Function Similarity Using Family Context

Finding changed and similar functions between a pair of binaries is an important problem in malware attribution and for the identification of new malware capabilities. This paper presents a new technique called Function Similarity using Family Context (FSFC) for this problem. FSFC trains a Support Vector Machine (SVM) model using pairs of similar functions from two program variants. This method improves upon previous research called Cross Version Contextual Function Similarity (CVCFS) e epresenting a function using features extracted not just from the function itself, but also, from other functions with which it has a caller and callee relationship. We present the results of an initial experiment that shows that the use of additional features from the context of a function significantly decreases the false positive rate, obviating the need for a separate pass for cleaning false positives. The more surprising and unexpected finding is that the SVM model produced by FSFC can abstract function similarity features from one pair of program variants to find similar functions in an unrelated pair of program variants. If validated by a larger study, this new property leads to the possibility of creating generic similar function classifiers that can be packaged and distributed in reverse engineering tools such as IDA Pro and Ghidra.

Distinguishing the Impact of Age on Semantic and Nonsemantic Associations in Episodic Memory

Objectives Refreshing, or the act of briefly foregrounding recently presented but now perceptually absent representations, has been identified as a possible source of age differences in working memory and episodic memory. We investigated whether the refreshing deficit contributes to the well-known age-related deficit for retrieving nonsemantic associations, but has no impact on existing semantic associations. Method Younger and older adults judged the relatedness of stimulus word pairs (e.g., pink–blue or pink–cop) after repeating or refreshing one of the words. During a later source recognition memory test, participants determined whether each item recognized as old was presented on the left or right (nonsemantic source memory) and presented in a related or unrelated pair (semantic source memory). The data were analyzed using a hierarchical Bayesian implementation of a multinomial model of multidimensional source memory. Results Neither age group exhibited a refreshing benefit to nonsemantic or semantic source memory parameters. There was a large age difference in nonsemantic source memory, but no age difference in semantic source memory. Discussion The study suggests that the nature of the association is most important to episodic memory performance in older age, irrespective of refreshing, such that source memory is unimpaired for semantically meaningful information.

Juvenile dispersal in Gray Jays: dominant brood member expels siblings from natal territory

Breeding pairs of Gray Jays (Perisoreus canadensis) in Quebec and Ontario were accompanied in the autumn significantly more often by one nonbreeder, and less often by none or two, than expected from initial brood size frequencies. Among the rare cases of two nonbreeders accompanying a pair, there was no evidence that both were from the same brood. These observations, and the fact that 30.6% of single nonbreeders closely associated with autumn pairs of known, same-year breeding history were unrelated to those adults, indicated the division of juvenile Gray Jays into "stayers," which remained with their parents at no more than one per pair, and "leavers," which left their natal territory and sometimes joined an unrelated pair. The weight distribution of 62 stayers indicated that about two-thirds were males. Leavers had a more equal sex ratio and showed a strong tendency to associate with failed breeders. Stayers apparently had much higher first-summer survival than leavers but no significant chance to inherit their natal territory. Gray Jay broods broke up in June, through intrabrood aggression, when the young were 55–65 days old. Stayers were the dominant juveniles that forced out the leavers. Partial June dispersal may function as a type of brood reduction that permits the dominant juvenile to have exclusive access to a parental subsidy of stored food that is reliably adequate for the survival of only one extra bird on the territory. The best models describing the origin and winter acquisition of such a subsidy postulate recovery of stored food by memory and require that the expulsion of subordinate siblings occur at the beginning of the food storage season. The models predict that food stored by Gray Jays in June survives in significant enough quantities to enhance winter survival.