API Calls Research Articles

Cryptographic ransomware encryption detection: Survey

The ransomware threat has loomed over our digital life since 1989. Criminals use this type of cyber attack to lock or encrypt victims' data, often coercing them to pay exorbitant amounts in ransom. The damage ransomware causes ranges from monetary losses paid for ransom at best to endangering human lives. Cryptographic ransomware, where attackers encrypt the victim's data, stands as the predominant ransomware variant. The primary characteristics of these attacks have remained the same since the first ransomware attack. For this reason, we consider this a key factor differentiating ransomware from other cyber attacks, making it vital in tackling the threat of cryptographic ransomware. This paper proposes a cyber kill chain that describes the modern crypto-ransomware attack. The survey focuses on the Encryption phase as described in our proposed cyber kill chain and its detection techniques. We identify three main methods used in detecting encryption-related activities by ransomware, namely API and System calls, I/O monitoring, and file system activities monitoring. Machine learning (ML) is a tool used in all three identified methodologies, and some of the issues within the ML domain related to this survey are also covered as part of their respective methodologies. The survey of selected proposals is conducted through the prism of those three methodologies, showcasing the importance of detecting ransomware during pre-encryption and encryption activities and the windows of opportunity to do so. We also examine commercial crypto-ransomware protection and detection offerings and show the gap between academic research and commercial applications.

MalAnalyser: An effective and efficient Windows malware detection method based on API call sequences

Continuously evolving malware and their variants pose severe threats to information systems. API call sequence based methodologies perform well in malware detection but often suffer from high-dimensional feature sets or loss of information. Malware developers take advantage of this situation and use sophisticated coding/ obfuscation techniques to add, remove, and replace redundant API calls in malware and evade existing detection mechanisms. To address these concerns, we propose a novel and lightweight API call sequence-based Windows malware detection system, MalAnalyser. Specifically, it first extracts frequent API call subsequences (patterns) from API call sequences because frequent patterns filter superfluous API calls and highlight useful information about malware samples. Thereafter, it applies Global Local Best Particle Swarm Optimization (GLBPSO) algorithm on frequent patterns and identifies a small set of significant features that contribute to malware detection. Finally, MalAnalyser enriches frequent malware patterns using Genetic Algorithm (GA) to unveil unseen malware behavior. Extensive experimentation was conducted to evaluate the performance of MalAnalyser on different datasets and scenarios. GLBPSO considered two feature sets as input during experimentation: (i) the entire feature set and (ii) 60% randomly selected features from the entire set. Experimentation results prove that MalAnalyser attains up to 99.7% accuracy using approximately 30% features of the entire feature set. It is important to note that MalAnalyser achieves up to 100% accuracy on GA enriched feature set. Further, we evaluate the performance of MalAnalyser on a benchmark dataset, and the results proved that MalAnalyser outperforms similar approaches by achieving 99.72% accuracy. Additionally, we determined the suitability of MalAnalyser against a specific type of malware i.e. ransomware, and results showed that MalAnalyser performed remarkably well on ransomware dataset as well.

Open-Source Implementations of the Reactive Asset Administration Shell: A Survey

The use of open-source software is crucial for the digitalization of manufacturing, including the implementation of Digital Twins as envisioned in Industry 4.0. This research paper provides a comprehensive comparison of free and open-source implementations of the reactive Asset Administration Shell (AAS) for creating Digital Twins. A structured search on GitHub and Google Scholar was conducted, leading to the selection of four implementations for detailed analysis. Objective evaluation criteria were defined, and a testing framework was created to test support for the most common AAS model elements and API calls. The results show that all implementations support at least a minimal set of required features while none implement the specification in all details, which highlights the challenges of implementing the AAS specification and the incompatibility between different implementations. This paper is therefore the first attempt at a comprehensive comparison of AAS implementations and identifies potential areas for improvement in future implementations. It also provides valuable insights for software developers and researchers in the field of AAS-based Digital Twins.

Dynamic Malware Analysis Based on API Sequence Semantic Fusion

The existing dynamic malware detection methods based on API call sequences ignore the semantic information of functions. Simply mapping API to numerical values does not reflect whether a function has performed a query or modification operation, whether it is related to network communication, the file system, or other factors. Additionally, the detection performance is limited when the size of the API call sequence is too large. To address this issue, we propose Mal-ASSF, a novel malware detection model that fuses the semantic and sequence features of the API calls. The API2Vec embedding method is used to obtain the dimensionality reduction representation of the API function. To capture the behavioral features of sequential segments, Balts is used to extract the features. To leverage the implicit semantic information of the API functions, the operation and the type of resource operated by the API functions are extracted. These semantic and sequential features are then fused and processed by the attention-related modules. In comparison with the existing methods, Mal-ASSF boasts superior capabilities in terms of semantic representation and recognition of critical sequences within API call sequences. According to the evaluation with a dataset of malware families, the experimental results show that Mal-ASSF outperforms existing solutions by 3% to 5% in detection accuracy.

An Android Malware Detection Method Using Multi-Feature and MobileNet

Most of the existing static analysis-based detection methods adopt one or few types of typical static features for avoiding the problem of dimensionality and computational resource consumption. In order to further improve detecting accuracy with reasonable resource consumption, in this paper, a new Android malware detection model based on multiple features with feature selection method and feature vectorization method are proposed. Feature selection method for each type of features reduces the dimensionality of feature set. Weight-based feature vectorization method for API calls, intent and permission is designed to construct feature vector. Co-occurrence matrix-based vectorization method is proposed to vectorize opcode sequence. To demonstrate the effectiveness of our method, we conducted comprehensive experiments with a total of 30,000 samples. Experimental results show that our method outperforms state-of-the-art methods.

Data Wrangling from Socio-Academic Web-Space: Designing a Meta Model

Data carpentry is an emerging field in the domain of LIS and has opened new possibilities for information professionals to survive in the age of data-intensive information services. However, library professionals face the challenges of information overload because of the free availability of data, both in terms of quantity and variety. The role of library professionals is moving from tech-savvy to data-savvy. This research discusses the possibilities of ODbL-based data sources that offer freely accessible data through API calls and proposes a meta-model for fetching and extracting datasets from these databases using an open-Source Data Wrangling Tool (OpenRefine). Further, it discusses the possible application of data wrangling techniques from diverse sources in libraries and how information professionals can take advantage of openly available data to provide value-added information services to users. The practical implications of an array of databases are projected through two case studies: Case Study I deals with measuring the productivity of individual institutions through different metrics, and Case Study II projects a coverage comparison among the ODbL-based citation and Altmetric databases. This meta-model will aid in understanding the potential application of data wrangling techniques to an array of library services.

Malware API Calls Detection Using Hybrid Logistic Regression and RNN Model

Behavioral malware analysis is a powerful technique used against zero-day and obfuscated malware. Additionally referred to as dynamic malware analysis, this approach employs various methods to achieve enhanced detection. One such method involves using machine learning and deep learning algorithms to learn from the behavior of malware. However, the task of weight initialization in neural networks remains an active area of research. In this paper, we present a novel hybrid model that utilizes both machine learning and deep learning algorithms to detect malware across various categories. The proposed model achieves this by recognizing the malicious functions performed by the malware, which can be inferred from its API call sequences. Failure to detect these malware instances can result in severe cyberattacks, which pose a significant threat to the confidentiality, privacy, and availability of systems. We rely on a secondary dataset containing API call sequences, and we apply logistic regression to obtain the initial weight that serves as input to the neural network. By utilizing this hybrid approach, our research aims to address the challenges associated with traditional weight initialization techniques and to improve the accuracy and efficiency of malware detection based on API calls. The integration of both machine learning and deep learning algorithms allows the proposed model to capitalize on the strengths of each approach, potentially leading to a more robust and versatile solution to malware detection. Moreover, our research contributes to the ongoing efforts in the field of neural networks, by offering a novel perspective on weight initialization techniques and their impact on the performance of neural networks in the context of behavioral malware analysis. Experimental results using a balanced dataset showed 83% accuracy and a 0.44 loss, which outperformed the baseline model in terms of the minimum loss. The imbalanced dataset’s accuracy was 98%, and the loss was 0.10, which exceeded the state-of-the-art model’s accuracy. This demonstrates how well the suggested model can handle malware classification.

IOS and Android Platform Development of Korean Professional Application-Oriented Talent Training Platform Based on Multi-Dimensional Information Transmission Algorithm

iOS and Android platform development of Korean professional application-oriented talent training platform based on multi-dimensional information transmission algorithm. Firstly, we consider the data security of the system. When the application executes the sensitive operation, the policy executor will request the security policy from the security decision center. If the security policy contains restriction rules for the sensitive operation, the security decision center instructs the policy executor to carry out corresponding permission control and security operation. It is necessary to first perform static analysis on the Android application specified by the user to obtain all sensitive API calls and dangerous permission requests involved in the application; then convert the obtained information into policy points, and decide whether to agree or not by operating the policy points. Dangerous requests from applications and more fine-grained API calls. With these technologies, the professional application-oriented talent training platform is implemented. Through the verification, the efficiency of the platform is tested.

Sober: Explores for invasive behaviour of malware

Trigger-based malware samples exhibit untrustworthy aims provided that certain environmental conditions are satisfied. We have categorized trigger-based malware behaviours into two classes, i.e., invasive and evasive. Invasive behaviour is concerned with malicious activities, while malware uses evasive behaviours for self-defence. In this article, we propose a greedy incremental approach for detecting invasive trigger-based malicious behaviour. The method proceeds by identifying and supplying resources required by malign samples. Trigger-based behaviours vary depending on environmental conditions. Such behaviours can be modelled as directed graphs, where each node represents a state, and edges denote invocation of a specific event. We define each state in the graph as atomic behaviour, represented using API calls, having legitimate functionality. This atomic behaviour transforms into harmful action if augmented with additional APIs. A well-known challenge with behavioural analysis is the proactive identification of malicious activities before devices are compromised. Timely prediction of malicious behaviours without damaging the systems can be fulfilled by defining them as atomic actions. To reckon a sub-behaviour as atomic, we propose a novel algorithm. Besides, a new likelihood statistical significance test, Htest, is suggested to extract frequent subgraphs of graphs, representing malware family signature. The main message underlying Htest is that the lesser the number of subgraphs exhibiting benign behaviour, the higher the chances of the sub-graph being chosen as malware family signature. Experiments conducted on 2320 real malware samples demonstrate a 42% reduction in the number of signatures than the state-of-the-art methods, namely CDG and CMQDG. Also, 3% and 1.3% improvement in path coverage compared to the state-of-the-art methods, namely Pytrigger and GoldenEye.

Ransomware Detection by Distinguishing API Call Sequences through LSTM and BERT Models

Abstract Nowadays, ransomware evolved rapidly and the prevention of ransomware has become an important issue. The threat of ransomware is much more sophisticated than before for governments and enterprises; breaches or corruption of sensitive data will cause huge impact on the organization. Early detection is one of the effective method to prevent the ransomware attack. Modern ransomware detection technologies can be divided into two categories: static analysis and dynamic analysis. Dynamic analysis observes the behavior of the running program. Previous research adopted machine learning approach for dynamic analysis and API sequence dataset were used to trained machine learning models for dynamic analysis. In this research, we collected the API calls of the ransomware from reports generated by Cuckoo Sandbox and proposed two detecting models using BERT and LSTM. The result shows that both BERT and LSTM models can successfully predict ransomware with 95% high accuracy. We aimed to compare the performance of two text-based learning model, LSTM and BERT, and analyze the pros and cons. The result shows that API sequence data can be used to train effective ransomware detection models in text-based manner.

Android malware detection based on sensitive patterns

In recent years, the rapid increase in the number and type of Android malware has brought great challenges and pressure to malware detection systems. As a widely used method in android malware detection, static detecting has been a hot topic in academia and industry. However, in order to improve the accuracy of detection, the existing static detecting methods sacrifice the excessively high analysis complexity and time cost. Moreover, the correlation between static features leads to redundancy of a large amount of data. Therefore, this paper proposes a static detecting method of Android malware based on sensitive pattern. It uses an improved FP-growth algorithm to mine frequent combinations of sensitive permissions and API calls in malicious apps and benign apps, which avoids the generation of redundant information. In addition, this paper adopts multi-layered gradient boosting decision trees algorithm to train the detection model. And a dual similarity combination method is proposed to measure the similarity between different sensitive patterns. The experimental results show that our proposed detection method has high accuracy and great generalization ability.

APIRO: A Framework for Automated Security Tools API Recommendation

Security Orchestration, Automation, and Response (SOAR) platforms integrate and orchestrate a wide variety of security tools to accelerate the operational activities of Security Operation Center (SOC). Integration of security tools in a SOAR platform is mostly done manually using APIs, plugins, and scripts. SOC teams need to navigate through API calls of different security tools to find a suitable API to define or update an incident response action. Analyzing various types of API documentation with diverse API format and presentation structure involves significant challenges such as data availability, data heterogeneity, and semantic variation for automatic identification of security tool APIs specific to a particular task. Given these challenges can have negative impact on SOC team’s ability to handle security incident effectively and efficiently, we consider it important to devise suitable automated support solutions to address these challenges. We propose a novel learning-based framework for automated security tool API R ecommendation for security O rchestration, automation, and response, APIRO . To mitigate data availability constraint, APIRO enriches security tool API description by applying a wide variety of data augmentation techniques. To learn data heterogeneity of the security tools and semantic variation in API descriptions, APIRO consists of an API-specific word embedding model and a Convolutional Neural Network (CNN) model that are used for prediction of top three relevant APIs for a task. We experimentally demonstrate the effectiveness of APIRO in recommending APIs for different tasks using three security tools and 36 augmentation techniques. Our experimental results demonstrate the feasibility of APIRO for achieving 91.9% Top-1 Accuracy. Compared to the state-of-the-art baseline, APIRO is 26.93%, 23.03%, and 20.87% improved in terms of Top-1, Top-2, and Top-3 Accuracy and outperforms the baseline by 23.7% in terms of Mean Reciprocal Rank (MRR).

Intelligent Hyperparameter-Tuned Deep Learning-Based Android Malware Detection and Classification Model

Recently, Android applications have been playing a vital part in the everyday life as several services are offered via mobile applications. Due of its market dominance, Android is more at danger from malicious software, and this threat is growing. The exponential growth of malicious Android apps has made it essential to develop cutting-edge methods for identifying them. Despite the prevalence of a number of security-based approaches in the research, feature selection (FS) methods for Android malware detection methods still have to be developed. In this research, researchers provide a method for distinguishing malicious Android apps from legitimate ones by using a intelligent hyperparameter tuned deep learning based malware detection (IHPT-DLMD). Extraction of features and preliminary data processing are the main functions of the IHPT-DLMD method. The proposed IHPT-DLMD technique initially aims to determine the considerable permissions and API calls using the binary coyote optimization algorithm (BCOA)-based FS technique, which aids to remove the unnecessary features. Besides, bidirectional long short-term memory (Bi-LSTM) model is employed for the detection and classification of Android malware. Finally, the glowworm swarm optimization (GSO) algorithm is applied to optimize the hyperparameters of the BiLSTM model to produce effectual outcomes for Android application classification. This IHPT-DLMD method is checked for quality using a benchmark dataset and evaluated in several ways. The test data demonstrated overall higher performance of the IHPT-DLMD methodology in comparison to the most contemporary methods that are currently in use.

MedicaidJS: a FAIR approach to real-time drug analytics

Abstract Motivation As prescription drug prices have drastically risen over the past decade, so has the need for real-time drug tracking resources. In spite of increased public availability to raw data sources, individual drug metrics remain concealed behind intricate nomenclature and complex data models. Some web applications, such as GoodRX, provide insight into real-time drug prices but offer limited interoperability. To overcome both obstacles we pursued the direct programmatic operation of the stateless Application Programming interfaces (HTTP REST APIs) maintained by the Food and Drug Administration (FDA), Medicaid, and National Library of Medicine. These data-intensive resources represent an opportunity to develop Software Development Kits (SDK) to streamline drug metrics without downloads or installations, in a manner that addresses the FAIR principles for stewardship in scientific data—Findability, Accessibility, Interoperability, and Reusability. These principles provide a guideline for continual stewardship of scientific data. Results MedicaidJS SDK was developed to orchestrate API calls to three complementary data resources: Medicaid (data.medicaid.gov), Food and Drug Administration (open.fda.gov), and the National Library of Medicine RxNorm (lhncbc.nlm.nih.gov/RxNav). MedicaidJS synthesizes response data from each platform into a zero-footprint JavaScript modular library that provides data wrangling, analysis, and generation of embeddable interactive visualizations. The SDK is served on github with live examples on observableHQ notebooks. It is freely available and can be embedded into web applications as modules returning structured JSON data with standardized identifiers. Availability and implementation Open source code publicly available at https://github.com/episphere/medicaid, live at episphere.github.io/medicaid, supplementary interactive Observable Notebooks at observablehq.com/@medicaidsdk/medicaidsdk.

A Novel Machine Learning Approach for Android Malware Detection Based on the Co-Existence of Features

This paper proposes a machine learning model based on the co-existence of static features for Android malware detection. The proposed model assumes that Android malware requests an abnormal set of co-existed permissions and APIs in comparing to those requested by benign applications. To prove this assumption, the paper created a new dataset of co-existed permissions and API calls at different levels of combinations, which are the second level, the third level, the fourth level and the fifth level. The extracted datasets of co-existed features at different levels were applied on permissions only, APIs only, permissions and APIs, and APIs and APIs frequencies. To extract the most relevant co-existed features, the frequent pattern growth (FP-growth) algorithm, which is an association rule mining technique, was used. The new datasets were extracted using Android APK samples from the Drebin, Malgenome and MalDroid2020 datasets. To evaluate the proposed model, several conventional machine learning algorithms were used. The results show that the model can successfully classify Android malware with a high accuracy using machine learning algorithms and the co-existence of features. Moreover, the results show that the achieved classification accuracy depends on the classifier and the type of co-existed features. The maximum accuracy, which is 98%, was achieved using the Random Forest algorithm and the co-existence of permissions features at the second combination level. Furthermore, the results show that the proposed approach outperforms the state-of-the-art model. Using Malgenome dataset, the proposed approach achieved an accuracy of about 98%, while the state-of-the-art achieved an accuracy of about 87%. In addition, the experiments show that using the Drebin dataset, the proposed approach achieved an accuracy of about 95%, while the state-of-the-art achieved an accuracy of about 93%.

Android malware classification using optimum feature selection and ensemble machine learning

The majority of smartphones on the market run on the Android operating system. Security has been a core concern with this platform since it allows users to install apps from unknown sources. With thousands of apps being produced and launched daily, malware detection using Machine Learning (ML) has attracted significant attention compared to traditional detection techniques. Despite academic and commercial efforts, developing an efficient and reliable method for classifying malware remains challenging. As a result, several datasets for malware analysis have been generated and made available during the past ten years. These datasets may contain static features, such as API calls, intents, and permissions, or dynamic features, like logcat errors, shared memory, and system calls. Dynamic analysis is more resilient when it comes to code obfuscation. Though binary classification and multi-classification have been carried out in recent studies, the latter provides valuable insight into the nature of malware. Because each malware variant operates differently, identifying its category might help prevent it. Using the well-known ensemble ML approach called weighted voting, this study performed dynamic feature analysis for multi-classification. Random Forest, K-nearest Neighbors, Multi-Level Perceptrons, Decision Trees, Support Vector Machines, and Logistic Regression are all studied in this ensemble model. We used a recent dataset named CCCS-CIC-AndMal-2020, which contains an extensive collection of Android applications and malware samples. A well-researched data preparation phase followed by weighted voting based on R2 scores of the ML classifiers presents an accuracy of 95.0% even after excluding 60.2% features, outperforming all recent studies.

LongCGDroid: Android malware detection through longitudinal study for machine learning and deep learning

This study aims to compare the longitudinal performance between machine learning and deep learning classifiers for Android malware detection, employing different levels of feature abstraction. Using a dataset of 200k Android apps labeled by date within a 10-year range (2013-2022), we propose the LongCGDroid, an image-based effective approach for Android malware detection. We use the semantic Call Graph API representation that is derived from the Control Flow Graph and Data Flow Graph to extract abstracted API calls. Thus, we evaluate the longitudinal performance of LongCGDroid against API changes. Different models are used, machine learning models (LR, RF, KNN, SVM) and deep learning models (CNN, RNN). Empirical experiments demonstrate a progressive decline in performance for all classifiers when evaluated on samples from later periods. Whereas, the deep learning CNN model under the class abstraction maintains a certain stability over time. In comparison with eight state-of-the-art approaches, LongCGDroid achieves higher accuracy.

Investigation of Android Malware Using Deep Learning Approach

In recent days the usage of android smartphones has increased extensively by end-users. There are several applications in different categories banking/finance, social engineering, education, sports and fitness, and many more applications. The android stack is more vulnerable compared to other mobile platforms like IOS, Windows, or Blackberry because of the open-source platform. In the Existing system, malware is written using vulnerable system calls to bypass signature detection important drawback is might not work with zero-day exploits and stealth malware. The attackers target the victim with various attacks like adware, backdoor, spyware, ransomware, and zero-day exploits and create threat hunts on the day-to-day basics. In the existing approach, there are various traditional machine learning classifiers for building a decision support system with limitations such as low detection rate and less feature selection. The important contents taken for building model from android applications like Intent Filter, Permission Signature, API Calls, and System commands are taken from the manifest file. The function parameters of various machine and deep learning classifiers like Nave Bayes, k-Nearest Neighbors (k-NN), Support Vector Machine (SVM), Ada Boost, and Multi-Layer Perceptron (MLP) are done for effective results. In our proposed work, we have used an unsupervised learning multilayer perceptron with multiple target labels and built a model with a better accuracy rate compared to logistic regression, and rank the best features for detection of applications and classify as malicious or benign can be used as threat model by online antivirus scanners.

Broadening The Solution Space of Feature Selection in Time-interval-based Malware Detection

In the last few years, the number of malware has grown exponentially. Malware has become the major medium for cyber criminals to conduct attacks and malicious actions, which has led to a lot of financial loss and data leakage. It is important to have an effective malware detection method to combat malware. Several malware detection methods were proposed recently. Many studies focus on dynamic analysis, which require malware to be executed. Some of them identify similarities among runtime API sequences or network behaviors, and some studies calculate occurrences of API calls and rank them to find the most discriminative features. A novel time-interval-based malware detection method was proposed in 2022, which mines the temporal relationships among the occurrences and tendencies of runtime API calls. This method has been demonstrated that it could outperform prior malware detection methods in terms of accuracy. However, the current time-interval-based malware detection method failed to explore a large enough solution space of feature selection, which could waste a lot of time and decrease accuracy. This paper illustrates that a broader feature selection solution space could generate better results, with the computational cost reduced by up to 27.1% and the accuracy increased by 4.7%. This paper also proposes a new time-interval-based malware detection method with the ability of more detailed adjustments in feature selection, which could reduce computational cost by up to 79.34%.

ARTE: Automated Generation of Realistic Test Inputs for Web APIs

Automated test case generation for web APIs is a thriving research topic, where test cases are frequently derived from the API specification. However, this process is only partially automated since testers are usually obliged to manually set meaningful valid test inputs for each input parameter. In this article, we present ARTE, an approach for the automated extraction of realistic test data for web APIs from knowledge bases like DBpedia. Specifically, ARTE leverages the specification of the API parameters to automatically search for realistic test inputs using natural language processing, search-based, and knowledge extraction techniques. ARTE has been integrated into RESTest, an open-source testing framework for RESTful APIs, fully automating the test case generation process. Evaluation results on 140 operations from 48 real-world web APIs show that ARTE can efficiently generate realistic test inputs for 64.9% of the target parameters, outperforming the state-of-the-art approach SAIGEN (31.8%). More importantly, ARTE supported the generation of over twice as many valid API calls (57.3%) as random generation (20%) and SAIGEN (26%), leading to a higher failure detection capability and uncovering several real-world bugs. These results show the potential of ARTE for enhancing existing web API testing tools, achieving an unprecedented level of automation.