arXiv subjects

Peng Liu

Publications and source records attributed to Peng Liu.

At least 343 records · Page 19Linked to original sources

arXiv2021

Finding Taint-Style Vulnerabilities in Linux-based Embedded Firmware with SSE-based Alias Analysis

Although the importance of using static analysis to detect taint-style vulnerabilities in Linux-based embedded firmware is widely recognized, existing approaches are plagued by three major limitations. (a) Approaches based on symbolic execution may miss alias information and therefore suffer from a high false-negative rate. (b) Approaches based on VSA (value set analysis) often provide an over-approximate pointer range. As a result, many false positives could be produced. (c) Existing work for detecting taint-style vulnerability does not consider indirect call resolution, whereas indirect calls are frequently used in Internet-facing embedded devices. As a result, many false negatives could be produced. In this work, we propose a precise demand-driven flow-, context- and field-sensitive alias analysis approach. Based on this new approach, we also design a novel indirect call resolution scheme. Combined with sanitization rule checking, our solution discovers taint-style vulnerabilities by static taint analysis. We implemented our idea with a prototype called EmTaint and evaluated it against 35 real-world embedded firmware samples from six popular vendors. EmTaint discovered at least 192 bugs, including 41 n-day bugs and 151 0-day bugs. At least 115 CVE/PSV numbers have been allocated from a subset of the reported vulnerabilities at the time of writing. Compared to state-of-the-art tools such as KARONTE and SaTC, EmTaint found significantly more bugs on the same dataset in less time.

cs.CR↗

arXiv2021

The current recorded signals of ultrahigh-energy $γ$-rays may come from EeVatrons in the galaxy

A hard $γ$-ray spectrum of supernova remnant G106.3+2.7 can be explained by using the hadronic model with the gluon condensation effect. This implies that not only PeVatrons but also EeVatrons generally exist in the universe including our galaxy, and they can accelerate protons to beyond "ankle" ($10^{19}~eV$). Although these proton beams are very weak in the galaxy and cannot be observed individually on the earth, the gluon condensation effect may greatly enhance the proton-proton cross section, which can compensate for the weak proton flux and produce the observed $γ$-rays. We also show that the gluon condensation effect in proton provides an efficient conversion mechanism for kinetic energy into $γ$-rays in the universe.

astro-ph.HE↗

arXiv2021

Trade-off between validity and efficiency of merging p-values under arbitrary dependence

Various methods of combining individual p-values into one p-value are widely used in many areas of statistical applications. We say that a combining method is valid for arbitrary dependence (VAD) if it does not require any assumption on the dependence structure of the p-values, whereas it is valid for some dependence (VSD) if it requires some specific, perhaps realistic but unjustifiable, dependence structures. The trade-off between validity and efficiency of these methods is studied via analyzing the choices of critical values under different dependence assumptions. We introduce the notions of independence-comonotonicity balance (IC-balance) and the price for validity. In particular, IC-balanced methods always produce an identical critical value for independent and perfectly positively dependent p-values, a specific type of insensitivity to a family of dependence assumptions. We show that, among two very general classes of merging methods commonly used in practice, the Cauchy combination method and the Simes method are the only IC-balanced ones. Simulation studies and a real data analysis are conducted to analyze the sizes and powers of various combining methods in the presence of weak and strong dependence.

math.ST↗

arXiv2021

Circuit design and integration feasibility of a high-resolution broadband on-chip spectral monitor

Up-to-date network telemetry is the key enabler for resource optimization by a variety of means including capacity scaling, fault recovery, network reconfiguration. Reliable optical performance monitoring in general and specifically the monitoring of the spectral profile of WDM signals in fixed- and flex-grid architecture across the entire C-band remains challenging. This article describes a spectrometer circuit architecture along with an original data processing algorithm that combined can measure the spectrum quantitatively across the entire C-band aiming at 1 GHz resolution bandwidth. The circuit is composed of a scanning ring resonator followed by a parallel arrangement of AWGs with interlaced channel spectra. The comb of ring resonances provides the high resolution and the algorithm creates a virtual tuneable AWG that isolates individual resonances of the comb within the flat pass-band of its synthesized channels. The parallel arrangement of AWGs may be replaced by a time multiplexed multi-input port AWG. The feasibility of a ring resonator functioning over whole C-band is experimentally validated. Full tuning of the comb of resonances over a free spectral range is achieved with a high-resolution bandwidth of 1.30 GHz. Due to its maturity and low loss, CMOS compatible silicon nitride is chosen for integration. Additionally, the whole system demonstration is presented using industry standard simulation tool. The architecture is robust to fabrication process variations owing to its data processing approach.

eess.SP↗

arXiv2021

A Deep Learning-Based FPGA Function Block Detection Method with Bitstream to Image Transformation

In the context of various application scenarios and/or for the sake of strengthening field-programmable gate array (FPGA) security, the system functions of an FPGA design need to be analyzed, which can be achieved by systematically partitioning the FPGA's bitstream into manageable functional blocks and detecting their functionalities thereafter. In this paper, we propose a novel deep learning-based FPGA function block detection method with three major steps. In specific, we first analyze the format of the bitstream to obtain the mapping relationship between the configuration bits and configurable logic blocks because of the discontinuity of the configuration bits in the bitstream for one element. In order to reap the maturity of object detection techniques based on deep learning, our next step is to convert an FPGA bitstream to an image, following the proposed transformation method that takes account of both the adjacency nature of the programmable logic and the high degree of redundancy of configuration information. Once the image is obtained, a deep learning-based object detection algorithm is applied to this transformed image, and the objects detected can be reflected back to determine the function blocks of the original FPGA design. The deep neural network used for function block detection is trained and validated with a specially crafted bitstream/image dataset. Experiments have confirmed high detection accuracy of the proposed function detection method, showing a 98.11% of mean Average Precision (IoU=0.5) for 10 function blocks within a YOLOv3 detector implemented on Xilinx Zynq-7000 SoCs and Zynq UltraScale+ MPSoCs.

cs.OH↗

arXiv2021

Bayesian spectral density approach for identification and uncertainty quantification of bridge section's flutter derivatives operated in turbulent flow

This study presents a Bayesian spectral density approach for identification and uncertainty quantification of flutter derivatives of bridge sections utilizing buffeting displacement responses, where the wind tunnel test is conducted in turbulent flow. Different from traditional time-domain approaches (e.g., least square method and stochastic subspace identification), the newly-proposed approach is operated in frequency domain. Based on the affine invariant ensemble sampler algorithm, Markov chain Monte-Carlo sampling is employed to accomplish the Bayesian inference. The probability density function of flutter derivatives is modeled based on complex Wishart distribution, where probability serves as the measure. By the Bayesian spectral density approach, the most probable values and corresponding posterior distributions (namely identification uncertainty here) of each flutter derivative can be obtained at the same time. Firstly, numerical simulations are conducted and the identified results are accurate. Secondly, thin plate model, flutter derivatives of which have theoretical solutions, is chosen to be tested in turbulent flow for the sake of verification. The identified results of thin plate model are consistent with the theoretical solutions. Thirdly, the center-slotted girder model, which is widely-utilized long-span bridge sections in current engineering practice, is employed to investigate the applicability of the proposed approach on a general bridge section. For the center-slotted girder model, the flutter derivatives are also extracted by least square method in uniform flow to cross validate the newly-proposed approach. The identified results by two different approaches are compatible.

stat.AP↗

arXiv2021

Informational properties of holographic Lifshitz field theory

In this paper, we explore the properties of holographic entanglement entropy (HEE), mutual information (MI) and entanglement of purification (EoP) in holographic Lifshitz theory. These informational quantities exhibit some universal properties of holographic dual field theory. For most configuration parameters and temperatures, these informational quantities change monotonously with the Lifshitz dynamical critical exponent $z$. However, we also observe some non-monotonic behaviors for these informational quantities in some specific spaces of configuration parameters and temperatures. A particularly interesting phenomenon is that a dome-shaped diagram emerges in the behavior of MI vs $z$, and correspondingly a trapezoid-shaped profile appears in that of EoP vs $z$. This means that for some specific configuration parameters and temperatures, the system measured in terms of MI and EoP is entangled only in a certain intermediate range of $z$.

hep-th↗

arXiv2021

An explainable two-dimensional single model deep learning approach for Alzheimer's disease diagnosis and brain atrophy localization

Early and accurate diagnosis of Alzheimer's disease (AD) and its prodromal period mild cognitive impairment (MCI) is essential for the delayed disease progression and the improved quality of patients'life. The emerging computer-aided diagnostic methods that combine deep learning with structural magnetic resonance imaging (sMRI) have achieved encouraging results, but some of them are limit of issues such as data leakage and unexplainable diagnosis. In this research, we propose a novel end-to-end deep learning approach for automated diagnosis of AD and localization of important brain regions related to the disease from sMRI data. This approach is based on a 2D single model strategy and has the following differences from the current approaches: 1) Convolutional Neural Network (CNN) models of different structures and capacities are evaluated systemically and the most suitable model is adopted for AD diagnosis; 2) a data augmentation strategy named Two-stage Random RandAugment (TRRA) is proposed to alleviate the overfitting issue caused by limited training data and to improve the classification performance in AD diagnosis; 3) an explainable method of Grad-CAM++ is introduced to generate the visually explainable heatmaps that localize and highlight the brain regions that our model focuses on and to make our model more transparent. Our approach has been evaluated on two publicly accessible datasets for two classification tasks of AD vs. cognitively normal (CN) and progressive MCI (pMCI) vs. stable MCI (sMCI). The experimental results indicate that our approach outperforms the state-of-the-art approaches, including those using multi-model and 3D CNN methods. The resultant localization heatmaps from our approach also highlight the lateral ventricle and some disease-relevant regions of cortex, coincident with the commonly affected regions during the development of AD.

eess.IV↗

arXiv2021

Automatic Firmware Emulation through Invalidity-guided Knowledge Inference (Extended Version)

Emulating firmware for microcontrollers is challenging due to the tight coupling between the hardware and firmware. This has greatly impeded the application of dynamic analysis tools to firmware analysis. The state-of-the-art work automatically models unknown peripherals by observing their access patterns, and then leverages heuristics to calculate the appropriate responses when unknown peripheral registers are accessed. However, we empirically found that this approach and the corresponding heuristics are frequently insufficient to emulate firmware. In this work, we propose a new approach called uEmu to emulate firmware with unknown peripherals. Unlike existing work that attempts to build a general model for each peripheral, our approach learns how to correctly emulate firmware execution at individual peripheral access points. It takes the image as input and symbolically executes it by representing unknown peripheral registers as symbols. During symbolic execution, it infers the rules to respond to unknown peripheral accesses. These rules are stored in a knowledge base, which is referred to during the dynamic firmware analysis. uEmu achieved a passing rate of 95% in a set of unit tests for peripheral drivers without any manual assistance. We also evaluated uEmu with real-world firmware samples and new bugs were discovered.

cs.CR↗

arXiv2021

Ordering and Inequalities for Mixtures on Risk Aggregation

Aggregation sets, which represent model uncertainty due to unknown dependence, are an important object in the study of robust risk aggregation. In this paper, we investigate ordering relations between two aggregation sets for which the sets of marginals are related by two simple operations: distribution mixtures and quantile mixtures. Intuitively, these operations ``homogenize" marginal distributions by making them similar. As a general conclusion from our results, more ``homogeneous" marginals lead to a larger aggregation set, and thus more severe model uncertainty, although the situation for quantile mixtures is much more complicated than that for distribution mixtures. We proceed to study inequalities on the worst-case values of risk measures in risk aggregation, which represent conservative calculation of regulatory capital. Among other results, we obtain an order relation on VaR under quantile mixture for marginal distributions with monotone densities. Numerical results are presented to visualize the theoretical results and further inspire some conjectures. Finally, we provide applications on portfolio diversification under dependence uncertainty and merging p-values in multiple hypothesis testing, and discuss the connection of our results to joint mixability.

q-fin.RM↗

arXiv2021

Entanglement Wedge Minimum Cross-section in Holographic Massive Gravity Theory

We study the entanglement wedge cross-section (EWCS) in holographic massive gravity theory, in which a first and second-order phase transition can occur. We find that the mixed state entanglement measures, the EWCS and mutual information (MI) can characterize the phase transitions. The EWCS and MI show exactly the opposite behavior in the critical region, which suggests that the EWCS captures distinct degrees of freedom from that of the MI. More importantly, EWCS, MI and HEE all show the same scaling behavior in the critical region. We give an analytical understanding of this phenomenon. By comparing the quantum information behavior in the thermodynamic phase transition of holographic superconductors, we analyze the relationship and difference between them, and provide two mechanisms of quantum information scaling behavior in the thermodynamic phase transition.

hep-th↗

arXiv2021

Importance Weighted Adversarial Discriminative Transfer for Anomaly Detection

Previous transfer methods for anomaly detection generally assume the availability of labeled data in source or target domains. However, such an assumption is not valid in most real applications where large-scale labeled data are too expensive. Therefore, this paper proposes an importance weighted adversarial autoencoder-based method to transfer anomaly detection knowledge in an unsupervised manner, particularly for a rarely studied scenario where a target domain has no labeled normal/abnormal data while only normal data from a related source domain exist. Specifically, the method learns to align the distributions of normal data in both source and target domains, but leave the distribution of abnormal data in the target domain unchanged. In this way, an obvious gap can be produced between the distributions of normal and abnormal data in the target domain, therefore enabling the anomaly detection in the domain. Extensive experiments on multiple synthetic datasets and the UCSD benchmark demonstrate the effectiveness of our approach.

cs.LG↗

arXiv2021

Development of a magnet power supply with a common-mode cancellation method based on automatic calibration of driving pulses

Based on conventional H-bridge topologies of magnet power supplies, a high-frequency common-mode equivalent model was established. It is pointed out that the two phase legs have complementary effect of common-mode noise under bipolar PWM modulation. Due to the phase difference of the driving pulses in the real product, however, the effect of common-mode cancellation is greatly disrupted. Based on the common-mode equivalent model, a frequency domain analysis was carried out to determine the theoretical relationship between the common-mode noise intensity and the phase difference, which can guide the adjustment of the driving pulses. It was also found that the increase of switching frequency will aggravate the common-mode noise caused by the phase difference. To reduce the common-mode noise, a method that automatic calibration of the driving pulses was evaluated by a simulation and experimentally. Finally, a prototype is built, and the results of the prototype show that the proposed method can effectively reduce the common-mode noise.

physics.ins-det↗

arXiv2021

Principled Exploration via Optimistic Bootstrapping and Backward Induction

One principled approach for provably efficient exploration is incorporating the upper confidence bound (UCB) into the value function as a bonus. However, UCB is specified to deal with linear and tabular settings and is incompatible with Deep Reinforcement Learning (DRL). In this paper, we propose a principled exploration method for DRL through Optimistic Bootstrapping and Backward Induction (OB2I). OB2I constructs a general-purpose UCB-bonus through non-parametric bootstrap in DRL. The UCB-bonus estimates the epistemic uncertainty of state-action pairs for optimistic exploration. We build theoretical connections between the proposed UCB-bonus and the LSVI-UCB in a linear setting. We propagate future uncertainty in a time-consistent manner through episodic backward update, which exploits the theoretical advantage and empirically improves the sample-efficiency. Our experiments in the MNIST maze and Atari suite suggest that OB2I outperforms several state-of-the-art exploration approaches.

cs.LG↗

arXiv2021

Tackling Imbalanced Data in Cybersecurity with Transfer Learning: A Case with ROP Payload Detection

In recent years, deep learning gained proliferating popularity in the cybersecurity application domain, since when being compared to traditional machine learning, it usually involves less human effort, produces better results, and provides better generalizability. However, the imbalanced data issue is very common in cybersecurity, which can substantially deteriorate the performance of the deep learning models. This paper introduces a transfer learning based method to tackle the imbalanced data issue in cybersecurity using Return-Oriented Programming (ROP) payload detection as a case study. We achieved 0.033 average false positive rate, 0.9718 average F1 score and 0.9418 average detection rate on 3 different target domain programs using 2 different source domain programs, with 0 benign training data samples in the target domain. The performance improvement compared to the baseline is a trade-off between false positive rate and detection rate. Using our approach, the number of false positives is reduced by 23.20%, and as a trade-off, the number of detected malicious samples is reduced by 0.50%.

cs.CR↗

arXiv2021

Evolution of Anti-de Sitter black holes in Einstein-Maxwell-dilaton theory

We study the nonlinear evolution of the spherical symmetric black holes under a small neutral scalar field perturbation in Einstein-Maxwell-dilaton theory with coupling function $f(ϕ)=e^{-bϕ}$ in asymptotic anti-de Sitter spacetime. The non-minimal coupling between scalar and Maxwell fields allows the transmission of the energy from the Maxwell field to the scalar field, but also behaves as a repulsive force for the scalar. The scalar field oscillates with damping amplitude and converges to a final value by a power law. The irreducible mass of the black hole increases abruptly at initial times and then saturates to the final value exponentially. The saturating rate is twice the decaying rate of the dominant mode of the scalar. The effects of the black hole charge, the cosmological constant and the coupling parameter on the evolution are studied in detail. When the initial configuration is a naked singularity spacetime with a large charge to mass ratio, a horizon will form soon and hide the singularity.

gr-qc↗

arXiv2021

Dynamical charged black hole spontaneous scalarization in Anti-de Sitter spacetimes

We study the fully nonlinear dynamics of black hole spontaneous scalarizations in Einstein-Maxwell scalar theory with coupling function $f(ϕ)=e^{-bϕ^{2}}$, which can transform usual Reissner-Nordström Anti-de Sitter (RN-AdS) black holes into hairy black holes. Fixing the Arnowitt-Deser-Misner mass of the system, the initial scalar perturbation will destroy the original RN-AdS black hole and turn it into a hairy black hole provided that the constant $-b$ in the coupling function and the charge of the original black hole are sufficiently large, while the cosmological constant is small enough. In the scalarization process, we observe that the black hole irreducible mass initially increases exponentially, then it approaches to and finally saturates at a finite value. Choosing stronger coupling and larger black hole charge, we find that the black hole mass exponentially grows earlier and it takes a longer time for a hairy black hole to be developed and stabilized. We further examine phase structure properties in the scalarization process and confirm the observations in the non-linear dynamical study.

gr-qc↗

arXiv2021

Positive mass theorems of ALF and ALG manifolds

In this paper, we want to prove positive mass theorems for ALF and ALG manifolds with model spaces $\mathbb R^{n-1}\times \mathbb S^1$ and $\mathbb R^{n-2}\times \mathbb T^2$ respectively in dimensions no greater than $7$ (Theorem \ref{ALFPMT0}). { Different from the compatibility condition for spin structure in \cite[Theorem 2]{minerbe2008a}, we show that some type of incompressible condition for $\mathbb S^1$ and $\mathbb T^2$ is enough to guarantee the nonnegativity of the mass.} As in the asymptotically flat case, we reduce the desired positive mass theorems to those ones concerning non-existence of positive scalar curvature metrics on closed manifolds coming from generalize surgery to $n$-torus. { Finally, we investigate certain fill-in problems and obtain an optimal bound for total mean curvature of admissible fill-ins for flat product $2$-torus $\mathbb S^1(l_1)\times \mathbb S^1(l_2)$.}

math.DG↗