Results 1  10
of
12
A Survey of Combinatorial Gray Codes
 SIAM Review
, 1996
"... The term combinatorial Gray code was introduced in 1980 to refer to any method for generating combinatorial objects so that successive objects differ in some prespecified, small way. This notion generalizes the classical binary reflected Gray code scheme for listing nbit binary numbers so that ..."
Abstract

Cited by 99 (2 self)
 Add to MetaCart
The term combinatorial Gray code was introduced in 1980 to refer to any method for generating combinatorial objects so that successive objects differ in some prespecified, small way. This notion generalizes the classical binary reflected Gray code scheme for listing nbit binary numbers so that successive numbers differ in exactly one bit position, as well as work in the 1960's and 70's on minimal change listings for other combinatorial families, including permutations and combinations. The area of combinatorial Gray codes was popularized by Herbert Wilf in his invited address at the SIAM Discrete Mathematics Conference in 1988 and his subsequent SIAM monograph in which he posed some open problems and variations on the theme. This resulted in much recent activity in the area and most of the problems posed by Wilf are now solved. In this paper, we survey the area of combinatorial Gray codes, describe recent results, variations, and trends, and highlight some open problems. ...
Smashing the Gadgets: Hindering ReturnOriented Programming Using InPlace Code Randomization
"... Abstract—The wide adoption of nonexecutable page protections in recent versions of popular operating systems has given rise to attacks that employ returnoriented programming (ROP) to achieve arbitrary code execution without the injection of any code. Existing defenses against ROP exploits either r ..."
Abstract

Cited by 49 (7 self)
 Add to MetaCart
(Show Context)
Abstract—The wide adoption of nonexecutable page protections in recent versions of popular operating systems has given rise to attacks that employ returnoriented programming (ROP) to achieve arbitrary code execution without the injection of any code. Existing defenses against ROP exploits either require source code or symbolic debugging information, or impose a significant runtime overhead, which limits their applicability for the protection of thirdparty applications. In this paper we present inplace code randomization, a practical mitigation technique against ROP attacks that can be applied directly on thirdparty software. Our method uses various narrowscope code transformations that can be applied statically, without changing the location of basic blocks, allowing the safe randomization of stripped binaries even with partial disassembly coverage. These transformations effectively eliminate about 10%, and probabilistically break about 80 % of the useful instruction sequences found in a large set of PE files. Since no additional code is inserted, inplace code randomization does not incur any measurable runtime overhead, enabling it to be easily used in tandem with existing exploit mitigations such as address space layout randomization. Our evaluation using publicly available ROP exploits and two ROP code generation toolkits demonstrates that our technique prevents the exploitation of the tested vulnerable Windows 7 applications, including Adobe Reader, as well as the automated construction of alternative ROP payloads that aim to circumvent inplace code randomization using solely any remaining unaffected instruction sequences. I.
Generating Linear Extensions Fast
"... One of the most important sets associated with a poset P is its set of linear extensions, E(P) . "ExtensionFast.html" 87 lines, 2635 characters One of the most important sets associated with a poset P is its set of linear extensions, E(P) . In this paper, we present an algorithm to generat ..."
Abstract

Cited by 46 (6 self)
 Add to MetaCart
One of the most important sets associated with a poset P is its set of linear extensions, E(P) . "ExtensionFast.html" 87 lines, 2635 characters One of the most important sets associated with a poset P is its set of linear extensions, E(P) . In this paper, we present an algorithm to generate all of the linear extensions of a poset in constant amortized time; that is, in time O(e(P)) , where e ( P ) =  E(P) . The fastest previously known algorithm for generating the linear extensions of a poset runs in time O(n e(P)) , where n is the number of elements of the poset. Our algorithm is the first constant amortized time algorithm for generating a ``naturally defined'' class of combinatorial objects for which the corresponding counting problem is #Pcomplete. Furthermore, we show that linear extensions can be generated in constant amortized time where each extension differs from its predecessor by one or two adjacent transpositions. The algorithm is practical and can be modified to efficiently count linear extensions, and to compute P(x < y) , for all pairs x,y , in time O( n^2 + e ( P )).
Generating Linear Extensions of Posets by Transpositions
 J. Combinatorial Theory (B
, 1992
"... This paper considers the problem of listing all linear extensions of a partial order so that successive extensions differ by the transposition of a single pair of elements. A necessary condition is given for the case when the partial order is a forest. A necessary and sufficient condition is given f ..."
Abstract

Cited by 27 (2 self)
 Add to MetaCart
This paper considers the problem of listing all linear extensions of a partial order so that successive extensions differ by the transposition of a single pair of elements. A necessary condition is given for the case when the partial order is a forest. A necessary and sufficient condition is given for the case where the partial order consists of disjoint chains. Some open problems are mentioned. 1 Introduction Many combinatorial objects can be represented by permutations subject to various restrictions. The set of linear extensions of a poset can be viewed as a set of permutations of the elements of the poset. If the Hasse diagram of the poset consists of two disjoint chains, then the linear extension permutations correspond to combinations. If the poset consists of disjoint chains, then the linear extension permutations correspond to multiset permutations. The extensions of the poset that is the product of a 2element chain with an nelement chain correspond to "ballot sequences" of ...
Evolution on distributive lattices
 J Theor Biol
"... Abstract. We consider the directed evolution of a population after an intervention that has significantly altered the underlying fitness landscape. We model the space of genotypes as a distributive lattice; the fitness landscape is a realvalued function on that lattice. The risk of escape from inte ..."
Abstract

Cited by 12 (6 self)
 Add to MetaCart
(Show Context)
Abstract. We consider the directed evolution of a population after an intervention that has significantly altered the underlying fitness landscape. We model the space of genotypes as a distributive lattice; the fitness landscape is a realvalued function on that lattice. The risk of escape from intervention, i.e., the probability that the population develops an escape mutant before extinction, is encoded in the risk polynomial. Tools from algebraic combinatorics are applied to compute the risk polynomial in terms of the fitness landscape. In an application to the development of drug resistance in HIV, we study the risk of viral escape from treatment with the protease inhibitors ritonavir and indinavir.
Replaying play in and play out: Synthesis of design models from scenarios by learning
 Proceedings of the 13 th International Conference on Tools and Algorithms for Construction and Analysis of Systems (TACAS’07
, 2007
"... Abstract. This paper is concerned with bridging the gap between requirements, provided as a set of scenarios, and conforming design models. The novel aspect of our approach is to exploit learning for the synthesis of design models. In particular, we present a procedure that infers a messagepassing ..."
Abstract

Cited by 10 (5 self)
 Add to MetaCart
(Show Context)
Abstract. This paper is concerned with bridging the gap between requirements, provided as a set of scenarios, and conforming design models. The novel aspect of our approach is to exploit learning for the synthesis of design models. In particular, we present a procedure that infers a messagepassing automaton (MPA) from a given set of positive and negative scenarios of the system’s behavior provided as message sequence charts (MSCs). The paper investigates which classes of regular MSC languages and corresponding MPA can (not) be learned, and presents a dedicated tool based on the learning library LearnLib that supports our approach. 1
Partial Order Bounding: A new Approach to Evaluation in Game Tree Search
"... In computer gameplaying, the established method for constructing an evaluation function uses a scalar value computed as a weighted sum of features. This paper advocates the use of partial order evaluation, and describes an ecient new search method called partial order bounding (POB). Previous tree ..."
Abstract

Cited by 10 (5 self)
 Add to MetaCart
In computer gameplaying, the established method for constructing an evaluation function uses a scalar value computed as a weighted sum of features. This paper advocates the use of partial order evaluation, and describes an ecient new search method called partial order bounding (POB). Previous tree search algorithms using a partial order evaluation have attempted to propagate partially ordered values through the search tree, which leads to many problems in practice, such as the complexity of backing up sets of incomparable evaluations. POB compares partially ordered values only in the leaves of a game tree, and backs up boolean values through the tree. A closely related new algorithm, linear extension partial order bounding (LEPOB), uses a standard scalar alphabeta search with values from a suitably chosen linear extension of the partial order evaluation. As an application, the eectiveness of partial order evaluation is shown in the case of modeling capturing races called semeai in ...
Test Case Generation using Model Transformations
, 2009
"... anderen als die angegebenen Quellen und Hilfsmittel verwendet habe. ..."
Abstract

Cited by 1 (0 self)
 Add to MetaCart
(Show Context)
anderen als die angegebenen Quellen und Hilfsmittel verwendet habe.
Chapter 9 Practical Software Diversification Using InPlace Code Randomization
"... Abstract The wide adoption of nonexecutable page protections has given rise to attacks that employ returnoriented programming (ROP) to achieve arbitrary code execution without the injection of any code. Existing defenses against ROP exploits either require source code or symbolic debugging informa ..."
Abstract
 Add to MetaCart
(Show Context)
Abstract The wide adoption of nonexecutable page protections has given rise to attacks that employ returnoriented programming (ROP) to achieve arbitrary code execution without the injection of any code. Existing defenses against ROP exploits either require source code or symbolic debugging information, or impose a significant runtime overhead, which limits their applicability for the protection of thirdparty applications. Aiming for a practical mitication against ROP attacks, we introduce inplace code randomization, a software diversification technique that can be applied directly on thirdparty software. Our method uses various narrowscope code transformations that can be applied statically, without changing the location of basic blocks, allowing the safe randomization of stripped binaries even with partial disassembly coverage. We demonstrate how inplace code randomization can prevent the exploitation of vulnerable Windows 7 applications, including Adobe Reader, as well as the automated construction of reliable ROP payloads. Attack prevention technologies based on the No eXecute (NX) memory page protection
AND
"... Oxford University Press is a department of the University of Oxford. It furthers the University’s objective of excellence in research, scholarship, and education by publishing worldwide in ..."
Abstract
 Add to MetaCart
Oxford University Press is a department of the University of Oxford. It furthers the University’s objective of excellence in research, scholarship, and education by publishing worldwide in