Automatic malware analysis is an essential part of today's computer security practices. Nearly one million malware samples were delivered to the analysts on a daily basis on year 2014 alone while the number of samples submitted for analysis increases almost exponentially each year. Given the size of the threat we are facing today and the amount of malicious codes emerging every day, the ability to automatically analyze unknown and unwanted software is critically important more than ever. On the other hand, malware writers adapt their malicious codes to new security measurements to protect them from being exposed and detected. This is usually achieved by employing obfuscation techniques that complicate the reverse engineering and analysis of the code by adding lots of unnecessary and irrelevant computations. Most of the malicious samples found in the wild are obfuscated and equipped with complicated anti-analysis defenses intended to hide the malicious intent of the malware by defeating the analysis and/or increasing the analysis time. Deobfuscation (reversing the obfuscation) requires automatic techniques to extract the original logic embedded in the obfuscated code for further analysis. Presumably the deobfuscated code requires less analysis time and is easier to analyze compared to the obfuscated one. Previous approaches in this regard target specific types of obfuscations by making strong assumptions about the underlying protection scheme leaving opportunities for the adversaries to attack. This work addresses this limitation by proposing new program analysis techniques that are effective against code obfuscations while being generic by minimizing the assumptions about the underlying code. We found that standard program analysis techniques, including well-known data and control flow analyses and/or symbolic execution, suffer from imprecision due to the obfuscation and show how to mitigate this loss of precision. Using more precise program analysis techniques, we propose a deobfuscation technique that is successful in reversing the complex obfuscation techniques such as virtualization-obfuscation and/or Return-Oriented Programming (ROP).

Technological advances have led to the generation of large databases of organizational data recognized as an information-rich, strategic asset for internal analysis and sharing with trading partners. Data mining techniques can discover patterns in large databases including relationships considered strategically relevant to the owner of the data. The frequent item set hiding problem is an area of active research to study approaches for hiding the sensitive knowledge patterns before disclosing the data outside the organization. Several methods address hiding sensitive item sets including an exact approach that generates an extension to the original database that, when combined with the original database, limits the discovery of sensitive association rules without impacting other non-sensitive information. To generate the database extension, this method formulates a constraint optimization problem (COP). Solving the COP formulation is the dominant factor in the computational resource requirements of the exact approach. This dissertation developed heuristics that address the scalability of the exact hiding method. The heuristics are directed at improving the performance of COP solver by reducing the size of the COP formulation without significantly affecting the quality of the solutions generated. The first heuristic decomposes the COP formulation into multiple smaller problem instances that are processed separately by the COP solver to generate partial extensions of the database. The smaller database extensions are then combined to form a database extension that is close to the database extension generated with the original, larger COP formulation. The second heuristic evaluates the revised border used to formulate the COP and reduces the number of variables and constraints by selectively substituting multiple item sets with composite variables. Solving the COP with fewer variables and constraints reduces the computational cost of the processing. Results of heuristic processing were compared with an existing exact approach based on the size of the database extension, the ability to hide sensitive data, and the impact on nonsensitive data.

Thesis (MSc)--Stellenbosch University, 2014. / ENGLISH ABSTRACT: This thesis gives a broad overview of what artificial chemistries (ACs) are, a brief review of several ACs and their applications, and an in depth analysis of one speci c AC: the four-bit binary string system. The model designed by Banzhaf [1] for in silico examination was recreated using the Python programming language. The initial motivation was to identify an existing AC that could be used to elucidate the sequence-function relationship, which led to the simultaneous investigation of self-organization in AC systems [7]. The interest in sequence-function relationships stems from their importance for self-production of objects [35]. For self-replication to be possible in larger organizations, the components of the organization must be able to continuously produce themselves [3, 7]. We chose the four-bit binary string system for investigation because of its simple design and implementation, its ability to yield complex results from interactions between a small population of objects, and its analogy to the DNA{RNA{protein organisation. When a population of objects are allowed to continuously interact, self-production and self-organization occur, even in simple arti cial systems [7, 8]. The stability of the emergent organizations depends on the interactions of its components, which must be capable of self-production if they are to maintain the organization [27]. Self-production of objects depends on their sequence-function relationship, which determines their rate of replication when interacting with other objects. / AFRIKAANSE OPSOMMING: Hierdie tesis verskaf `n bree oorsig van die algemene aard van artifisiele chemies (ACs), `n kort opsomming van `n paar ACs en hul toepassings, en `n diepgaande analise van een spesifieke AC: die 4-bis binere stringstelsel. Die model wat Banzhaf [1] ontwerp het vir in silico eksperimentering is hier herskep in die Python programmeringstaal. Die aanvanklike motivering was om `n bestaande AC te identifiseer wat gebruik kon word om die sekwens-funksie verwantskap te ontrafel, en dit het gelei tot die gelyktydige ondersoek van self-organisasie in AC stelsels [7]. Ons belangstelling in sekwens-funksie verwantskappe spruit uit hul belang vir die selfproduksie van objekte [35]. Om selfreplisering in meer omvangryke organisasies moontlik te maak moet die komponente in staat wees om hulself eenstryk te produseer [3, 7]. Ons het `n 4-bis stelsel vir hierdie studie gekies omdat die ontwerp en implementering eenvoudig is, omdat interaksies binne `n klein populasie van objekte komplekse resultate gee, en omdat die stelsel se organisasie analoog aan die DNA-RNA-proteien organisasie is. Wanneer `n populasie van objekte toegelaat word om eenstryk op mekaar te reageer vind self-produksie en self-organisasie vanself plaas, selfs in eenvoudige artifsiele stelsels [7, 8]. Die stabiliteit van die emergente organisasies hang af van die interaksies tussen die komponente, wat self die vermoe tot selfproduksie moet he indien hulle die organisasie in stand wil hou [27]. Selfproduksie van objekte hang af van hul sekwens-funsieverwantskap, wat op hul beurt bepaal hoe vinnig hulle repliseer wanneer in interaksie met ander objekte.

Thesis (MComm) -- Stellenbosch University, 2002. / ENGLISH ABSTRACT: Consider a data set with a categorical response variable and a set of explanatory variables. The response variable can have two or more categories and the explanatory variables can be numerical or categorical. This is a typical setup for a classification analysis, where we want to model the response based on the explanatory variables. Traditional statistical methods have been developed under certain assumptions such as: the explanatory variables are numeric only and! or the data follow a multivariate normal distribution. hl practice such assumptions are not always met. Different research fields generate data that have a mixed structure (categorical and numeric) and researchers are often interested using all these data in the analysis. hl recent years robust methods such as classification trees have become the substitute for traditional statistical methods when the above assumptions are violated. Classification trees are not only an effective classification method, but offer many other advantages. The aim of this thesis is to highlight the advantages of classification trees. hl the chapters that follow, the theory of and further developments on classification trees are discussed. This forms the foundation for the CART software which is discussed in Chapter 5, as well as other software in which classification tree modeling is possible. We will compare classification trees to parametric-, kernel- and k-nearest-neighbour discriminant analyses. A neural network is also compared to classification trees and finally we draw some conclusions on classification trees and its comparisons with other methods. / AFRIKAANSE OPSOMMING: Beskou 'n datastel met 'n kategoriese respons veranderlike en 'n stel verklarende veranderlikes. Die respons veranderlike kan twee of meer kategorieë hê en die verklarende veranderlikes kan numeries of kategories wees. Hierdie is 'n tipiese opset vir 'n klassifikasie analise, waar ons die respons wil modelleer deur gebruik te maak van die verklarende veranderlikes. Tradisionele statistiese metodes is ontwikkelonder sekere aannames soos: die verklarende veranderlikes is slegs numeries en! of dat die data 'n meerveranderlike normaal verdeling het. In die praktyk word daar nie altyd voldoen aan hierdie aannames nie. Verskillende navorsingsvelde genereer data wat 'n gemengde struktuur het (kategories en numeries) en navorsers wil soms al hierdie data gebruik in die analise. In die afgelope jare het robuuste metodes soos klassifikasie bome die alternatief geword vir tradisionele statistiese metodes as daar nie aan bogenoemde aannames voldoen word nie. Klassifikasie bome is nie net 'n effektiewe klassifikasie metode nie, maar bied baie meer voordele. Die doel van hierdie werkstuk is om die voordele van klassifikasie bome uit te wys. In die hoofstukke wat volg word die teorie en verdere ontwikkelinge van klassifikasie bome bespreek. Hierdie vorm die fondament vir die CART sagteware wat bespreek word in Hoofstuk 5, asook ander sagteware waarin klassifikasie boom modelering moontlik is. Ons sal klassifikasie bome vergelyk met parametriese-, "kernel"- en "k-nearest-neighbour" diskriminant analise. 'n Neurale netwerk word ook vergelyk met klassifikasie bome en ten slote word daar gevolgtrekkings gemaak oor klassifikasie bome en hoe dit vergelyk met ander metodes.

Η ανάπτυξη του διαδικτύου τα τελευταία χρόνια έχει φέρει αλλαγές στο μέγεθος και την ποιότητα του διαθέσιμου περιεχομένου. Οι χρήστες κυριολεκτικά κατακλύζονται από πληροφορία η οποία μπορεί να έχει διάφορες μορφές όπως κείμενο, ήχο, εικόνα, βίντεο. Η μεγάλη εξάπλωση του διαδικτύου, η εύκολη αναζήτηση σε μεγάλο όγκο πληροφορίας καθώς και η παρουσίαση του περιεχομένου με φιλικό τρόπο προς το χρήστη συνέβαλε στην ολοένα αυξανόμενη ανάγκη για προμήθεια εικόνων, βίντεο και μουσικής. Η ψηφιοποίηση του μεγαλύτερου όγκου περιεχομένου που διαχειρίζονται οι χρήστες τόσο στην προσωπική όσο και στην επαγγελματική ζωή τους οδήγησε στην ανάπτυξη νέων τεχνικών στεγανογραφίας για την ανταλλαγή κρυφής πληροφορίας, έννοια η οποία είναι ευρέως γνωστή από την αρχαιότητα. Η παρούσα μεταπτυχιακή εργασία υλοποιεί δύο από τους πιο δημοφιλείς αλγορίθμους στεγανογράφησης τον (Least Significant Bit) και τον LBP (Local Binary Pattern). Το σύστημα που αναπτύχθηκε είναι διαθέσιμο στο διαδίκτυο και μπορεί να χρησιμοποιηθεί από οποιοδήποτε χρήστη επιθυμεί να αποκρύψει πληροφορία (κείμενο ή εικόνα) μέσα σε μια εικόνα. Το σύστημα υλοποιεί όλο τον κύκλο της στεγανογράφησης δίνοντας τη δυνατότητα στο χρήστη όχι μόνο να κάνει απόκρυψη της πληροφορίας που επιθυμεί αλλά και την αντίστροφη διαδικασία δηλαδή την ανάκτηση της κρυμμένης πληροφορίας. Η διαδικασία είναι απλή και απαιτεί από τον αποστολέα (αυτός που κρύβει το μήνυμα) το ανέβασμα της εικόνας στο σύστημα, την εισαγωγή ενός μυστικού κλειδιού το οποίο πρέπει να είναι γνωστό για την ανάκτηση του μηνύματος, και φυσικά το μήνυμα, δηλαδή η προς απόκρυψη πληροφορία. Στη συνέχεια ο παραλήπτης για να ανακτήσει το μήνυμα θα πρέπει να ανεβάσει στο σύστημα τη στεγανογραφημένη εικόνα καθώς και το μυστικό κλειδί που έχει συμφωνήσει με τον αποστολέα. Τέλος, με κάποια σενάρια χρήσης, πραγματοποιούνται μετρήσεις, οι οποίες δείχνουν την απόδοση κάθε αλγορίθμου και γίνονται οι αντίστοιχες συγκρίσεις. Το σύστημα που υλοποιήθηκε στην παρούσα εργασία μπορεί να συμπεριλάβει και άλλες μεθόδους στεγανογράφησης καθώς επίσης και με την επέκταση του αλγορίθμου LBP ώστε να χρησιμοποιεί και τις τρεις χρωματικές συνιστώσες για την απόκρυψη της πληροφορίας.. Επίσης, θα είχε ιδιαίτερο ενδιαφέρον η παροχή της συγκεκριμένης διαδικασίας σαν ηλεκτρονική υπηρεσία (web service) ώστε να είναι εφικτό να χρησιμοποιηθεί ανεξάρτητα και να μπορεί να εισαχθεί ως αυτόνομο κομμάτι λογισμικού σε κάθε πλατφόρμα που υποστηρίζει web services. / The development of the internet in recent years has brought changes in the size and quality of the available content. Users literally flooded with information which may have various forms like text, audio, image, and video. The wide spread of the internet, the ease of search in a large amount of information and the presentation of the available content in a friendly way resulted in the need for more images, videos and music. With the digitization of the available content new steganography techniques were necessary so that users can exchange secret information. In the current thesis two of the most popular steganography algorithms are implemented: the LSB (Least Significant Bit) and the LBP (Local Binary Pattern). The system is publicly available and can be used by any user who wishes to hide information (text or image) within an image. The system provides functionalities so that user can hide information within an image and recover the hidden information. The sender (the person who wishes to hide a message) has to provide the following information in the system: upload the image, provide the secret key needed to retrieve the message, and upload the message. The receiver has to upload the image containing the message and the secret key needed to recover the message. Anumber of usage scenarios are implemented to measure the performance of the algorithms and make comparisons. The implemented system can easily include more steganografy methods and also the extension of the LBP algorithm so that the three color components are used to hide the information. It would be interested to provide the current process as an e-service (web service) that it is feasible to be used independently and can be introduced as a standalone piece of software in any platform that supports web services.

Nanomaterials such as carbon nanotubes, gold nanorods, magnetic nanocrystals, and binary nanocrystal superlattices have exciting potential applications. However, before these ideas can be applied, it is imperative to fully understand the materials synthesis. Multiwall carbon nanotubes were synthesized in supercritical toluene using cobaltocene, nickelocene, ferrocene, or metal nanocrystals as catalysts. Toluene served as both the solvent and carbon source for nanotube growth. The reaction was optimized by introducing supplemental carbon sources; either hexane or ethanol increased the yield relative to pure toluene and catalytic amounts of water minimized carbon filament and amorphous carbon formation. Gold nanorods were synthesized by the colloidal seed-mediated, surfactantassisted approach using cetyltrimethylammonium bromide (CTAB) obtained from ten different suppliers. The gold nanorod yield depended strongly on the CTAB used: with the same recipe, three of the CTABs produced only spherical particles, whereas the other CTABs produced nanorods with nearly 100% yield. Inductively coupled plasma mass spectrometry revealed a trace iodide impurity in the CTABs that did not yield nanorods. Further experiments introducing potassium iodide to the nanorod synthesis verified the detrimental effect of iodide on nanorod formation. Multifunctional colloidal core-shell nanoparticles of magnetic nanocrystals or gold nanorods coated with a fluorescent dye (Tris(2,2 -bipyridyl)dichlororuthenium(II) hexahydrate) doped silica shells were also synthesized. The as-prepared magnetic nanocrystals were initially hydrophobic and silica coated using a microemulsion approach, while the gold nanorods were hydrophilic and silica coated using a Stöber process. These colloidal heterostructures have the potential to be used as dual-purpose tags, exhibiting a fluorescent signal that could be combined with either dark-field optical contrast or enhanced contrast in magnetic resonance imaging. Binary superlattices (BSLs) of large iron oxide and small gold nanocrystals were assembled by slow evaporation of colloidal dispersions on tilted substrates. SEM and grazing incidence small angle X-ray scattering (GISAXS) confirmed the BSLs were simple hexagonal AB2 superlattices with long range order. GISAXS also revealed that the superlattice was slightly contracted perpendicular to the substrate as a result of solvent drying during the deposition process. Additionally, in some BSLs nearly periodic superlattice dislocations consisting of inserted half-planes of gold nanocrystals were observed. / text

Biomass energy is increasingly used to reduce the dependence on fossil fuels and reduce the impact of greenhouse gas emissions on global warming. Fluidized bed gasification converts solid biomass into gaseous fuels that can be used for combustion or liquid fuels synthesis. The efficiency of biomass gasification is directly affected by the fluidized bed hydrodynamics. For example, the solids recirculation rate through the system is an important parameter that affects the heat and mass transfer rates. In this study, a cold model of a dual fluidized bed (DFB) biomass gasification plant was designed using scaling laws, and was constructed to investigate the hydrodynamics of industrial DFBs. A DFB consists of a bubbling fluidized bed (BFB), where biomass is gasified to produce syngas, and a circulating fluidized bed (CFB) where the residues of gasification are combusted. The investigation was divided into Phase I and II. In Phase I, an operational map was developed for the CFB to define operational boundaries for steady state operation of the plant. An empirical model was developed to predict the solids mass flow rate out of the CFB riser, which is an empirical function of the exit opening width, the CFB diameter, and a newly introduced aerodynamic factor. The correlation coefficient, R2 for the empirical function was 0.8327. The aerodynamic factor accounts for the particle inertia and clustering effects at the exit of the CFB riser. Results from Phase I also showed that increasing the fluidizing velocities increased the solids circulation rate and affected the pressure drop over various points in the CFB plant due to redistribution of solids with the system. A critical assessment was performed on published correlations found in the literature to determine how accurately they predicted the hydrodynamics in the CFB riser. By comparing predicted and experimental results, the correlations were found to be inaccurate for the conditions and configuration of the CFB tested in this study. For example, the solids velocity was not accurately predicted by published correlations due to unaccounted particle clustering effects. The main issue with the published correlations was a lack of generality, so that the correlations only applied for predicting fluidizing behaviour in the equipment they were developed in. In Phase II, an operational map was developed for the DFB, which incorporated both the CFB and the BFB. Experiments with a binary mixture representing sand and char in an industrial gasifier showed a blocking effect in the connecting chute between the CFB and BFB by the material representing char, which was larger and less dense than the material representing sand. A computational fluid dynamics (CFD) based design tool for modelling the cold model CFB cyclone was developed and validated by comparing the predicted and experimental cyclone pressure drop. The correlation coefficient for the CFD pressure drop prediction was 0.7755. The design tool contained information about the grid resolution and the time step required for modelling the cyclone accurately.

In this thesis, we examine the role of accretion disks in the formation of stellar systems, focusing on young massive disks which regulate the flow of material from the parent molecular core down to the star. We study the evolution of disks with high infall rates that develop strong gravitational instabilities. We begin in chapter 1 with a review of the observations and theory which underpin models for the earliest phases of star formation and provide a brief review of basic accretion disk physics, and the numerical methods which we employ. In chapter 2 we outline the current models of binary and multiple star formation, and review their successes and shortcomings from a theoretical and observational perspective. In chapter 3 we begin with a relatively simple analytic model for disks around young, very massive stars, showing that instability in these disks may be responsible for the higher multiplicity fraction of massive stars, and perhaps the upper mass to which they grow. We extend these models in chapter 4 to explore the properties of disks and the formation of binary companions across a broad range of stellar masses. In particular, we model the role of global and local mechanisms for angular momentum transport in regulating the relative masses of disks and stars. We follow the evolution of these disks throughout the main accretion phase of the system, and predict the trajectory of disks through parameter space. We follow up on the predictions made in our analytic models with a series of high resolution, global numerical experiments in chapter 5. Here we propose and test a new parameterization for describing rapidly accreting, gravitationally unstable disks. We find that disk properties and system multiplicity can be mapped out well in this parameter space. Finally, in chapter 6, we address whether our studies of unstable disks are relevant to recently detected massive planets on wide orbits around their central stars.

I have used blue near-infrared colours to select a group of UKIDSS T dwarfs with spectral types later than T4. From amongst these I identify two kinematic halo T-dwarf candi- dates. Blue near-infrared colours have been attributed to collisionally-induced hydrogen absorption, which is enhanced by either high surface gravity or low metallicity. Proper motions are measured and distances estimated, allowing the determination of tangential velocities. U and V components are estimated for our objects by assuming Vrad = 0. From this, ULAS J0926+0835 is found to have U = 62 kms−1 and V = −140 kms−1 and ULAS J1319+1209 is found to have U = 192 kms−1 and V = −92 kms−1. These values are consistent with potential halo membership. However, surprisingly, these are not the bluest objects in the selection. The bluest is ULAS J1233+1219, with J −K = −1.16±0.07, and surprisingly this object is found to have thin disc-like U and V . Our sample also contains Hip 73786B, which I find to be a companion to the star Hip 73786. Hip 73786 is a metal- poor star, with [Fe/H]= −0.3 ± 0.1 and is located at a distance of 19±0.7 pc. U, V,W space velocity components are calculated for Hip 73786A and B, finding that U = −48±7 kms−1, V = −75 ± 4 kms−1 and W = −44 ± 8 kms−1. From the properties of the pri- mary, Hip 73786B is found to be at least 1.6Gyr old. As a metal poor object, Hip 73786B represents an important addition to the sample of known T dwarf benchmarks. Using mid-infrared data from WISE, I also identify T dwarfs with abnormally-red H − W2 and consider possible causes for their extreme colours. In particular I exam- ine three prominent examples of this phenomenon, ULAS J1416+1348B, 2MASS J0939- 2448 and BD+01o 2920B. A plot of spectral type against MW2-magnitude suggests that ULAS J1416+1348B is potentially an unresolved binary, similar to 2MASS J0939-2448. However, the plot also indicates that BD+01o 2920B is not an unresolved binary. I also present new FIRE spectroscopy for ULAS J1416+1348B and 2MASS J0939-2448. These data show that ULAS J1416+1348B has a similar shape to the Y -band spectrum to that of BD+01o 2920B, thus suggesting that the two objects have a similar metallicity, whereas 2MASS J0939-2448 appears to be a more metal-rich object. Using a new parallactic dis- tance, I derive a luminosity of (6.9±0.7)×1020W for ULAS J1416+1348B. I also find a radial velocity of −39 ± 1 kms−1 for this object. The agreement between this and that of the L dwarf SDSS J1416+1348A confirms that these two objects are physically-associated. I also present a set of simulated unresolved binaries; the colours of these systems do not appear to redden significantly with the addition of cooler companions. From this, I suggest that the colours of ULAS J1416+1348B and BD+01o 2920B cannot be solely attributed to any possible unresolved companions; for these two objects, composition and/or surface gravity must be playing a substantial role. Consideration of model predictions provides extra evidence for this argument, showing as it does that high log g and low metallicity can redden H − W2 colours by as much as »0.5mag as compared to a high-metallicity and low log g object of the same effective temperature. I also present kinematics and photometry for several more new candidate low-metallicity T dwarfs. Spectra are also presented, where available. In addition I provide new follow-up JHK spectroscopy for ULAS J0926+0835, ULAS J1233+1219 and ULAS J1319+1209. These new spectra allow full JHK-based spectral typing for these objects.

Safety systems are designed to prevent the occurrence of certain conditions and their future development into a hazardous situation. The consequence of the failure of a safety system of a potentially hazardous industrial system or process varies from minor inconvenience and cost to personal injury, significant economic loss and death. To minimise the likelihood of a hazardous situation, safety systems must be designed to maximise their availability. Therefore, the purpose of this thesis is to propose an effective safety system design optimization scheme. A multi-objective genetic algorithm has been adopted, where the criteria catered for includes unavailability, cost, spurious trip and maintenance down time. Analyses of individual system designs are carried out using the latest advantages of the fault tree analysis technique and the binary decision diagram approach (BDD). The improved strength Pareto evolutionary approach (SPEA2) is chosen to perform the system optimization resulting in the final design specifications. The practicality of the developed approach is demonstrated initially through application to a High Integrity Protection System (HIPS) and subsequently to test scalability using the more complex Firewater Deluge System (FDS). Computer code has been developed to carry out the analysis. The results for both systems are compared to those using a single objective optimization approach (GASSOP) and exhaustive search. The overall conclusions show a number of benefits of the SPEA2 based technique application to the safety system design optimization. It is common for safety systems to feature dependency relationships between its components. To enable the use of the fault tree analysis technique and the BDD approach for such systems, the Markov method is incorporated into the optimization process. The main types of dependency which can exist between the safety system component failures are identified. The Markov model generation algorithms are suggested for each type of dependency. The modified optimization tool is tested on the HIPS and FDS. Results comparison shows the benefit of using the modified technique for safety system optimization. Finally the effectiveness and application to general safety systems is discussed.