API Calls Research Articles

An approach to dynamic malware analysis based on system and application code split

This paper discusses the development of tools for dynamic malware analysis. The main idea is to provide total control on a suspicious sample execution on the test computer. The approach we propose is to separate the application code from the system code by using memory pages access control. Thus, we are able to detect all system API calls and non-standard ways to transfer the control flow. Our tools (codename ToolChain) intentionally consist of a Control module, a Scheduling module, and a Cloaking module. In this paper, we focus mainly on the Control module. We monitor internal target process events by using invasive methods such as a system call hook or an executable file patch. This research describes the key creation stages of the prototype, with the basic functionality and technical ideas on handling several issues, such as analysis of multi-threaded applications, cloaking of the presence of analytical tools, and mitigation of the performance degradation of the operation system.

CRAFTS: Configurable REST APIs for Triple Stores

Massive amounts of Linked Open Data are readily available to anyone who wants to use them. Unfortunately, Semantic Web technologies such as SPARQL and RDF remain unfamiliar to the majority of web developers, more used to REST APIs. This paper addresses the challenge of accessing Linked Open Data through REST APIs. Configurable REST APIs For Triple Stores (CRAFTS) is the tool devised for this purpose. CRAFTS allows knowledge engineers to configure REST APIs over multiple triple stores. CRAFTS automatically handles the translation of API calls into SPARQL queries, delivering results in JSON format. Web developers can then use a CRAFTS API to read and write Linked Open Data. The API of CRAFTS is uniform, domain-independent, and described with the OpenAPI specification. A reference implementation of CRAFTS is published in a GitHub repository, and a live test site is readily available since February 2021. CRAFTS is currently employed in eight different applications, with more than 2.4K users, and more than 260K API calls.

Deep-Ensemble and Multifaceted Behavioral Malware Variant Detection Model

Every day, hundreds of thousands of new malware programs are developed and spread worldwide in cyberspace. Most of these malware programs are malware variants such as polymorphic and metamorphic malware, which are created from older versions of malware and able to change their structures and function flows to circumvent security solutions. The accuracy of malware variant detection is a crucial challenge. Many existing malware variant detections use static features extracted from the physical structure of malware file, such as opcodes and function flows. Unfortunately, the static features are subject to obfuscation and code shelling using simple obfuscation techniques. Although a malware variant can change its structure and function flows, it is widely believed that the malware variant cannot hide its malicious behavioral patterns during the runtime. Accordingly, dynamic, or behavioral analysis-based features were suggested by many studies to detect malware variants accurately. However, most of these studies are solely dependent on application-programmable interface calls (or API calls), which is not enough to accurately distinguish between malware and benign due to API-based obfuscation techniques. Therefore, a malware variant detection model that combines different behavioral activities can improve detection accuracy while reducing the false-negative rate. To this end, this study proposed a Deep-Ensemble and Multifaceted Behavioral Malware Variant Detection Model using Sequential Deep Learning and Extreme Gradient Boosting Techniques. Different behavioral features were extracted from the dynamic analysis environment. Then, a feature extraction algorithm that can automatically extract effective representative patterns has been designed and developed to extract the hidden representative features of the malware variants using a sequential deep learning model. These features have been fed into a developed extreme gradient boosting-based classifier for decision making. Extensive experiments have been carried out to validate the proposed scheme. The results were compared to the other related techniques in the field. The results show that the proposed model is reliable, as it improves the detection rate while reducing the false-negative rate.

A Software Development Kit and Translation Layer for Executing Intel 8080 Assembler on a Quantum Computer (August 2022)

One of the major obstacles to the adoption of quantum computing is the requirement to define quantum circuits at the quantum gate level. Many programmers are familiar with high-level or low-level programming languages but not quantum gates nor the low-level quantum logic required to derive useful results from quantum computers. The steep learning curve involved when progressing from quantum gates to complex simulations such as Shor's algorithm has proven too much for many developers. The purpose of this paper and the software presented within, addresses this challenge by providing a Software Development Kit (SDK), translation layer, emulator and a framework of techniques for executing Intel 8080/Z80 assembler on a quantum computer, i.e. all salient points of CPU execution, logic, arithmetic and bitwise manipulation will be executed on the quantum computer using quantum circuits. This provides a novel means of displaying the equivalency and interoperability of quantum and classical computers. Developers and researchers can use the SDK to write code in Intel 8080/Z80 assembler which is executed locally via traditional emulation and remotely on a quantum computer in parallel. The emulator features side-by-side code execution with visibility of the running quantum circuit and re-usable/overridable methods. This enables programmers to learn, reuse and contrast techniques for performing any traditional CPU based technique/instruction on a quantum computer; e.g. a programmer may know how to multiply and perform checks on a classical CPU but is not able to perform the same tasks in a quantum implementation, this SDK allows the programmer to pick and choose the methods they would like to use to fulfil their requirements. The SDK makes use of open-source software, specifically Python and Qiskit for the emulation, translation, API calls and execution of user supplied code or binaries.

An Android Malware Detection Approach Based on Static Feature Analysis Using Machine Learning Algorithms

In the past decade, mobile devices became necessary for modern civilization and contributed directly to its development stages in defining mobile information access. Nonetheless, along with these rapid developments in modern mobile devices, security issues rise dramatically, and malware is the most concerning of all. Therefore, many studies and research are still trending in this spectrum, using Machine Learning approaches to prevent and reduce malware’s impact. This paper seeks to add to what is already a foundation of various malware detection efforts by presenting a static base classification approach for malware detection based on android permissions and API calls. This approach is based on three well-known Machine Learning algorithms, Support Vector Machines (SVM), K-nearest neighbors (KNN), and Naive Bayes (NB) against a comprehensive new Android malware dataset (CICInvesAndMal2019), in pursuit of achieving high malware detection rates and contribution to the efforts and studies in protecting the development of mobile information. access.

Deep learning models for multi-class malware classification using Windows exe API calls

Deep learning models for multi-class malware classification using Windows exe API calls

AGEpy: A Python Package for Computational Biology

Summary: AGEpy is a Python package focused on the transformation of interpretable data into biological meaning. It is designed to support high-throughput analysis of pre-processed biological data using either local Python based processing or Python based API calls to local or remote servers. In this application note we describe its different Python modules as well as its command line accessible tools aDiff, abed, blasto, david, and obo2tsv.

CruParamer: Learning on Parameter-Augmented API Sequences for Malware Detection

Learning on execution behaviour, i.e., sequences of API calls, is proven to be effective in malware detection. In this paper, we present CruParamer, a deep neural network based malware detection approach for Windows platform that performs learning on sequences of parameter-augmented APIs. It first employs rule-based and clustering-based classification to assess the sensitivity of a parameter to malicious behaviour, and further labels the API following the run-time parameters with varying degrees of sensitivities. Then, it encodes the APIs by concatenating the native embedding and the sensitive embedding of labelled APIs, for characterizing the relationship between successive labelled APIs and their correspondence in terms of security semantics. Finally, it feeds the sequences of API embedding into the deep neural network for training a binary classifier to detect malware. In addition to presenting the design, we have implemented CruParamer and evaluated it on two datasets. The results demonstrate that CruParamer outperforms naïve models when taking raw APIs as input, proving the effectiveness of CruParamer. Moreover, we have evaluated the impact of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">mimicry</i> and adversarial attacks on our model, and the results verify the robustness of CruParamer.

Deep learning models for multi-class malware classification using Windows exe API Calls

Deep learning models for multi-class malware classification using Windows exe API Calls

Ensemble dynamic behavior detection method for adversarial malware

Behavior-based malware detection approaches combined with deep learning techniques are effective against unknown malware and malware variants. However, such approaches are vulnerable to adversarial attacks. Adversarial malware is carefully optimized to evade detection through embedding numerous anti-detection techniques, e.g., inserting irrelevant API calls or using API calls in loops during the program execution to mask the real malicious intentions. To address this problem, we propose a novel ensemble adversarial dynamic behavior detection method aiming at three features of malicious API sequence, namely Immediacy, Locality, and Adversary. The individual classifiers of the ensemble method follow the “excellent and diverse” principle. We conduct extensive experiments over large real benign and malicious instances and demonstrate a generic, query-efficient gray-box adversarial attack to evaluate our model. The experimental results indicate that, compared with the individual classifiers, the detection accuracy is improved by up to 2.55%∼11.34% (without anti-attack), 8.64%∼21.33% (random perturbation), and 10.07%∼21.34% (benign perturbation) respectively. To sum up, our method provides better effectiveness, generality, and resiliency in the absence of a constant re-training of the detector needed to cope with the evolution of adversarial malware.

DroidEnemy: Battling adversarial example attacks for Android malware detection

In recent years, we have witnessed a surge in mobile devices such as smartphones, tablets, smart watches, etc., most of which are based on the Android operating system. However, because these Android-based mobile devices are becoming increasingly popular, they are now the primary target of mobile malware, which could lead to both privacy leakage and property loss. To address the rapidly deteriorating security issues caused by mobile malware, various research efforts have been made to develop novel and effective detection mechanisms to identify and combat them. Nevertheless, in order to avoid being caught by these malware detection mechanisms, malware authors are inclined to initiate adversarial example attacks by tampering with mobile applications. In this paper, several types of adversarial example attacks are investigated and a feasible approach is proposed to fight against them. First, we look at adversarial example attacks on the Android system and prior solutions that have been proposed to address these attacks. Then, we specifically focus on the data poisoning attack and evasion attack models, which may mutate various application features, such as API calls, permissions and the class label, to produce adversarial examples. Then, we propose and design a malware detection approach that is resistant to adversarial examples. To observe and investigate how the malware detection system is influenced by the adversarial example attacks, we conduct experiments on some real Android application datasets which are composed of both malware and benign applications. Experimental results clearly indicate that the performance of Android malware detection is severely degraded when facing adversarial example attacks.

Applications of deep learning for mobile malware detection: A systematic literature review

For detecting and resolving the various types of malware, novel techniques are proposed, among which deep learning algorithms play a crucial role. Although there has been a lot of research on the development of DL-based mobile malware detection approaches, they were not reviewed in detail yet. This paper aims to identify, assess, and synthesize the reported articles related to the application of DL techniques for mobile malware detection. A Systematic Literature Review is performed in which we selected 40 journal articles for in-depth analysis. This SLR presents and categorizes these articles based on machine learning categories, data sources, DL algorithms, evaluation parameters & approaches, feature selection techniques, datasets, and DL implementation platforms. The study also highlights the challenges, proposed solutions, and future research directions on the use of DL in mobile malware detection. This study showed that Convolutional Neural Networks and Deep Neural Networks algorithms are the most used DL algorithms. API calls, Permissions, and System Calls are the most dominant features utilized. Keras and Tensorflow are the most popular platforms. Drebin and VirusShare are the most widely used datasets. Supervised learning and static features are the most preferred machine learning and data source categories.

FCSCNN: Feature centralized Siamese CNN-based android malware identification

Malware has been a serious threat to Android security since its inception. The key to defending against malware threats is how to extract the discriminative features of the apps and identify the samples. In order to alleviate the problem, a Siamese network is proposed to achieve high-performance Android malware detection. Meanwhile, a feature grouping (FG) strategy is also designed to choose valuable Permission and API calls effectively. In order to further improve the detection speed, a Feature Centralized Siamese Convolutional Neural Network (FCSCNN) is proposed, the benign and malicious mean centers are calculated from the sample database at first. Then, the distances between the application and the two centers are calculated to determine the class. Sufficient experimental results demonstrate that the proposed method FCSCNN can achieve the accuracy of 98.07% on the public dataset “VirusShare”, and the detection time is less than 0.1 s.

The role of feature-tracking strain analysis in the differentiation of cardiac amyloidosis from hypertrophic cardiomyopathy

Abstract Cardiac magnetic resonance (CMR) examinations have an essential role in the differentiation of cardiac involvement of amyloidosis (CA) from hypertrophic cardiomyopathy (HCM). The CMR diagnosis is traditionally based on morphologic features and the pattern of late gadolinium enhancement (LGE). However, in patients contraindicated for contrast agent administration, the diagnosis can be challenging. Novel CMR techniques, including strain analysis, can help in the differentiation of these patients. The aim of our study was to investigate the differential diagnostic and prognostic importance of feature-tracking strain analysis in patients with left ventricular hypertrophy caused by CA or HCM. We investigated 89 HCM patients (48 males; 50±18 years) and 46 CA patients (29 males; 64±10 years) who underwent CMR examination. The left ventricular ejection fraction (LVEF), volumes (end-diastolic volume: LVEDV, end-systolic volume: LVESV, stroke volume: LVSV), mass (LVM), and the amount of LGE were quantified. Global longitudinal (GLS), circumferential (GCS) and radial (GRS) LV strain parameters, and basal, midventricular, and apical LS and CS were measured. The apex-to-base regional LS and CS ratios were calculated. The all-cause mortality of the patients was analyzed. The characteristics of groups were compared with an independent t-test or Mann-Whitney test, as appropriate. ROC curve analysis was performed to analyze the diagnostic accuracy of a parameter and to identify optimal cutoff values. The prognostic value of CMR parameters was assessed with Cox proportional hazard regression analyses. Survival probability was analyzed with Kaplan-Meier curves and compared by the log-rank test. CA patients had significantly lower LVEF (51±11 vs. 63±8%; p&amp;lt;0.0001), lower LVSVi (43±12 vs. 54±12 ml/m2; p&amp;lt;0.0001), higher LVMi (94±24 vs. 79±24 g/m2; p&amp;lt;0.001), higher amount of LGE (29±15 vs. 8±8%; p&amp;lt;0.0001), and more impaired global and regional strain values (GRS: 55±22 vs. 93±29%; GCS: −33±10 vs. −42±8%; GLS: −18±4 vs. −25±6%; basal CS: −26±9 vs. −39±7%; basal LS: −15±4 vs. −22±6%; p&amp;lt;0.0001) than HCM patients. The apex-to-base CS and LS ratios were higher in CA patients, suggestive of apical sparing (1.71±0.68 vs. 1.29±0.33; p&amp;lt;0.0001; 1.88±0.76 vs. 1.57±0.62; p&amp;lt;0.05; respectively). In the differentiation of CA and HCM, LGE, basal CS, basal LS, GRS, and GLS had the highest diagnostic accuracies (AUCs: 0.911, 0.866, 0.848, 0.859, 0.849). During the mean 2.1±2.0 years of follow-up, three HCM patients (3.4%) and 29 CA patients (63%) died (p&amp;lt;0.0001). The significant independent predictors of mortality were a diagnosis of CA, LVSVi and basal LS. Our results show that CMR-based strain analysis might be a useful method for differentiating cardiac involvement of amyloidosis from HCM. Furthermore, this technique provides additional information for the assessment of prognosis in this patient population. Funding Acknowledgement Type of funding sources: Public Institution(s). Main funding source(s): National Research, Development and Innovation Office of Hungary; Ministry for Innovation and Technology in Hungary, within the framework of the Therapeutic Development and Bioimaging programmes of the Semmelweis University

Leveraging open data to reconstruct the Singapore Housing Index and other building-level markers of socioeconomic status for health services research

BackgroundSocioeconomic status (SES) is an important determinant of health, and SES data is an important confounder to control for in epidemiology and health services research. Individual level SES measures are cumbersome to collect and susceptible to biases, while area level SES measures may have insufficient granularity. The ‘Singapore Housing Index’ (SHI) is a validated, building level SES measure that bridges individual and area level measures. However, determination of the SHI has previously required periodic data purchase and manual parsing. In this study, we describe a means of SHI determination for public housing buildings with open government data, and validate this against the previous SHI determination method.MethodsGovernment open data sources (e.g. data.gov.sg, Singapore Land Authority OneMAP API, Urban Redevelopment Authority API) were queried using custom Python scripts. Data on residential public housing block address and composition from the HDB Property Information dataset (data.gov.sg) was matched to postal code and geographical coordinates via OneMAP API calls. The SHI was calculated from open data, and compared to the original SHI dataset that was curated from non-open data sources in 2018.ResultsTen thousand seventy-seven unique residential buildings were identified from open data. OneMAP API calls generated valid geographical coordinates for all (100%) buildings, and valid postal code for 10,012 (99.36%) buildings. There was an overlap of 10,011 buildings between the open dataset and the original SHI dataset. Intraclass correlation coefficient was 0.999 for the two sources of SHI, indicating almost perfect agreement. A Bland-Altman plot analysis identified a small number of outliers, and this revealed 5 properties that had an incorrect SHI assigned by the original dataset. Information on recently transacted property prices was also obtained for 8599 (85.3%) of buildings.ConclusionSHI, a useful tool for health services research, can be accurately reconstructed using open datasets at no cost. This method is a convenient means for future researchers to obtain updated building-level markers of socioeconomic status for policy and research.

MapperDroid: Verifying app capabilities from description to permissions and API calls

Android Applications (Apps) are usually accompanied by a text description and a permissions manifest which are expected to describe the app behaviour. However, an app may request or use more permissions than what has been described. Therefore, the permissions declared in the application manifest alone can not be interpreted as the ground truth. Recent literature reported that malicious apps under-report permissions. Such a scenario is a security and privacy risk. In this work, to discover such instances, we establish a correspondence from the application description to the permissions manifest leading to the Android API calls of the app. After experimentation on more than 25,000 random apps from Google Play Store over 19 different Android permissions, we show that a vast majority of apps understate at least one permission. This phenomenon raises data privacy and security concerns due to over-privileged application binaries. The correspondence is of significance because each additional permission corresponds to one or more sensitive or protected API calls made by the app which is not explicitly known to the user. We created a data set for our work which contains app metadata from where different permission sets are obtained. Our approach to detect under-reporting of permissions is scalable with respect to the number of apps.

Технология идентификации ключевых особенностей в последовательностях API-вызовов вредоносных программ

Today, almost everyone is faced with computer security problems in one or another way. Antivirus programs are used to control threats to the security of malicious software. Conventional methods for detecting malware are no longer effective enough; nowadays, neural networks and behavioral analysis technology have begun to be used for these purposes. Analyzing the behavior of programs is a difficult task, since there is no clear sequence of actions to accurately identify a program as malicious. In addition, such programs use measures to resist such detection, for example, noise masking the sequence of their work with meaningless actions. There is also the problem of uniquely identifying the class of malware due to the fact that malware can use similar methods, while being assigned to different classes. In this paper, it is proposed to use NLP methods, such as word embedding, and LDA in relation to the problems of analyzing malware API calls sequences in order to reveal the presence of semantic dependencies and assess the effectiveness of the application of these methods. The results obtained indicate the possibility of identifying the key features of malware behavior, which in the future will significantly improve the technology for detecting and identifying such programs.

Enhancing Search-based Testing with Testability Transformations for Existing APIs

Search-based software testing (SBST) has been shown to be an effective technique to generate test cases automatically. Its effectiveness strongly depends on the guidance of the fitness function. Unfortunately, a common issue in SBST is the so-called flag problem , where the fitness landscape presents a plateau that provides no guidance to the search. In this article, we provide a series of novel testability transformations aimed at providing guidance in the context of commonly used API calls (e.g., strings that need to be converted into valid date/time objects). We also provide specific transformations aimed at helping the testing of REST Web Services. We implemented our novel techniques as an extension to EvoMaster , an SBST tool that generates system-level test cases. Experiments on nine open-source REST web services, as well as an industrial web service, show that our novel techniques improve performance significantly.

Machine Learning Techniques for Malware Detection with Challenges and Future Directions

In the recent times Cybersecurity is the hot research topic because of its sensitivity. Especially at the times of digital world where everything is now transformed into digital medium. All the critical transactions are being carried out online with internet applications. Malware is an important issue which has the capability of stealing the privacy and funds from an ordinary person who is doing sensitive transactions through his mobile device. Researchers in the current time are striving to develop efficient techniques to detect these kinds of attacks. Not only individuals are getting offended even the governments are getting effected by these kinds of attacks and losing big amount of funds. In this work various Artificial intelligent and machine learning techniques are discussed which were implements for the detection of malware. Traditional machine learning techniques like Decision tree, K-Nearest Neighbor and Support vector machine and further to advanced machine learning techniques like Artificial neural network and convolution neural network are discussed. Among the discussed techniques, the work got the highest accuracy is 99% followed by 98.422%, 97.3% and 96% where the authors have implemented package-level API calls as feature, followed by advanced classification technique. Also, dataset details are discussed and listed which were used for the experimentation of malware detection, among the many dataset DREBIN had the most significant number of samples with 123453 Benign samples and 5560 Malware samples. Finally, open challenges are listed, and the future directions are highlighted which would encourage a new researcher to adopt this field of research and solve these open challenges with the help of future direction details provided in this paper. The paper is concluded with the limitation and conclusion section

A Multi-Perspective malware detection approach through behavioral fusion of API call sequence

The widespread development of the malware industry is considered the main threat to our e-society. Therefore, malware analysis should also be enriched with smart heuristic tools that recognize malicious behaviors effectively. Although the generated API calling graph representation for malicious processes encodes worthwhile information about their malicious behavior, it is pragmatically inconvenient to generate a behavior graph for each process. Therefore, we experimented with creating generic behavioral graph models that describe malicious and non-malicious processes. These behavioral models relied on the fusion of statistical, contextual, and graph mining features that capture explicit and implicit relationships between API functions in the calling sequence. Our generated behavioral models proved the behavioral contrast between malicious and non-malicious calling sequences. According to that distinction, we built different relational perspective models that characterize processes’ behaviors. To prove our approach novelty, we experimented with our approach over Windows and Android platforms. Our experimentations demonstrated that our proposed system identified unseen malicious samples with high accuracy with low false-positive. In terms of detection accuracy, our model returns an average accuracy of 0.997 and 0.977 to the unseen Windows and Android malware testing samples, respectively. Moreover, we proposed a new indexing method for APIs based on their contextual similarities. We also suggested a new expressive, a visualized form that renders the API calling sequence. Consequently, we introduced a confidence metric to our model classification decision. Furthermore, we developed a behavioral heuristic that effectively identified malicious API call sequences that were deceptive or mimicry.