden. In diesem Zusammenhang wird die Beziehung zwischen maximalen C-Klonen und maximalen Klonen betrachtet. Es wird gezeigt, daß, mit Ausnahme eines Spezialfalles für Boolesche Grundmengen, maximale C-Klone niemals maximale Klone sind.

Thesis (Ph. D.)--University of Oulu. / Includes bibliographical references.