arXiv subjects

Irfan Ahmed

Publications and source records attributed to Irfan Ahmed.

11 recordsLinked to original sources

arXiv2026

What You See Is Not What You Execute: Memory-Based Runtime SBOM Generation for Supply Chain Security

Modern software development relies heavily on third-party components from public repositories, expanding the software supply chain attack surface. In response to these growing risks, federal initiatives have advanced the Software Bill of Materials (SBOM) as a standardized mechanism for improving transparency by describing software components, dependencies, and their relationships. However, SBOMs built from metadata or filesystem artifacts fail to capture the components loaded and executed at runtime, especially in dynamic ecosystems such as Python. Moreover, generating runtime SBOMs through instrumentation requires monitoring to be deployed in advance and the system to remain observable throughout execution. Such conditions are difficult to satisfy in production environments and incident-response scenarios. Volatile memory, in contrast, provides a reliable source for recovering the actual runtime state of a running application without requiring prior instrumentation. Therefore, this paper presents MEM-SBOM, the first memory forensics framework that generates SBOMs directly from the runtime state of Python applications. It recovers the modules from the interpreter's internal structures, resolves package versions, and analyzes bytecode to build dependency graphs and identify vulnerable functions. We implemented MEM-SBOM as a suite of Volatility 3 plugins and evaluated it against 51 real-world Python applications. It achieves 100% extraction accuracy, identifies Streamlit as the only application that calls the vulnerable routines of the tornado dependency, and recovers all runtime packages missed by existing SBOM tools, providing more accurate dependency graphs and better vulnerability assessment. These capabilities make MEM-SBOM a practical foundation for software supply chain security and incident response by providing a forensically sound runtime view of what is executed on a system.

cs.CR↗

arXiv2026

Another Perspective on Chatterjea Contraction

Inspired by the well-known result stating that if any iterate of a mapping is a Banach contraction on a complete metric space, then the mapping itself possesses a unique fixed point, we investigate that claim for a Chatterjea contraction but by retaining the left-hand side of the inequality as per the mapping itself. With an additional assumption of k- continuity, the existence and uniqueness of a fixed point is obtained for a new class of contractions, m-Chatterjea contraction, on a complete metric space. Several examples are given in order to substantiate many theoretical claims such as discontinuity at the unique limit point of the iterative sequence, as well as examples demonstrating that this new class strictly contains the class of Chatterjea mappings.

math.FA↗

arXiv2026

Memory Forensics Techniques for Automated Detection and Analysis of Go Malware

The Go programming language has become increasingly popular among malware developers due to its ability to produce statically linked, cross-platform executables that challenge traditional analysis techniques. These binaries embed a substantial runtime and compiler-generated metadata and are compiled with aggressive optimizations that discard type information for function parameters and local variables. Go's design further complicates analysis by representing strings as pointer-length pairs rather than null-terminated sequences, employing a caller-allocated stack model that obscures argument boundaries, and fragmenting program state across concurrent goroutines. Although existing static analysis and reverse engineering tools provide Go-specific support, they remain limited to compile-time artifacts and cannot recover runtime execution state and artifacts that persist solely in memory. To address this gap, we present the first memory forensics framework for runtime analysis of Go binaries. By parsing Go's internal structures, our framework reconstructs type and function metadata, recovers heap-allocated and static strings, and distinguishes application-level functions. Through ABI-aware backward analysis, it derives execution paths and argument values from call sites. To capture runtime state beyond what static analysis reveals, it analyzes goroutine stacks to identify actively executing functions and recover their runtime argument values. We implemented all capabilities as Volatility 3 plugins and evaluated them against malware seen in recent incidents, such as the BRICKSTORM backdoor, Obscura ransomware, and Pantegana RAT, as well as open-source samples for reproducibility. The framework successfully recovered C2 endpoints, persistence mechanisms, encryption keys, ransom notes, and execution state, including critical runtime artifacts that were absent from published threat intelligence.

cs.CR↗

arXiv2025

Some Fixed Point Theorems in $(α,β)$- Metric Spaces with applications to Fredholm integral and non-linear differential equations

In this paper, we presented a new type of metric space called $(α,β)$-metric space along with some novel contraction mappings named $(α,β)$-contraction and weak $(α,β)$-contraction mapping. We established some fixed point theorem for these newly introduced contractive mappings. Our results extended some fixed point results in the existing literature. We also provide an example which holds for the weak $(α,β)$-contraction. Furthermore, we proved Kannan's fixed point theorem and Reich's fixed point theorem in the setting of $(α,β)$-metric spaces. At the end, as applications the Fredholm integral and non-linear differential equations are solved in order to validate the theoretically obtained conclusions

math.FA↗

arXiv2024

Optimal Synthesis of Finite State Machines with Universal Gates using Evolutionary Algorithm

This work presents an optimization method for the synthesis of finite state machines. The focus is on the reduction in the on-chip area and the cost of the circuit. A list of finite state machines from MCNC91 benchmark circuits have been evolved using Cartesian Genetic Programming. On the average, almost 30% of reduction in the total number of gates has been achieved. The effects of some parameters on the evolutionary process have also been discussed in the paper.

cs.NE↗

arXiv2019

A Criterion to identify maximally entangled nine-qubit state

We present a generalized criterion for maximally entangled nine-qubit states, whose minimum averaged subsystem purity should be equal to 1/14. In this note, we prove that absolutely maximally entangled state for nine qubits does not exist. Further, we construct a new genuine nine-qubit maximally entangled states of 110,15 and 1 balanced purities equal to 1/16, , 1/8 and and 1/4, respectively. We found that, the marginal density matrices for subsystems of 1,2,3- qubits all completely mixed in these states, therefore, maximally entangled nine-qubit state is a 3-uniform state.

quant-ph↗

arXiv2018

SIT: A Lightweight Encryption Algorithm for Secure Internet of Things

The Internet of Things (IoT) being a promising technology of the future is expected to connect billions of devices. The increased number of communication is expected to generate mountains of data and the security of data can be a threat. The devices in the architecture are essentially smaller in size and low powered. Conventional encryption algorithms are generally computationally expensive due to their complexity and requires many rounds to encrypt, essentially wasting the constrained energy of the gadgets. Less complex algorithm, however, may compromise the desired integrity. In this paper we propose a lightweight encryption algorithm named as Secure IoT (SIT). It is a 64-bit block cipher and requires 64-bit key to encrypt the data. The architecture of the algorithm is a mixture of feistel and a uniform substitution-permutation network. Simulations result shows the algorithm provides substantial security in just five encryption rounds. The hardware implementation of the algorithm is done on a low cost 8-bit micro-controller and the results of code size, memory utilization and encryption/decryption execution cycles are compared with benchmark encryption algorithms. The MATLAB code for relevant simulations is available online at https://goo.gl/Uw7E0W.

cs.CR↗

arXiv2016

Forensic Acquisition of Cloud Drives

Cloud computing and cloud storage services, in particular, pose a new challenge to digital forensic investigations. Currently, evidence acquisition for such services still follows the traditional method of collecting artifacts on a client device. This approach requires labor-intensive reverse engineering efforts, and ultimately results in an acquisition that is inherently incomplete. Specifically, it makes the incorrect assumption that all storage content for an account is fully replicated on the client; further, there are no means to acquire historical data in the form of document revisions, nor is there a way to acquire cloud-native artifacts, such as Google Docs. In this work, we introduce the concept of API-based evidence acquisition for cloud services, which addresses these concerns by utilizing the officially supported API of the service. To demonstrate the utility of this approach, we present a proof-of-concept acquisition tool, kumodd, which can acquire evidence from four major cloud drive providers: Google Drive, Microsoft OneDrive, Dropbox, and Box. The implementation provides both command-line and web user interfaces, and can be readily incorporated into established forensic processes.

cs.CR↗

arXiv2015

Scaling up for high dimensional and high speed data streams: HSDStream

This paper presents a novel high speed clustering scheme for high dimensional data streams. Data stream clustering has gained importance in different applications, for example, in network monitoring, intrusion detection, and real-time sensing are few of those. High dimensional stream data is inherently more complex when used for clustering because the evolving nature of the stream data and high dimensionality make it non-trivial. In order to tackle this problem, projected subspace within the high dimensions and limited window sized data per unit of time are used for clustering purpose. We propose a High Speed and Dimensions data stream clustering scheme (HSDStream) which employs exponential moving averages to reduce the size of the memory and speed up the processing of projected subspace data stream. The proposed algorithm has been tested against HDDStream for cluster purity, memory usage, and the cluster sensitivity. Experimental results have been obtained for corrected KDD intrusion detection dataset. These results show that HSDStream outperforms the HDDStream in all performance metrics, especially the memory usage and the processing speed.

cs.DB↗

arXiv2015

3-Uniform states and orthogonal arrays

In a recent paper (Phys. Rev. A 90, 022316 (2014) ), Goyeneche et al. established a link between the combinatorial notion of orthogonal arrays and k-uniform states and present open issue. (B) Find for what N there are 3-uniform states of N-qubits. In this paper, we demonstrate the existence of 3-uniform states of N-qubits for N=11,..,15".

quant-ph↗

arXiv2015

Design and Implementation of Performance Metrics for Evaluation of Assessments Data

The objective of this paper is to design performance metrics and respective formulas to quantitatively evaluate the achievement of set objectives and expected outcomes both at the course and program levels. Evaluation is defined as one or more processes for interpreting the data acquired through the assessment processes in order to determine how well the set objectives and outcomes are being attained. Even though assessment processes for accreditation are well documented but existence of an evaluation process is assumed. This paper focuses on evaluation process to provide insights and techniques for data interpretation. It gives a complete evaluation process from the data collection through various assessment methods, performance metrics, to the presentations in the form of tables and graphs. Authors hope that the articulated description of evaluation formulas will help convergence to high quality standard in evaluation process.

physics.ed-ph↗