Not available / text

Thesis (Ph. D.)--University of Texas at Austin, 2005. / Supervisor: Arthur B. Markman. Vita. Includes bibliographical references.

Thesis (Ph. D.)--University of Texas at El Paso, 2008. / Title from title screen. Vita. CD-ROM. Includes bibliographical references. Also available online.

Thesis (Ph. D.)--University of Texas at El Paso, 2008. / Title from title screen. Vita. CD-ROM. Includes bibliographical references. Also available online.

Thesis (Ph. D.)--University of Texas at El Paso, 2008. / Title from title screen. Vita. CD-ROM. Includes bibliographical references. Also available online.

The detection of similar code can support many so ware engineering tasks such as program understanding and program classification. Many excellent approaches have been proposed to detect programs having similar syntactic features. However, these approaches are unable to identify programs dynamically or statistically close to each other, which we call behaviorally similar programs. We believe the detection of behaviorally similar programs can enhance or even automate the tasks relevant to program classification. In this thesis, we will discuss our current approaches to identify programs having similar behavioral features in multiple perspectives. We first discuss how to detect programs having similar functionality. While the definition of a program’s functionality is undecidable, we use inputs and outputs (I/Os) of programs as the proxy of their functionality. We then use I/Os of programs as a behavioral feature to detect which programs are functionally similar: two programs are functionally similar if they share similar inputs and outputs. This approach has been studied and developed in the C language to detect functionally equivalent programs having equivalent I/Os. Nevertheless, some natural problems in Object Oriented languages, such as input generation and comparisons between application-specific data types, hinder the development of this approach. We propose a new technique, in-vivo detection, which uses existing and meaningful inputs to drive applications systematically and then applies a novel similarity model considering both inputs and outputs of programs, to detect functionally similar programs. We develop the tool, HitoshiIO, based on our in-vivo detection. In the subjects that we study, HitoshiIO correctly detect 68.4% of functionally similar programs, where its false positive rate is only 16.6%. In addition to functional I/Os of programs, we attempt to discover programs having similar execution behavior. Again, the execution behavior of a program can be undecidable, so we use instructions executed at run-time as a behavioral feature of a program. We create DyCLINK, which observes program executions and encodes them in dynamic instruction graphs. A vertex in a dynamic instruction graph is an instruction and an edge is a type of dependency between two instructions. The problem to detect which programs have similar executions can then be reduced to a problem of solving inexact graph isomorphism. We propose a link analysis based algorithm, LinkSub, which vectorizes each dynamic instruction graph by the importance of every instruction, to solve this graph isomorphism problem efficiently. In a K Nearest Neighbor (KNN) based program classification experiment, DyCLINK achieves 90 + % precision. Because HitoshiIO and DyCLINK both rely on dynamic analysis to expose program behavior, they have better capability to locate and search for behaviorally similar programs than traditional static analysis tools. However, they suffer from some common problems of dynamic analysis, such as input generation and run-time overhead. These problems may make our approaches challenging to scale. Thus, we create the system, Macneto, which integrates static analysis with machine topic modeling and deep learning to approximate program behaviors from their binaries without truly executing programs. In our deobfuscation experiments considering two commercial obfuscators that alter lexical information and syntax in programs, Macneto achieves 90 + % precision, where the groundtruth is that the behavior of a program before and after obfuscation should be the same. In this thesis, we offer a more extensive view of similar programs than the traditional definitions. While the traditional definitions of similar programs mostly use static features, such as syntax and lexical information, we propose to leverage the power of dynamic analysis and machine learning models to trace/collect behavioral features of pro- grams. These behavioral features of programs can then apply to detect behaviorally similar programs. We believe the techniques we invented in this thesis to detect behaviorally similar programs can improve the development of software engineering and security applications, such as code search and deobfuscation.

Thesis (M.A.)--University of Texas at El Paso, 2009. / Title from title screen. Vita. CD-ROM. Includes bibliographical references. Also available online.

This study investigated the influence of chronological age and stimuli on the explanations of "same" and "different" by young children. Seventy children, between by young children. the ages of three-years, six-months and nine-years, six-months, selected on the basis of chronological age, normal speech and language development, and normal verbal maturity, were involved as subjects. A test consisting of a series of verbal tasks was administered to each child. The experimenter recorded and later analyzed and classified all responses for each child, following specific guidelines for judging appropriateness of response and assigning each appropriate response to one of three classifications.

Thesis (M.A.)--Carleton University, 2004. / Includes bibliographical references (p. 73-77). Also available in electronic format on the Internet.

The objective of the thesis is to advance the concept of learning by explicating the mechanisms contributing to knowledge accumulation and its transfer to new situations. On the basis of 44 case studies, the framework is refined to accurately capture the unique features and outcomes of experiential knowledge in acquisitions. Feedback from the performance of prior acquisitions was found to enrich representations of action-outcome linkages and modify procedures in search and valuation. Inferential transfer though depended on similar kinds of features emerging in subsequent decisions. Outcomes therefore reflected the integration of feedback processes and similarity judgments. From the case studies, a set of hypotheses was developed and their plausibility tested, using another data set on the acquisitions of 687 managers. The research finds that the performance of prior decisions and the similarity to prior experiences materially impact behaviour. Poor performance in prior, similar acquisitions led to a reduction in subsequent risk behaviour, illustrated by the extent of risk management and by the lessening of commitment to specific transactions. The impact of performance feedback was also extant in the similarity of choice to prior experiences. The results illustrate that although feedback shapes perceptions of likelihood and expected value, similarity judgments moderate the impact of prior performance on behaviour. Given the impact on acquisition behaviour, the research also illustrates that prior experiences do not necessarily increase performance. Adaptation from prior failures was not unambiguously linked to positive returns, suggesting limitations from feedback mechanisms. Rather, the extent and similarity of acquisition experience led to a reduction in the variability of performance. By providing a framework for selecting planning procedures, greater experience tended to reduce surprises post-acquisition.