Malicious software authors have shifted their focus from illegal and clearly malicious software to potentially unwanted programs (PUPs) to earn revenue. PUPs blur the border between legitimate and illegitimate programs and thus fall into a grey zone. Existing anti-virus and anti-spyware software are in many instances unable to detect previously unseen or zero-day attacks and separate PUPs from legitimate software. Many tools also require frequent updates to be effective. By predicting the class of particular piece of software, users can get support before taking the decision to install the software. This Licentiate thesis introduces approaches to distinguish PUP from legitimate software based on the supervised learning of file features represented as n-grams. The overall research method applied in this thesis is experiments. For these experiments, malicious software applications were obtained from anti-malware industrial partners. The legitimate software applications were collected from various online repositories. The general steps of supervised learning, from data preparation (n-gram generation) to evaluation were, followed. Different data representations, such as byte codes and operation codes, with different configurations, such as fixed-size, variable-length, and overlap, were investigated to generate different n-gram sizes. The experimental variables were controlled to measure the correlation between n-gram size, the number of features required for optimal training, and classifier performance. The thesis results suggest that, despite the subtle difference between legitimate software and PUP, this type of software can be classified accurately with a low false positive and false negative rate. The thesis results further suggest an optimal size of operation code-based n-grams for data representation. Finally, the results indicate that classification accuracy can be increased by using a customized ensemble learner that makes use of multiple representations of the data set. The investigated approaches can be implemented as a software tool with a less frequently required update in comparison to existing commercial tools.

This thesis introduces a financial simulation model covering two related financial domains: Mobile Payments and Retail Stores systems. The problem we address in these domains is different types of fraud. We limit ourselves to isolated cases of relatively straightforward fraud. However, in this thesis the ultimate aim is to cover more complex types of fraud, such as money laundering, that comprises multiple organisations and domains. Fraud is an important problem that impact the whole economy. Currently, there is a general lack of public research into the detection of fraud. One important reason is the lack of transaction data which is often sensitive. To address this problem we present a Mobile Money Simulator (PaySim) and Retail Store Simulator (RetSim), which allow us to generate synthetic transactional data. These simulations are based on real transaction data. These simulations are multi agent based simulations. Hence, we developed agents that represent the clients in PaySim and customers and salesmen in RetSim. The normal behaviour was based on behaviour observed in data from the field, and is codified in the agents as rules of transactions and interaction between clients, or customers and salesmen. Some of these agents were intentionally designed to act fraudulently, based on observed patterns of real fraud. We introduced known signatures of fraud in our model and simulations to test and evaluate our fraud detection results. The resulting behaviour of the agents generate a synthetic log of all transactions as a result of the simulation. This synthetic data can be used to further advance fraud detection research, without leaking sensitive information about the underlying data. Using statistics and social network analysis (SNA) on real data we could calibrate the relations between staff and customers and generate realistic synthetic data sets that were validated statistically against the original. We then used RetSim to model two common retail fraud scenarios to ascertain exactly how effective the simplest form of statistical threshold detection commonly in use could be. The preliminary results show that threshold detection is effective enough at keeping fraud losses at a set level, that there seems to be little economic room for improved fraud detection techniques.

Nowadays ships are usually equipped with a system of marine instruments, one of which is an Automatic Identification System (AIS) transponder. The availability of the global AIS ship tracking data opened the possibilities to develop maritime security far beyond the simple collision prevention. The research work summarized in this thesis explores this opportunity, with the aim of developing an intuitive and comprehensible method for traffic modeling and anomaly detection in the maritime domain. The novelty of the method lays in employing the technique of artificial potential fields. The general idea is for the potentials to represent typical patterns of vessels' behaviors. A conflict between potentials, which have been observed in the past, and the potential of a vessel currently in motion, indicates an anomaly. The developed potential field based method has been examined using a web-based anomaly detection system STRAND (for Seafaring TRansport ANomaly Detection). Its applicability has been demonstrated in several publications, examining its scalability, modeling capabilities and detection performance. The experimental investigations led to identifying optimal detection resolution for different traffic areas (open sea, harbor and river), and extracting traffic rules, e.g., with regard to speed limits and course, i.e., right-hand sailing rule. The map-based display of modeled traffic patterns and detection cases has been analyzed as well, using several demonstrative cases. The massive AIS database created for this study, together with a dataset of real traffic incidents, provides an abundance of challenges for future studies.

As the world is getting more and more competitive, efficiency has become a bigger concern than ever for many businesses. Certain efficiency concerns can naturally be expressed as optimization problems, which is a well studied field in the academia. However, optimization algorithms are not as widely employed in industrial practice as they could. There are various reasons for the lack of widespread adoption. For example, it can be difficult or even impossible for non-experts to formulate a detailed mathematical model of the problem. On the other hand, a scientist usually does not have a deep enough understanding of critical business details, and may fail to capture enough details of the real- world phenomenon of concern. While a model at an arbitrary abstraction level is often good enough to demonstrate the optimization approach, ignoring relevant aspects can easily render the solution impractical for the industry. This is an important problem, because applicability concerns hinder the possible gains that can be achieved by using the academic knowledge in industrial practice. In this thesis, we study the challenges of industrial optimization problems in the form of four case studies at four different companies, in the domains of maintenance schedule optimization and search-based software testing. Working with multiple case studies in different domains allows us to better understand the possible gains and practical challenges in applying optimization methods in an industrial setting. Often there is a need to trade precision for applicability, which is typically very context dependent. Therefore, we compare our results against base values, e.g., results from simpler algorithms or the state of the practice in the given context, where applicable. Even though we cannot claim that optimization methods are applicable in all situations, our work serves as an empirical evidence for the usability of optimization methods for improvements in different industrial contexts. We hope that our work can encourage the adoption of optimization techniques by more industrial practitioners.

Embedded systems are typically resource constrained, i.e., resources such as processors, I/O devices, shared buffers or shared memory can be limited for tasks in the system. Therefore, techniques that enable an efficient usage of such resources are of great importance. In the industry, typically large and complex software systems are divided into smaller parts (applications) where each part is developed independently. Migration towards multiprocessor platforms has become inevitable from an industrial perspective. Due to such migration and to efficient use of system resources, these applications eventually may be integrated on a shared multiprocessor platform. In order to facilitate the integration phase of the applications on a shared platform, the timing and resource requirements of each application can be provided in an interface when the application is developed. The system integrator can benefit from such provided information in the interface of each application to ease the integration process. In this thesis, we have provided the resource and timing requirements of each application in their interfaces for applications that may need several processors to be allocated on when they are developed. Although many scheduling techniques have been studied for multiprocessor systems, these techniques are usually based on the assumption that tasks are independent, i.e. do not share resources other than the processors. This assumption is typically not true. In this thesis, we provide an extension to such systems to handle sharing of resources other than processor among tasks. Two traditional approaches exist for multiprocessor systems to schedule tasks on processors. A recent scheduling approach for multiprocessors has combined the two traditional approaches and achieved a hybrid more efficient approach compared to the two previous one. Due to the complex nature of this scheduling approach the conventional approaches for resource sharing could not be used straight forwardly. In this thesis, we have modified resource sharing approaches such that they can be used in such hybrid scheduling systems. A second concern is that enabling resource sharing in the systems can cause unpredictable delays and variations in response time of tasks which can degrade system performance. Therefore, it is of great significance to improve the resource handling techniques to reduce the effect of imposed delays caused by resource sharing in a multiprocessor platform. In this thesis we have proposed alternative techniques for resource handling that can improve system performance for special setups.

We present regular model checking, a framework for algorithmic verification of infinite-state systems with, e.g., queues, stacks, integers, or a parameterized linear topology. States are represented by strings over a finite alphabet and the transition relation by a regular length-preserving relation on strings. Both sets of states and the transition relation are represented by regular sets. Major problems in the verification of parameterized and infinite-state systems are to compute the set of states that are reachable from some set of initial states, and to compute the transitive closure of the transition relation. We present an automata-theoretic construction for computing a non-finite composition of regular relations, e.g., the transitive closure of a relation. The method is incomplete in general, but we give sufficient conditions under which it works. We show how to reduce model checking of ω-regular properties of parameterized systems into a non-finite composition of regular relations. We also report on an implementation of regular model checking, based on a new package for non-deterministic finite automata.

Concurrent systems, i.e., systems of parallel processes, are nearly ubiquitous and verifying the correctness of such systems is becoming an important subject. Many formalisms were invented for such purpose, however, new types of systems are introduced and there is a need for handling larger systems. One examples is wireless sensor networks that are being deployed in increasing numbers in various areas; and in particular safety-critical areas, e.g., bush fire detection. Thus, ensuring their correctness is important. A process calculus is a formal language for modeling concurrent systems. The pi-calculus is a prominent example of such a language featuring message-passing concurrency. Psi-calculi is a parametric framework that extends the pi-calculus with arbitrary data and logics. Psi-calculi feature a universal theory with its results checked in an automated theorem prover ensuring their correctness. In this thesis, we extend psi-calculi expressiveness and modeling precision by introducing a sort system and generalised pattern matching. We show that the extended psi-calculi enjoy the same meta-theoretical results. We have developed the Pwb, a tool for the psi-calculi framework. The tool provides a high-level interactive symbolic execution and automated behavioral equivalence checking. We exemplify the use of the tool by developing a high-level executable model of a data collection protocol for wireless sensor networks. We are the first to introduce a session types based system for systems with unreliable communication. Remarkably, we do not need to add specific extensions to the types to accommodate such systems. We prove the standard desirable properties for type systems hold also for our type system. / ProFuN / UPMARC

Software has an important role in many systems, in particular in critical systems where the correct function of the larger system is of utmost importance. Software malfunction, or software exploits, that allow other system components or an adversary to control the execution of software, can cause significant damage to the system, and hence to what is controlled by the system. Due to the complexity in, and construction of, modern software systems, it is not sufficient to only analyze software source, such as source code, trying to find vulnerabilities that might enable exploits when executing. Instead, software protection must be extended with methods that consider the actual software execution, typically by executing in parallel with the software, and that protect the software as it executes. By using such methods, we can detect unwanted execution and protect against many exploits where the underlying vulnerability is difficult or impossible to find using only pre-execution, or static, methods. In this thesis, we present a methodology, and model for protecting software execution. We argue for the merits of dynamic methods, i.e. methods that consider the actual software execution, and we present a number of principles for how dynamic methods can be constructed. We also present three experiment systems that we have constructed, and show how the dynamic methods represented through these systems can be used to protect software execution and hence protect a system against exploits.

A district heating system consists of one or more production units supplying energy in the form of heated water through a distribution pipe network to a multitude of consumers. District heating systems come in a range of different forms and sizes; from small independent systems within industrial estates or university campuses to large city-wide systems supplying millions of consumers with heating and hot water. The geographically dispersed layout of district heating systems suggest that they are suitable for distributed optimization and management. However, this would imply a transition from the classical production-centric perspective normally found within district heating management to a more consumer-centric perspective. In this work we use multi-agent based systems in order to implement distributed policies for operational planning within district heating systems. We also develop models for simulating the dynamics of district heating systems in order to evaluate those policies and their use in computer-based demand side management approaches for improving operational planning and resource management. These policies are then implemented in real world industrial settings and their performance, as well as implementation issues, are analysed and evaluated. It is shown that distributed policies can lead to significant benefits compared to current schemes with respect to energy usage and heat load management at an operational level.

Games are often used as training devices in various tasks, but proper biofeedback is more seldom used. Within an EU project it was explored how biofeedback games can target emotion regulation and be evaluated meaningfully. While many use games and biofeedback separately, here the focus was to combine them. This was explored through how the games were perceived and played while players were punished in-game, based on their physiological activity. By implementing games and study the interaction patterns in experimental settings, primarily correlational data was acquired. The results suggest that targeting cognitive constructs has to be validated for each specific game, since game strategies can influence the activation of the cognitive constructs.