Selected work

Representative Papers

Impact of File-Open Hook Points on Backup Ratio in ROFBS on XFS

Mar 17, 2026

This study addresses the limitations of existing real-time backup mechanisms against ransomware, which often fail due to suboptimal placement of file-open hooks, allowing attackers to encrypt files during detection delays. Without altering the underlying ROFBS framework, the authors present the first systematic quantitative evaluation of five kernel hook points—may_open, inode_permission, do_dentry_open, security_file_open, and xfs_file_open—along the Linux file-open path under the XFS filesystem, assessing their impact on backup ratio and encryption scope. Empirical experiments on AlmaLinux employ three ransomware families: AvosLocker, Conti, and IceFire. Results demonstrate that xfs_file_open achieves the highest backup ratios (100.0% for Conti and 63.2% for IceFire) while consistently minimizing the total number of encrypted files; security_file_open performs best against AvosLocker (82.5%), underscoring the critical defensive value of filesystem-layer hooks.

0 citationsRead paper

Impact of arbitrage between leveraged ETF and futures on market liquidity during market crash

Mar 06, 2026

This study investigates the mechanism through which arbitrage between leveraged ETFs and futures influences cross-market liquidity during market crashes. Using an agent-based artificial market simulation, the authors construct an interactive trading environment that, for the first time, systematically reveals a dynamic two-way liquidity transmission mechanism driven by arbitrage under extreme market conditions: when a liquidity shock triggered by erroneous orders disrupts one market, the other market mitigates the impact by supplying depth and price tightness, with trading volumes exhibiting significant co-movement. The findings highlight the critical role of arbitrage in stabilizing cross-market liquidity and offer a novel perspective on market resilience during extreme events.

0 citationsRead paper

Is an investor stolen their profits by mimic investors? Investigated by an agent-based model

Mar 03, 2026

This study investigates whether strategy homogenization erodes returns for original investors, addressing ongoing debates about the market impact of imitation behavior. By constructing an extended agent-based artificial financial market model that incorporates adjustable proportions of fundamentalist and technical traders, the paper provides the first empirical examination of how strategy imitation differentially affects the returns of distinct investor types. The findings reveal that while an increase in fundamentalist imitators enhances price stability, it simultaneously reduces their own returns; conversely, a growing population of technical imitators amplifies price volatility yet boosts their profitability. These results uncover an asymmetric return mechanism between the two strategies under group expansion, offering novel evidence for understanding the risks associated with market homogenization.

0 citationsRead paper

Analysis of the Impact of an Execution Algorithm with an Order Book Imbalance Strategy on a Financial Market Using an Agent-based Simulation

Sep 21, 2025

This paper addresses the insufficient robustness of order execution algorithms in financial markets by proposing and systematically evaluating an order-book imbalance (OBI)-based execution strategy. Using a multi-agent simulation framework, we construct controlled artificial markets to comparatively assess OBI-aware versus OBI-agnostic execution algorithms—enabling, for the first time, systematic empirical evaluation of OBI-driven execution under three distinct market regimes: stable, volatile, and manipulative (e.g., spoofing). Results demonstrate that OBI-based strategies significantly outperform conventional approaches under price instability and manipulation, exhibiting strong robustness; in stable markets, performance hinges critically on order slicing design. This work fills a critical gap in empirically validating OBI strategies within dynamic, adversarial market environments and provides interpretable, transferable theoretical foundations and practical guidance for designing intelligent execution algorithms.

0 citationsRead paper

Evasive Ransomware Attacks Using Low-level Behavioral Adversarial Examples

Aug 12, 2025

This work addresses behavioral-level vulnerabilities in AI-driven cybersecurity defense systems by introducing the novel concept of low-level behavioral adversarial examples and establishing an evasion-oriented threat model targeting ransomware. Unlike conventional pixel-level perturbations, our approach operates at the source-code level to modulate fine-grained malicious behavioral features—such as thread scheduling, file encryption ratio, and post-encryption delay—while preserving semantic functionality, and leverages adversarial optimization to generate evasive variants. Empirical evaluation on the Conti ransomware codebase demonstrates that our method significantly reduces detection rates across mainstream deep learning–based detectors. This study constitutes the first systematic demonstration of the practical feasibility and severity of behavioral-level adversarial attacks against AI security systems, thereby providing critical theoretical foundations and empirical evidence for robustness modeling and defensive mechanism design.

0 citationsRead paper

Recent publications

Latest Papers

Impact of File-Open Hook Points on Backup Ratio in ROFBS on XFS

Mar 17, 2026

This study addresses the limitations of existing real-time backup mechanisms against ransomware, which often fail due to suboptimal placement of file-open hooks, allowing attackers to encrypt files during detection delays. Without altering the underlying ROFBS framework, the authors present the first systematic quantitative evaluation of five kernel hook points—may_open, inode_permission, do_dentry_open, security_file_open, and xfs_file_open—along the Linux file-open path under the XFS filesystem, assessing their impact on backup ratio and encryption scope. Empirical experiments on AlmaLinux employ three ransomware families: AvosLocker, Conti, and IceFire. Results demonstrate that xfs_file_open achieves the highest backup ratios (100.0% for Conti and 63.2% for IceFire) while consistently minimizing the total number of encrypted files; security_file_open performs best against AvosLocker (82.5%), underscoring the critical defensive value of filesystem-layer hooks.

0 citationsRead paper

Impact of arbitrage between leveraged ETF and futures on market liquidity during market crash

Mar 06, 2026

This study investigates the mechanism through which arbitrage between leveraged ETFs and futures influences cross-market liquidity during market crashes. Using an agent-based artificial market simulation, the authors construct an interactive trading environment that, for the first time, systematically reveals a dynamic two-way liquidity transmission mechanism driven by arbitrage under extreme market conditions: when a liquidity shock triggered by erroneous orders disrupts one market, the other market mitigates the impact by supplying depth and price tightness, with trading volumes exhibiting significant co-movement. The findings highlight the critical role of arbitrage in stabilizing cross-market liquidity and offer a novel perspective on market resilience during extreme events.

0 citationsRead paper

Is an investor stolen their profits by mimic investors? Investigated by an agent-based model

Mar 03, 2026

This study investigates whether strategy homogenization erodes returns for original investors, addressing ongoing debates about the market impact of imitation behavior. By constructing an extended agent-based artificial financial market model that incorporates adjustable proportions of fundamentalist and technical traders, the paper provides the first empirical examination of how strategy imitation differentially affects the returns of distinct investor types. The findings reveal that while an increase in fundamentalist imitators enhances price stability, it simultaneously reduces their own returns; conversely, a growing population of technical imitators amplifies price volatility yet boosts their profitability. These results uncover an asymmetric return mechanism between the two strategies under group expansion, offering novel evidence for understanding the risks associated with market homogenization.

0 citationsRead paper

Analysis of the Impact of an Execution Algorithm with an Order Book Imbalance Strategy on a Financial Market Using an Agent-based Simulation

Sep 21, 2025

This paper addresses the insufficient robustness of order execution algorithms in financial markets by proposing and systematically evaluating an order-book imbalance (OBI)-based execution strategy. Using a multi-agent simulation framework, we construct controlled artificial markets to comparatively assess OBI-aware versus OBI-agnostic execution algorithms—enabling, for the first time, systematic empirical evaluation of OBI-driven execution under three distinct market regimes: stable, volatile, and manipulative (e.g., spoofing). Results demonstrate that OBI-based strategies significantly outperform conventional approaches under price instability and manipulation, exhibiting strong robustness; in stable markets, performance hinges critically on order slicing design. This work fills a critical gap in empirically validating OBI strategies within dynamic, adversarial market environments and provides interpretable, transferable theoretical foundations and practical guidance for designing intelligent execution algorithms.

0 citationsRead paper

Evasive Ransomware Attacks Using Low-level Behavioral Adversarial Examples

Aug 12, 2025

This work addresses behavioral-level vulnerabilities in AI-driven cybersecurity defense systems by introducing the novel concept of low-level behavioral adversarial examples and establishing an evasion-oriented threat model targeting ransomware. Unlike conventional pixel-level perturbations, our approach operates at the source-code level to modulate fine-grained malicious behavioral features—such as thread scheduling, file encryption ratio, and post-encryption delay—while preserving semantic functionality, and leverages adversarial optimization to generate evasive variants. Empirical evaluation on the Conti ransomware codebase demonstrates that our method significantly reduces detection rates across mainstream deep learning–based detectors. This study constitutes the first systematic demonstration of the practical feasibility and severity of behavioral-level adversarial attacks against AI security systems, thereby providing critical theoretical foundations and empirical evidence for robustness modeling and defensive mechanism design.

0 citationsRead paper