Bluetooth Low-Energy (BLE) beacons-based indoor positioning is a promising method for indoor positioning, especially in applications of position-based services (PbS). It has low deployment cost and it is suitable for a wide range of mobile devices. Existing BLE beacon-based positioning methods can be categorized as range-based methods and fingerprinting-based methods. For range-based methods, the positions of the beacons should be known before positioning. For fingerprinting-based methods, a pre-requisite is the reference fingerprinting map (RFM). Many existing methods focus on how to perform the positioning assuming the beacon positions or RFM are known. However, in practical applications, determining the beacon positions or RFM in the indoor environment is normally a difficult task. This paper proposed an efficient and graph optimization-based way for estimating the beacon positions and the RFM, which combines the range-based method and the fingerprinting-based method. The method exists without need for any dedicated surveying instruments. A user equipped with a BLE-enabled mobile device walks in the region collecting inertial readings and BLE received signal strength indication (RSSI) readings. The inertial measurements are processed through the pedestrian dead reckoning (PDR) method to generate the constraints at adjacent poses. In addition, the BLE fingerprints are adopted to generate constraints between poses (with similar fingerprints) and the RSSIs are adopted to generate distance constraints between the poses and the beacon positions (according to a pre-defined path-loss model). The constraints are then adopted to form a cost function with a least square structure. By minimizing the cost function, the optimal user poses at different times and the beacon positions are estimated. In addition, the RFM can be generated through the pose estimations. Experiments are carried out, which validates that the proposed method for estimating the pre-requisites (including beacon positions and the RFM). These estimated pre-requisites are of sufficient quality for both range-based and fingerprinting-based positioning.

The rapid proliferation of Android malware is challenging the classification of the Android malware family. The traditional static method for classification is easily affected by the confusion and reinforcement, while the dynamic method is expensive in computation. To solve these problems, this paper proposes an Android malware familial classification method based on Dalvik Executable (DEX) file section features. First, the DEX file is converted into RGB (Red/Green/Blue) image and plain text respectively, and then, the color and texture of image and text are extracted as features. Finally, a feature fusion algorithm based on multiple kernel learning is used for classification. In this experiment, the Android Malware Dataset (AMD) was selected as the sample set. Two different comparative experiments were set up, and the method in this paper was compared with the common visualization method and feature fusion method. The results show that our method has a better classification effect with precision, recall and F1 score reaching 0.96. Besides, the time of feature extraction in this paper is reduced by 2.999 seconds compared with the method of frequent subsequence. In conclusion, the method proposed in this paper is efficient and precise in the classification of the Android malware family.

Deep learning methods are being increasingly widely used in static malware detection field because they can summarize the feature of malware and its variants that have never appeared before. But similar to the picture recognition model, the static malware detection model based on deep learning is also vulnerable to the interference of adversarial samples. When the input feature vectors of the malware detection model is based on static features of Windows PE (Portable Executable, PE) file, the model is vulnerable to gradient-based attacks. Regarding the issue above, a method of adversarial sample generation is proposed, which can summarize the blind spots of the original detection model. However, the existing malware adversarial sample generation method is not universal and low in generation efficiency due to the need for human control and difficulty in maintaining a normal file format. In response to these problems, this paper proposes a novel method of automatic adversarial samples generation based on deep reinforcement learning. Firstly, a static PE malware detection model based on deep learning called DeepDetectNet is constructed, the original AUC of which can reach 0.989. Then, an adversarial sample generation model based on reinforcement learning called RLAttackNet is implemented, which generates malware samples that can bypass DeepDetectNet. Finally, when we re-input the adversarial samples into the previously trained DeepDetectNet, the original defects of DeepDetectNet can be reinforced. Experimental results show that the RLAttackNet proposed in this paper can generate about 19.13% of malware samples bypass DeepDetectNet. When DeepDetectNet is retrained with these adversarial samples, the AUC value improves from 0.989 to 0.996 and attack success rate has a significant drop, from 19.13% to 3.1%, compared with the original model.

With the rapid advances of anti-virus and anti-tracking technologies, three aspects in malware clustering need to be improved for effective clustering, i.e., the robustness of features, the accuracy of similarity measurements, and the effectiveness of clustering algorithms. In this paper, we propose a novel malware family clustering approach based on dynamic and static features with their weights. In this approach, we employ a new similarity measurement method based on EMD to improve the accuracy of feature similarities. In addition, to reduce convergence time and improve clustering purity, we design a novel semi-supervised clustering algorithm, termed as S-DBSCAN by involving supervision information into the original algorithm known as Density-Based Spatial Clustering of Applications with Noise (DBSCAN). The experimental results demonstrate that the proposed approach can correctly and accurately distinguish the samples among various families and achieve outperformed purity with 98.7%.