Antivirus Research Articles

Early Detection of Windows Cryptographic Ransomware Based on Pre-Attack API Calls Features and Machine Learning

Ransomware attacks are currently one of cybersecurity's greatest and most alluring threats. Antivirus software is frequently ineffective against zero-day malware and ransomware attacks; consequently, significant network infections could result in substantial data loss. Such attacks are also becoming more dynamic and capable of altering their signatures, resulting in a race to the bottom regarding weaponry. Cryptographic ransomware exploits crypto-viral extortion techniques. The malware encrypts the victim's data and demands payment in exchange. The attacker would release the data decryption key after accepting payment. After data encryption, the user has two options: pay the ransom or lose the data. Cryptographic ransomware causes damage that is nearly impossible to undo. Detection at an early stage of a ransomware attack's lifecycle is vital for preventing unintended consequences for the victim. Most ransomware detection technologies concentrate on detection during encryption and post-attack stages. Due to the absence of early behaviour signs, it is challenging to detect ransomware before it begins the unwanted process of mass file encryption. This study examines the relationship between API calls pattern and their nature to determine whether it is ransomware early behaviour. The purpose of this paper is to determine whether this technique can be used to early detect the presence of ransomware activity on a Windows endpoint. 582 ransomware samples that consist of ten ransomware families and 942 benign software samples were analysed. This study proposed RENTAKA, a novel framework for the early detection of cryptographic ransomware. It makes use of characteristics acquired from ransomware behaviour and machine learning. This study presented an algorithm to generate a ransomware pre-encryption dataset. This study, which includes six machine-learning models, gives satisfactory results in detecting cryptographic ransomware. The features used in this research were among the 232 features identified in Windows API calls. Five standard machine learning classifiers were employed in this experiment: Naive Bayes, k-nearest neighbours (kNN), Support Vector Machines (SVM), Random Forest, and J48. In our tests, SVM fared the best, with an accuracy rate of 93.8% and an area under the curve (AUC) of 0.979, respectively. The results indicate that we can distinguish ransomware from benign applications with low false-positive and false-negative rates.

Identifying Malware Packers through Multilayer Feature Engineering in Static Analysis

This research addresses a critical need in the ongoing battle against malware, particularly in the form of obfuscated malware, which presents a formidable challenge in the realm of cybersecurity. Developing effective antivirus (AV) solutions capable of combating packed malware remains a crucial endeavor. Packed malicious programs employ encryption and advanced techniques to obfuscate their payloads, rendering them elusive to AV scanners and security analysts. The introduced research presents an innovative malware packer classifier specifically designed to adeptly identify packer families and detect unknown packers in real-world scenarios. To fortify packer identification performance, we have curated a meticulously crafted dataset comprising precisely packed samples, enabling comprehensive training and validation. Our approach employs a sophisticated feature engineering methodology, encompassing multiple layers of analysis to extract salient features used as input to the classifier. The proposed packer identifier demonstrates remarkable accuracy in distinguishing between known and unknown packers, while also ensuring operational efficiency. The results reveal an impressive accuracy rate of 99.60% in identifying known packers and 91% accuracy in detecting unknown packers. This novel research not only significantly advances the field of malware detection but also equips both cybersecurity practitioners and AV engines with a robust tool to effectively counter the persistent threat of packed malware.

Malware Detection of Portable Executable Using Machine Learning and Neural Networks

Abstract: Among the more well-known types of automatic detection technology, malware detection includes detection and protection methods against viruses caused by viruses, worms, Trojan horses, spyware, and various types of malicious code. Failure to find a malware program at its inception leaves a space where it will send a significant threat and value to online security not only for individuals, organizations but also the community and the nation. And it seems that antivirus software may fail to detect viruses if it is not updated on a website with an anti-virus engine. The great struggle is to find a new virus because when it encounters new malware behavior, it takes a series of steps based on established law. If the rule of law determines thatthe new behavior is safe the virus remains undetected

Malware Detection of Portable Executable Using Machine Learning and Neural Networks

Abstract: Among the more well-known types of automatic detection technology, malware detection includes detection and protection methods against viruses caused by viruses, worms, Trojan horses, spyware, and various types of malicious code. Failure to find a malware program at its inception leaves a space where it will send a significant threat and value to online security not only for individuals, organizations but also the community and the nation. And it seems that antivirus software may fail to detect viruses if it is not updated on a website with an anti-virus engine. The great struggle is to find a new virus because when it encounters new malware behavior, it takes a series of steps based on established law. If the rule of law determines thatthe new behavior is safe the virus remains undetected.

Using 3D-VGG-16 and 3D-Resnet-18 deep learning models and FABEMD techniques in the detection of malware

Currently, the detection of malware to prevent cybersecurity breaches is a raising a concern for millions of people around the globe. Even with the most recent updates, antivirus software can leave computer users vulnerable to malware threats and attacks due to the rapid release of new malware. As a result, conventional antivirus software is frequently incapable of identifying novel forms of malware until their unique signatures have been added to the software's database. To protect systems, there is necessity in the current technology field to develop innovative techniques for detecting unidentified malware, particularly during the initial phases of malware deployment. The objective is to address the issue of imbalanced and inadequate malware dataset through the utilization of the fast and adaptive bidirectional empirical mode decomposition (FABEMD) technique. While exploring the Malimg and MaleVis datasets, promising results were reached in reference to accuracy, precision, recall, and F1-score. The experiment demonstrated the accuracy of two distinct 3D architectures, namely 3D VGG-16 and 3D Resnet-18, on two separate datasets: Malimg dataset and MaleVis dataset. The accuracy achieved for VGG-16 was 96.14% and 98.60% for the Malimg and the MaleVis dataset, respectively. In regards to the Resnet-18 architecture, it demonstrated high accuracy rates of 99.64% and 99.46% for the Malimg and MaleVis datasets, respectively.

Improving network data security interaction methods under wireless communication

AbstractWith the development of information technology, network data security issues have received widespread attention. Under traditional wired communication networks, it not only has high installation and maintenance costs, requires a lot of manpower and resources, but also has low security performance, which is not significant in improving network data security. How to improve network data security, prevent data from being maliciously leaked, stolen, and effectively transmitted in the network, is a major challenge facing today's society. Wireless communication technology has brought new ideas to improve network data security. This article analyzed the role of wireless communication technology in improving network data security and selected 30 enterprises as the research objects. This article studied the role of traditional wired communication technology and wireless communication technology in network data security protection and compared several indicators based on virus detection rate, defense rate, data transmission speed, and customer satisfaction. The experimental results showed that the average detection rate of Trojan viruses based on wireless communication technology was 80.8%, and the average defense rate against viruses using antivirus software was 58%. In the case of virus attacks, the average transmission speed was 2.4 s, and the average satisfaction of users with wireless communication technology in virus defense was 6.9. It indicates that wireless communication technology has significantly improved virus detection rate, defense rate, data transmission speed, and customer satisfaction in the mode of improving network data security. This technology has significant significance and value for users.

Computer Network Virus Defense with Data Mining-based Active Protection

A novel approach is presented in this paper to address the limitations of virtual machine technology, active kernel technology, heuristic killing technology, and behaviour killing technology in computer network virus defence. The proposed method provides data mining technology, specifically Object-Oriented Analysis (OOA) mining, to detect deformed and unknown viruses by analyzing the sequence of Win API calls in PE files. Experimental results showcase the Data Mining-based Antivirus (DMAV) system's superiority over existing virus scanning software in multiple aspects: higher accuracy in deformed virus detection, enhanced active defence capabilities against unknown viruses (with a recognition rate of 92%), improved efficiency, and a reduced false alarm rate for non-virus file detection. Furthermore, the paper introduces an OOA rule generator to optimize feature extraction, enhancing the system's intelligence and robustness. This research provides a promising solution to support virus detection accuracy, active defence mechanisms, and overall efficiency while minimizing false positives in virus scanning, thus contributing significantly to the advancement of computer network security.

Machine Learning Approaches to Malicious PowerShell Scripts Detection and Feature Combination Analysis

<p>With advances in communication technology, modern society relies more than ever on the Internet and various user-friendly digital tools. It provides access to and enables the manipulation of files, trips, and the Windows API. Attackers frequently use various obfuscation techniques PowerShell scripts to avoid detection by anti-virus software. Their doing so can significantly reduce the readability of the script. This work statically analyzes PowerShell scripts. Thirty-three features that were based on the script’s keywords, format, and string combinations were used herein to determine the behavioral intent of the script. Ones are characteristic-based features that are obtained by calculation; the others are behavior-based features that determine the execution function of behavior using keywords and instructions. Behavior-based features can be divided into positive behavior-based features, neutral behavior-based features, and negative behavior-based features. These three types of features are enhanced by observing samples and adding keywords. The other type of characteristic-based feature is introduced into the formula from other studies in this work. The XGBoost model was used to evaluate the importance of the features that are proposed in this study and to identify the combination of features that contributed most to the detection of PowerShell scripts. The final model with the combined features is found to exhibit the best performance. The model has 99.27% accuracy when applied to the validation dataset. The results clearly indicate that the proposed malicious PowerShell script detection model outperforms previously developed models.</p> <p> </p>

A proposed method for detecting network intrusion using an ensemble learning (stacking -voting) approach with unbalanced data

The use of computer networks has become necessary in most human activities. However, these networks are exposed to potential threats affecting the confidentiality, integrity, and availability of data. Nowadays, the security of computer networks is based on tools and software such as antivirus software. Among the techniques used for machine protection, firewalls, data encryption, etc., were mentioned. These techniques constitute the first phase of computer network security. However, they remain limited and do not allow for full network protection. In this paper, a Network Intrusion Detection System (NIDS) was proposed for binary classification. This model was based on ensemble learning techniques, where the base models were carefully selected in a first layer. Several machine learning algorithms were individually studied to choose the best ones based on multiple metrics, including calculation speed. The SMOTE technique was used to balance the data, and cross-validation was employed to mitigate overfitting issues. Regarding the approaches used in this research, a stacking and voting model was employed, trained, and tested on a UNSW-NB15 dataset. The stacking classifier achieved a higher accuracy of 96 %, while the voting approach attained 95,6 %

Implementation of the Russian antivirus mail gateway in the e-mail system of CEMI RAS

The article discusses issues related to the choice of an antivirus and anti-spam software intended for use as the security mail gateway instead of the functioning one. Some characteristics of the two Russian developments and criteria for choosing between them are given. An assessment of the implementation result obtained during actual operation is given.

A Static Approach for Malware Analysis: A Guide to Analysis Tools and Techniques

Abstract: Malicious code presents a severe risk to computer systems, making work difficult for information security and cyber experts. Malware analysis is in great demand because of its importance and function in digital forensics and cyber security. Malware, often known as malicious software, is purposefully written software that harms or damages people, computers, servers, or networks. An overview of malware analysis methods and techniques in the fields of digital forensics and cyber security is given in this article. The study examines several malware types, their characteristics, and analysts' challenges in locating and analyzing them. It also highlights the importance of continuing this field's research and development to stay ahead of evolving malware threats. Trojan horses, worms, backdoors, rootkits, and adware are examples of malware. There are several methods for analyzing malware, but one of the most well-known is static analysis. This article will look at several methods for doing malware analysis and detection on corporate systems, as well as the resources available to assist with sample inspection to reduce the impact of malware assaults on an organization's operations. The investigator must first choose which methods and instruments to use for analysis. Static analysis, which includes malware scanners and detectors, is the first line of defense against malware. As technology advances, malware creators use various techniques to conceal their source code from scanners and detectors that search for strings, pattern matching, and other similar patterns to determine hash values that may be used to identify the infection. Malware experts decompress the packed file into unpacked one to examine obfuscated malware. This study examines efforts to investigate the many techniques and instruments malware uses in the real world.

COV-19 RELATED DISCOURSE GENERIC ANALYSES

COVID-19 related discourse has been gaining widespread attention due to its extension and coverage area (geographical area, age groups, layers of society, etc.). It can therefore be argued that the problem is global and sorting it out goes far of the local medical interventions. Cov-19 related discourse, presented by authoritative persons on the press conference (which is not a coincidental area and plays an intermediary role), responsible for preventing the society from killing virus requires not only medical treatment but the real art of communication as well.
 On the one hand, selecting an efficient communicative strategy and on the other, analyzing a real idea lying under meticulously chosen generic features requires generic analyses of either discourse or a text.
 This paper is established on corpus based linguistic analysis, which enabled us to identify the frequency and apportioning of each discourse marker observed in target empirical material, to highlight dominant and supplementary discourse features, to strengthen hypotheses that Cov-19 related discourse or a text is hybrid. Over and above that, analyses outcome, sheds new light on generic features of COVID-19 related discourse and opens a wider scope for a socio-critical look at what responsible persons do with language and why do they do it.

An empirical study of problems and evaluation of IoT malware classification label sources

With the proliferation of malware on IoT devices, research on IoT malicious code has also become more mature. Most studies use learning models to detect or classify malware. Therefore, ensuring high-quality labels for malware samples is crucial to maintaining research accuracy. Researchers typically submit malware samples to Anti-Virus (AV) engines to obtain labels, but different engines have varying rules for detecting maliciousness and variants. This study aims to improve future IoT malware research accuracy by investigating label quality. We address three label-related issues, including Anti-Virus detection technology, naming rules, and label expiration. Additionally, we examine multiple sources of malware labels, including 63 studies on IoT, Windows, and Android malware, as well as commonly used tools such as AVClass and Anti-Virus engines. To evaluate and recommend label sources, we construct classification models using an IoT malware dataset obtained from VirusShare, which is labeled with common tools and Anti-Virus engines and classified based on ELF features. For family classification, we investigate four methods and tools, and for variant hierarchy classification, we compare label overlaps with sample clustering from 12 Anti-Virus engines. Based on our findings, we recommend AVClass for obtaining labels for IoT family classification. For small-scale malware families at the variant level, we recommend using the labels from Ad-Aware, BitDefender, and Emsisoft engines. For large-scale malware families, we advise employing labels from Jiangmin, NANO-Antivirus, and Avira engines, serving as a valuable guide for future IoT malware research.

Improving computer network security evaluation with grey relational analysis and probabilistic simplified neutrosophic sets

The popularity of computer network has provided great convenience for people’s work and life, but it has also brought corresponding information security problems. It is very important to do a good job in computer network security evaluation. Conventional computer network security evaluation can be realized with the help of firewalls, antivirus software, etc., while in the face of complex computer network applications, it is necessary to adopt a security evaluation method with good operability and wider application range. The computer network security evaluation is viewed as multiple attribute decision-making (MADM) issue. In this paper, an extended probabilistic simplified neutrosophic number grey relational analysis (PSNN-GRA) method is established for computer network security evaluation. The PSNN-GRA method integrated with Criteria Importance Though Intercrieria Correlation (CRITIC) method in probabilistic simplified neutrosophic sets (PSNSs) circumstance is applied to rank the optional alternatives and a numerical example for computer network security evaluation is used to proof the newly proposed method’s practicability along with the comparison with other methods. The results display that the approach is uncomplicated, valid and simple to compute.

TANTANGAN TERKINI DALAM KEAMANAN INFORMASI ANALISIS RESIKO DAN UPAYA PERLINDUNGAN

Threats and attacks that can result in leaks of personal or sensitive data or reduced business performance have a significant impact on the security of networks and information systems. Insider attacks, eavesdropping, misconfiguration, missing functionality, confusion, man-in- attacks, virus attacks, denial of service attacks are some of the dangers that threaten your network security or threaten the security of your network. Attacks are possible. Influencing information systems. Companies risk losing information appropriate security measures, such as network and information system security. You can implement the right security solutions to predict and prevent various security risks and attacks. Confidentiality, integrity, and availability are three characteristics of security, and to determine which security technology best suits your organization's needs, you must first compare the various threats and attacks with the security technologies in use. Recommended security technologies intrusion detection systems (IDS), antivirus programs, and encryption systems. This is because this technology relies on predicting and protecting networks and information systems in many security elements.

Analysis of adversarial attacks on the machine learning models of cyberprotection systems.

Modern trends in the development of cyber protection systems are associated with the widespread use of machine learning technologies to detect and prevent cyber threats. At the same time, attackers are looking for ways to evade detection by such systems, using both traditional attack methods and new ones aimed exclusively at countering artificial intelligence - adversarial attacks. Therefore, finding ways to counteract adversarial attacks is an urgent scientific and technical task. Adversarial Machine Learning (AML) is used to study them, which consists in simulating such attacks. The purpose of research is to determine ways to increase the resilience of cyber defense systems operating with the use of machine learning technologies to the impact of attacks based on AML models. The article provides examples of the application of machine learning methods in cyber protection systems. The models of adversarial attacks are described, namely: models of evasion, poisoning, functional extraction, inversion, and models of membership inference attack. Possible scenarios of their implementation are considered. Examples of adversarial attacks on machine learning models for recognizing images and text messages, detecting domain name generation algorithms, HTTP traffic malware, malicious content in e-mails, bypassing antivirus software are analyzed. Studies have shown that even without access to the algorithms of machine learning models, it is possible to bypass the cyber protection system. Therefore, to ensure the security of networks and services by means of cyber protection with artificial intelligence, it is necessary to take into account the need to counter adversarial attacks. For this purpose, it is proposed to: collect and aggregate training data for each machine learning model individually, instead of obtaining them from publicly available sources; optimize the content of event logs, taking into account the possibility of using the information contained in them to create adversarial attacks; to ensure the protection of training data and algorithms of the functioning of models; in the case of deploying cyber protection systems on critical infrastructure objects, use specially developed machine learning models that are not publicly available, which will complicate the possibility of creating a functional extraction attack.

Network Malware Detection Using Deep Learning Network Analysis

Malware, short for malicious software, is designed for harmful purposes and threatens network security because it can propagate without human interaction by exploiting user’s vulnerabilities and carelessness. Having your system regularly scanned for malicious software is essential for keeping hackers at bay and avoiding the disclosure of sensitive data. The major drawbacks are the rapid creation of new malware variants, and it may become difficult to detect existing threats. With the ever-increasing volume of Android malware, the sophistication with which it can hide, and the potentially enormous value of data assets stored on Android devices, detecting or classifying Android malware is a big data problem. Security researchers have developed various malware detection and prevention programs for servers, gateways, user workstations, and mobile devices. Some offer centralized monitoring for malware detection software deployed on many systems or computers. The purpose of this essay is to critically examine the research that has been done specifically on malware detection. This paper proposes the Anti-Virus Software Detection for Malware with Deep Learning Network (AVSD-MDLN) framework to explore the possible threats. The two methods help in finding the threats. Dynamic Analysis for the Detection of Spyware (DA-DS) framework is framed to detect malicious malware, while the other is for classifying Android malware which is helped out through the Category in an Ensemble (CE) method. Prior malware detection methods are compared with the results of the proposed method. According to the research findings, the proposed approach achieves a higher projected time (0.5 sec) and detection accuracy (97.47%) than the existing situation machine learning and deep learning methodologies. Performance, correlation coefficient, and recall rate all improved in the suggested framework. Likewise, the negative rate (MPR) and the positive rate (PPR) also improved.

Careful When You Click? How the Dark Triad of Personality Can Influence the Likelihood of Online Crime Victimization

Cybercrime is a growing problem, with increasing numbers of people reporting they have been a victim. However, the literature has tended to focus on the characteristics of the perpetrator and has often neglected to examine how the individual differences of victims may have an impact. This paper investigates how the Dark Triad – Machiavellianism, narcissism, and psychopathy – may increase the chances of being a victim of online crime. To do this, the Cyber Routine Activities Theory was applied, which suggests victimization is a result of two things: 1) a user’s routine online activity which may bring them into contact with nefarious others and/or makes them an attractive target, and 2) the lack of a “capable guardian” who can defend against such nefarious others. Using an online survey (N = 328), we measured Internet users’ Dark Triad traits, along with their engagement in various online activities and the preventative measures used against potential criminals. Findings demonstrated that narcissism and psychopathy increased the likelihood of victimization, but Machiavellianism did not. These relationships were moderated by gender. However, contrary to other work using the Cyber-RAT, preventative measures (e.g. knowledge of computers, presence of anti-virus programs) did not seem to impact on the likelihood of victimization. The challenges of using these findings to reduce cybercrime and future work are then discussed.

МЕТОДЫ ОБЕСПЕЧЕНИЯ БЕЗОПАСНОСТИ БАЗ ДАННЫХ

The article introduces the main trends in the development of databases that generate new threats regarding their availability, integrity and confidentiality. It provides an overview of literature sources. The article describes modern approaches to the tasks of ensuring the security of database operation. It also determines suitability database protection methods to the potential threats characteristic of them, shows the sources of these threats. Article containes example of corporate information and educational system of the East Kazakhstan University named after S. Amanzholov, where has been implemented such elements of the information security policy as basic security mechanisms (network filtering of information flows, installation of anti-virus software), role-based access control model, mandatory management of granting powers to authorized users, logging of user actions for ensuring the procedure of non-repudiation. At the end, has been formulated recommendations for the expanded use of the metadata mechanism and the improvement of authentication procedures.

Ransomware Attacks in the Healthcare Industry

This paper explores the growing problem of ransomware attacks in the healthcare industry. It dives deep into the meaning of ransomware attacks and the basics of the attack such as how hackers gain access to data through the ransomware. Furthermore, this paper specifically focuses on hospitals and patients that are directly affected by the impact of ransomware attacks. This writing also includes information about noteworthy attacks in the health sector that have caught the attention of people around the world and how they were addressed. An aspect of Bitcoin has been added as cyber criminals demand ransom money in this currency from their victims. Lastly, this paper mentions steps that can be taken by hospitals to reduce the risk of getting infected by ransomware or what to do during a ransomware attack, such as having preventative safety measures in place with the use of antivirus software and Artificial Intelligence security systems as well has having a response plan during an attack. Apart from the Information Technology team in hospitals practicing these preventative measures, businesses and individuals should put in the time to implement these precautionary steps to ensure that they aren’t victims of ransomware attacks and that no one can gain access to any of their classified information. This paper was written by the researcher in a limited amount of time and the researcher was not able to conduct any of their own trials. Hence, all the information and data included has been previously collected from researchers around the world.