Antivirus Research Articles

Cerrahpaşa Medical Faculty Hospital HIV-1/-2 Serological Test Data: 2019-2022 Retrospective Evaluation

Objective: The aim of this study was to retrospectively discuss the human immunodeficiency virus (HIV) scanning and verification test results and demographics of patients who were admitted to the Istanbul University Cerrahpaşa Medical Faculty’s Medical Microbiology Laboratory Center Serology/ELISA division with suspected HIV infection or pre-operative serologic screening. In addition, the study aimed to compare HIV seroprevalence with data from the center’s previous period. Materials and Methods: HIV-1/-2 antibody +P24 antigen (HIV-1/-2 Ab/Ag) was studied routinely using the chemiluminescent microparticle immunoassay (CMIA) method with the same method also being used as the second repeat test. The sera verifications of patients who showed repeated reactivity after the HIV Ab/Ag test were studied using the line immunoassay (LIA) method. Results: The study retrospectively studied 156,542 cases between 2019-2022, of which 237 (0.17%) showed repeated anti-HIV-1/-2 reactivity. From the repeated reactivity serum samples, LIA testing was performed to confirm the remaining 181 serum samples after excluding the previously confirmed samples, with 175 (96.6%) coming back positive. All these samples showed sgp120 and gp41 band positivity, thus confirming HIV1 positivity. Conclusion: These retrospective data from one center regarding HIV seroprevalence for the 2019-2022 period are in line with other national studies. However, due to the COVID-19 pandemic, HIV prevalence during this period may have been higher than detected. HIV prevalence in Istanbul, being a cosmopolitan city that receives immigrants, should be monitored in the future.

PENYULUHAN TENTANG PENTINGNYA CUCI TANGAN PAKAI SABUN DALAM RANGKA PENINGKATAN PERSONAL HYGIENE PADA ANAK DI TK TURSINA JAYA KELURAHAN SITINJAK

Indonesia is a country that is aggressively improving public health, the government has launched a handwashing with soap (CTPS) program which is useful for improving personal hygiene so that it avoids various diseases. CTPS is far more effective at killing germs, bacteria and viruses than washing your hands with water alone. Hand washing with soap (CTPS) is also known as an effort to prevent disease. This community service aims to increase knowledge and practice of washing hands with soap properly and correctly in kindergarten school children at Tursina Jaya Kindergarten. This community service activity was attended by 30 kindergarten students. This activity was carried out by delivering counseling materials and demonstrations of hand washing with soap. This activity was also interspersed with discussions and questions and answers. The results of this community service activity were received enthusiastically by students. All activity participants stated that this community service was very useful because it could broaden knowledge and the correct practice of washing hands with soap so that it would affect habits in daily life.

Cybersecurity and Country of Origin: Towards a New Framework for Assessing Digital Product Domesticity

Recent events concerning the Kaspersky anti-virus software in the UK and the Android operating system in the US have highlighted the significance of the domesticity of digital products for national cybersecurity, and the importance of establishing the origin of digital products has been further brought into focus by the war in Ukraine and China’s military activities around Taiwan. Digital products can contain hardware components, software elements, embedded systems, and data, and determining the country of origin (COO) in these circumstances is problematic. The aim of this research, and its main contribution, is to provide an operational framework for the application of the COO concept to address this problem. Using an inductive research methodology based on semi-structured interviews and an online survey, a 19-parameter framework for assessing the COO of digital products is developed and then applied to the case example of a mobile phone import in Turkey. This article concludes that new processes and policies are urgently required to enhance the cyber and information security for digital products, aid domestic digital technology production, and support the transition to recyclable technologies. Such developments are of significance not only for western nations concerned with data and security issues, but also for developing world countries trying to develop their own domestic digital product manufacturing capabilities. This is also of relevance to the computer end-user, who would benefit from greater clarity on the origin of digital products ahead of a purchase decision.

PERLINDUNGAN HUKUM MENGENAI KEBOCORAN DATA PRIBADI TERHADAP AKUN MICROSOFT OFFICE 365 YANG DIBELI MELALUI SHOPEE

In the new era, commonly referred to as big data, online-based storage is increasingly needed to accommodate data and information obtained and sent. The problem is that many users of Microsoft 365 series accounts are purchased illegally from sellers on the Shopee site and do not realize sellers have access to synchronize user data. The data is connected online and automatically, especially in data storage applications from the Microsoft 365 series, namely OneDrive so it can pose a significant threat to personal information leakage. This article aims to dissect and obtain an ideal concept regarding protecting the personal data of Microsoft Office 365 users purchased through the Shopee site. A legal study is a normative study of applicable legal provisions or statutory regulations. The result shows that the explicit rules in the new Personal Data Protection Law related to Cloud Computing Systems, as well as preventive measures to avoid leakage of personal data using self-literacy on the importance of protecting personal data. For example, customers should use a secure site for online transactions, stop buying products or application accounts online illegally, and use security antivirus software.

UAV SECaaS: Game-Theoretic Formulation for Security as a Service in UAV Swarms

Unmanned aerial vehicles, popularly known as UAVs, have been used in many applications in the recent past. UAVs have also been recently used to provide security as a service (SECaaS). SECaaS involves technical solutions, like antivirus and antispam software, firewalls, using secure operating systems, etc. UAVs are resource-constrained entities, and thus, they avail the computational facilities of the base station (BS) to serve the users in their range. At times, several UAVs cooperatively come together to serve a given region, and such a group of UAVs is called a swarm of UAVs. Generally, a group/swarm of UAVs connect themselves to the BS through cluster head (CH) UAVs, which are intermediary nodes. In real-world scenarios, many stakeholders come together to form a UAV swarm configuration providing services to users. Each stakeholder wants to maximize gains. This work proposes a pricing Stackelberg game among the UAVs, CHs, and the BS by formulating their behavioral utilities. Using particle swarm optimization on each entity’s utility functions, we create an optimal price strategy to maximize profit.

INFORMATION SECURITY POLICIES AND STRATEGIES AND PRACTICES ADOPTED IN IT: THE IMPORTANCE OF CONSULTANCY IN SMALL AND MEDIUM-SIZED COMPANIES

Objective: Companies in the cybersecurity consulting market are expanding their services in periodic training to business stakeholders and enforcement of security policies. The objective of this work is to demonstrate the importance of consulting in information security policies aimed at small and medium-sized companies. Methods: It is characterized as a narrative literature review with a qualitative approach, which does not use explicit and systematic criteria for the search and critical analysis of the selected literature. Results: Tools needed for cybersecurity include endpoint detection and response (EDR), antivirus software, next-generation firewalls, Domain Name System (DNS) protection, email gateway security, intrusion detection and prevention, logging and log monitoring, endpoint protection, authentication and virtual private network (VPN) services, cloud-based security, web application firewalls (WAFs), software-defined wide area networks (SD-WAN), enterprise password management , privileged access management (GAP), vulnerability and threat management, and threat detection. Conclusions: In summary, SMBs seem to implement some of the basic cybersecurity measures only as part of their overall IT implementation. However, it appears that unless cybersecurity controls are included as part of an IT solution, many SMBs do not realize the resulting potential risks to their business.

CYBER PROTECTION OF ENERGOIL ENTERPRISES

This article is about providing comprehensive protection of the oil refining and distribution company ENERGOIL. This protection includes components such as encryption, anti-virus software, and user access matrices. Within the access delimitation system, a dispatcher must be used, which performs access delimitation. This dispatcher is an employee of the security department. Access is restricted in accordance with the authority of employees. A request for employee access to a specific computer is sent to the database management and event registration unit. The authority of the employee and the characteristics of the object are analyzed by an employee of the security department. The first basic step for organizing work computers at the enterprise will be the creation of user accounts. For this, we create our own account for each computer A user access matrix was developed for the ENERGOIL enterprise, divided by information departments. It is necessary in order to clearly understand which users have access to which. The Triple DES algorithm was used for encryption. The essence of the algorithm is to use the Data Encryption Standard, or simply DES, published by the US National Bureau of Standards (NBS). First, the data is encrypted with the first key, decrypted back with the second key, and re-encrypted with the third key. Since as many as three keys are used, their total length is actually 3 * 56 = 168 bits. The encryption speed is also lower than that of the DES algorithm, but the reliability leaves no doubt. It takes a billion times more attempts to break this encryption than simple DES. Avast and Microsoft Windows Defender antiviruses were used to protect against malicious software, and an access matrix with user accounts and their permissions was created to limit access on work computers.

Scramblesuit: An effective timing side-channels framework for malware sandbox evasion1

Online malware scanners are one of the best weapons in the arsenal of cybersecurity companies and researchers. A fundamental part of such systems is the sandbox that provides an instrumented and isolated environment (virtualized or emulated) for any user to upload and run unknown artifacts and identify potentially malicious behaviors. The provided API and the wealth of information in the reports produced by these services have also helped attackers test the efficacy of numerous techniques to make malware hard to detect. The most common technique used by malware for evading the analysis system is to monitor the execution environment, detect the presence of any debugging artifacts, and hide its malicious behavior if needed. This is usually achieved by looking for signals suggesting that the execution environment does not belong to a native machine, such as specific memory patterns or behavioral traits of certain CPU instructions. In this paper, we show how an attacker can evade detection on such analysis services by incorporating a Proof-of-Work (PoW) algorithm into a malware sample. Specifically, we leverage the asymptotic behavior of the computational cost of PoW algorithms when they run on some classes of hardware platforms to effectively detect a non bare-metal environment of the malware sandbox analyzer. To prove the validity of this intuition, we design and implement Scramblesuit, a framework to automatically (i) implement sandbox detection strategies, and (ii) embed a test evasion program into an arbitrary malware sample. We perform a comprehensive evaluation of Scramblesuit across a wide range of: 1) COTS architectures (ARM, Apple M1, i9, i7 and Xeon), 2) malware families, and 3) online sandboxes (JoeSandbox, Sysinternals, C2AE, Zenbox, Dr.Web VX Cube, Tencent HABO, YOMI Hunter). Our empirical evaluation shows that a PoW-based evasion technique is hard to fingerprint, and reduces existing malware detection rate by a factor of 10. The only plausible counter-measure to Scramblesuit is to rely on bare-metal online malware scanners, which is unrealistic given they currently handle millions of daily submissions.

Uji Efektivitas Daya Antibakteri Ekstrak Alga Terhadap Pertumbuhan Bakteri Patogen Streptococcus Mutans

Background: Steptoccocus mutans is one of flora normal bacteria in the human body which can cause infections in the mouth cavity. Algae are plant-like organisms that may be found in a marine ecosystem. Recents studies have reported that algae contains numerous pharmacological activities compounds, such us: antibiotic, cytotoxic, antifungal, anti virus and antitumor. Purpose: this research aimed to know the antibacterial activity of algae extract against the growth of pathogen bacteria Streptococcus mutans. Methods: Algae were extracted by using aquades.The inhibition test was performed by agar diffusion method on Glucose Nutrient Agar (GNA) using three types of algae extracts: Eucheuma cottoni, Turbinaria decurrens and Ulva reticulata on the incubation period 1x24 and 2x24 hours at 37◦C. Data collection technique was based on the results of measuring the diameter of the inhibition zone (clear zone) for the growth of Streptococcus mutans bacteria using a caliper. The data obtained were analyzed using quantitative descriptive analysis methods. This data analysis was processed to see if there was a difference in antibacterial power from extract algae samples. Results: U. Reticulate algae extract formed a clear zone 11.2 mm in diameter at 1x24-hour incubation, and 10.3 mm at 2x24-hour incubation. T. deccurens formed clear zones 12.7 mm in diameter at 1x24-hour incubation, and 11.4 mm at 2x24-hour incubation. E. cottonii formed clear zones 10.1 mm in diameter at 1x24-hour incubation, and 9.3 mm at 2x24-hour incubation. Conclusion: Extracts of T. decurrens have the most potential in inhibiting the growth of pathogenic microbes of S. mutants.

Cybersecurity Awareness and Training (CAT) Framework for Remote Working Employees.

Currently, cybersecurity plays an essential role in computing and information technology due to its direct effect on organizations' critical assets and information. Cybersecurity is applied using integrity, availability, and confidentiality to protect organizational assets and information from various malicious attacks and vulnerabilities. The COVID-19 pandemic has generated different cybersecurity issues and challenges for businesses as employees have become accustomed to working from home. Firms are speeding up their digital transformation, making cybersecurity the current main concern. For software and hardware systems protection, organizations tend to spend an excessive amount of money procuring intrusion detection systems, antivirus software, antispyware software, and encryption mechanisms. However, these solutions are not enough, and organizations continue to suffer security risks due to the escalating list of security vulnerabilities during the COVID-19 pandemic. There is a thriving need to provide a cybersecurity awareness and training framework for remote working employees. The main objective of this research is to propose a CAT framework for cybersecurity awareness and training that will help organizations to evaluate and measure their employees' capability in the cybersecurity domain. The proposed CAT framework will assist different organizations in effectively and efficiently managing security-related issues and challenges to protect their assets and critical information. The developed CAT framework consists of three key levels and twenty-five core practices. Case studies are conducted to evaluate the usefulness of the CAT framework in cybersecurity-based organizational settings in a real-world environment. The case studies' results showed that the proposed CAT framework can identify employees' capability levels and help train them to effectively overcome the cybersecurity issues and challenges faced by the organizations.

Docking Simulation Analysis of Natural Ingredients as Anti Virus SARS-Cov-2 on Helicase Inhibitors

Aims: To find active compounds from natural ingredients that have the potential to be antivirals of SARS-CoV-2.
 Study Design: Simulation research.
 Place and Duration of Study: Physics Laboratory, Department of Physics Education, Universitas Kristen Indonesia, between December 2021 and August 2022.
 Methodology: The method used is a computational simulation commonly known as docking simulation or molecular docking. There are several steps taken, namely ligand and receptor preparation, docking simulation and analysis of simulation results.
 Results: The results obtained were from 22 ligand compounds of natural material selected as helicase receptor inhibitors, 14 ligand compounds were found that met the requirements according to Lipinski's five rules, namely Emodin, Luteolin, Curcumin, Kaemferol, Quercetin, Myricetin, Scutellarein, 10-Gingerol, Shogaol, Mangostin, Piseatanol, Diallyl disulfide, Cyperotundone and Eugenol. Of the 14 ligand compounds simulated with helicase receptors, it turned out that 14 stable ligand compounds were used as helicase receptor inhibitors. However, among the 14 ligands, myricetin is the most stable ligand with the smallest Gibbs free energy value, which is -8.7 kcal/mol.
 Conclusion: An active ingredient compound has been found that has the potential as an antivirus sars-COV-2 in the Helicase receptor, Myricetin from clove plants (Syzygium aromaticum). These results can be used as a basis for drug development for the development of SARS-COV-2 antivirus in the future.

A malware detection system using a hybrid approach of multi-heads attention-based control flow traces and image visualization

Android is the most widely used mobile platform, making it a prime target for malicious attacks. Therefore, it is imperative to effectively circumvent these attacks. Recently, machine learning has been a promising solution for malware detection, which relies on distinguishing features. While machine learning-based malware scanners have a large number of features, adversaries can avoid detection by using feature-related expertise. Therefore, one of the main tasks of the Android security industry is to consistently propose cutting-edge features that can detect suspicious activity. This study presents a novel feature representation approach for malware detection that combines API-Call Graphs (ACGs) with byte-level image representation. First, the reverse engineering procedure is used to obtain the Java programming codes and Dalvik Executable (DEX) file from Android Package Kit (APK). Second, to depict Android apps with high-level features, we develop ACGs by mining API-Calls and API sequences from Control Flow Graph (CFG). The ACGs can act as a digital fingerprint of the actions taken by Android apps. Next, the multi-head attention-based transfer learning method is used to extract trained features vector from ACGs. Third, the DEX file is converted to a malware image, and the texture features are extracted and highlighted using a combination of FAST (Features from Accelerated Segment Test) and BRIEF (Binary Robust Independent Elementary Features). Finally, the ACGs and texture features are combined for effective malware detection and classification. The proposed method uses a customized dataset prepared from the CIC-InvesAndMal2019 dataset and outperforms state-of-the-art methods with 99.27% accuracy.

Explainable Machine Learning for Intrusion Detection via Hardware Performance Counters

The exponential proliferation of Malware over the past decade has threatened system security across a plethora of Internet of Things (IoT) devices. Furthermore, the improvements in computer architectures to include speculative branching and out-of-order executions have engendered new opportunities for adversaries to carry out microarchitectural attacks in these devices. Both Malware and microarchitectural attacks are imperative threats to computing systems, as their behaviors range from stealing sensitive data to total system failure. With the cat-and-mouse game between Anti-Virus Software (AVS) and attackers, the frequent bolstering of AVS induces large computational overhead. Consequently, hardware performance counter (HPC)-based detection strategies augmented with machine learning (ML) classifiers have gained popularity as a low overhead solution in identifying these malicious threats. However, ML models are operated as black boxes, which results in decisions that are not human understandable. Clarity of the models’ results facilitates the development of more robust systems. Existing explainable frameworks are only capable of determining each feature’s impact on a prediction which does not provide meaningful interpretable outcomes for HPC-based intrusion detection. In this article, we address this issue by proposing an explainable HPC-based double regression (HPCDR) ML framework. Our proposed technique provides relevant transparency through isolation of the most malevolent transient window of an application, thereby allowing a user to efficiently locate the pernicious instructions within the program. We evaluated HPCDR on five microarchitectural attacks and two Malware. HPCDR was successfully able to identify the most malicious function manifested in each intrusive application.

Cross-site scripting detection with two-channel feature fusion embedded in self-attention mechanism

In the era of big data, stealing users’ private data has become one of the main targets of network hackers. In recent years, cross-site scripting (XSS) attacks to obtain users’ privacy data have been one of the main web attack methods of network hackers. Traditional antivirus software cannot identify such cross-site scripting attacks. To identify cross-site scripting attacks quickly and accurately, we proposed a cross-site scripting detection model (C-BLA) with two-channel multi-scale feature fusion embedded in a self-attention mechanism. The model first maps cross-site scripting payloads into spatial vectors by data preprocessing using Word2Vec. Then the two-channel network performs feature extraction on the data. Channel I: extract local features of cross-site scripting payloads at different scales by designing parallel one-dimensional convolutional layers with different convolutional kernel sizes; Channel II: extract semantic information of cross-site scripting payloads from two directions of positive and negative order using a bidirectional Long-Short Term Memory network, and then embed the self-attention mechanism to strengthen the semantic information features. Experiments show that the proposed model achieves a precision rate of 99.8% and a recall rate of 99.1% for cross-site scripting detection, which is a certain improvement in detection rate compared with a single deep learning model and traditional machine learning methods. The two-channel feature fusion of this model better solves the cross-site scripting detection problem.

A Study on Improving M2M Network Security through Abnormal Traffic Control

Machine-to-machine (M2M) intelligent network devices are exposed to vulnerable networks and security threats always exist. The devices are composed of low-capacity hardware by their nature and are exposed to various security threats such as worms, viruses and distributed denial of service (DDoS) flooding attacks due to lack of security or antivirus programs installed in the personal computer environment. In this paper, we proposed a network filter that improves the security of M2M intelligent networks by configuring the network security filter in a specific form that can be adapted to M2M intelligent networks. The proposed filter increases user convenience and decreases unnecessary loss. Experimental results show that when the security filter is applied, the response speed of the device improved by more than 50% in an abnormal traffic environment with a cost of less than 10% delay, depending upon the characteristics of the device.

Model Design of Big Data Information Security Management Based on the Internet of Things

At present, the level of modernization and informatization is constantly improving, especially in rapidly developing China. A large amount of information is collected every second, forming a huge database and making people live in the “big data era.” Following cloud computing and the Internet of things, big data technology has become another revolutionary change in the global society, changing global development and becoming a new development point for technological innovation, industrial policy, and national information security. Big data in the new age poses new challenges and perspectives for the nation’s infosec development. Big data is a renewed tool for state security. Nations use big data to create state infosec, offering great facilitation, potential for adoption, and business value. This is a “new blue ocean” for competition among countries. Although big data brings convenience to public life, it also poses a serious threat to national information security. After the research and experiment of the model design of big data information security management of the Internet of things, the experimental data have shown that 86.67% set passwords in communication devices and storage devices. 66.67% installed firewalls, and 76.67% ran antivirus software. Compared with before, the total ratio of setting a password increased by 53.34% and the total ratio of installing a firewall and running antivirus software both increased by 26.67%. It can be seen from the above data that the protection of big data information under the Internet of things has been significantly improved. From the above data, through the big data information security management of the Internet of things, a new development direction is proposed for the development of information security.

DFSGraph: Data Flow Semantic Model for Intermediate Representation Programs Based on Graph Network

With the improvement of software copyright protection awareness, code obfuscation technology plays a crucial role in protecting key code segments. As the obfuscation technology becomes more and more complex and diverse, it has spawned a large number of malware variants, which make it easy to evade the detection of anti-virus software. Malicious code detection mainly depends on binary code similarity analysis. However, the existing software analysis technologies are difficult to deal with the growing complex obfuscation technologies. To solve this problem, this paper proposes a new obfuscation-resilient program analysis method, which is based on the data flow transformation relationship of the intermediate representation and the graph network model. In our approach, we first construct the data transformation graph based on LLVM IR. Then, we design a novel intermediate language representation model based on graph networks, named DFSGraph, to learn the data flow semantics from DTG. DFSGraph can detect the similarity of obfuscated code by extracting the semantic information of program data flow without deobfuscation. Extensive experiments prove that our approach is more accurate than existing deobfuscation tools when searching for similar functions from obfuscated code.

Current problems of cybercrime prevention in Ukraine

The problems of cybercrime were explored in the article. The analysis of the works of Ukrainian scientists on this problem is carried out. Cybersecurity is revealed as an innovative system of virtuality of the modern information space. Cybercrime is shown as a social and legal phenomenon of a qualitatively new type, attention is focused on the fact that cybersecurity under martial law in Ukraine is becoming particularly relevant, since it is an investment risk with high - quality support for the anti-corruption component in the military sphere. It is proved that the problem of cybercrime has become relevant with the development of information technologies and a prerequisite for the rapid, large-scale and dynamic development of the digital society. Today these things require from us a system of knowledge and abilities for logical thinking, the ability for analyzing and investigating the received information, the implementation of which will allow the country to be financially and technically able to compete with other countries. Therefore, it is not surprising that with the dynamic development of society, the emergence of new systemic forms of organizing public relations (social networks, virtual reality, blockchain, etc.), a new type of high – tech crime appears-cybercrime, which is a complex and relatively new field of law enforcement activities. Thus, cybercrime is a problem that faced planets in the Twenty-First Century and promises to grow and absorb more and more funds. Despite measures taken by individuals, firms, and the state, cybercrime continues to operate, increasing the profits of violators and reducing the contents of the pockets of ordinary citizens. All these factors create certain obstacles for law enforcement agencies to identify, record and seize criminally significant information when performing investigative actions for use as material evidence. And the most important thing is that cybercriminals also know about this, so their behavior is brazen and illegal. It is concluded that cybercrime in Ukraine is primarily the creation of personal protection by entering your password into the computer and changing it periodically; secondly, timely updating of antivirus programs; thirdly, work with the computer should be carried out only in user mode. Unfortunately, this position, according to criminologists' research, is most often neglected, thereby creating additional risks of infecting your computer with viruses.

Components of viruses and antivirus software in modern information security.

In fact, in today's conditions of continuous innovative development of technologies, in the field of programming, computer networks and the Internet, the dark side of progress continues to grow at great rates: virus software. As a result, in this article we will try to focus on all aspects of the fight against viruses: prevention of infection, methods of detecting malicious programs, their destruction, as well as elimination of consequences. To do this, we conducted research and study of the main scientific sources on this topic and statistical data. As a result, this article focuses on different types of viruses and analyzes the methods of their classification, detection and destruction.

633 Extracellular vesicles as delivery vectors to enhance killing of bacteria and viruses by airway-recruited human neutrophils

633 Extracellular vesicles as delivery vectors to enhance killing of bacteria and viruses by airway-recruited human neutrophils